What I collect. Short list.

Your email address, used to deliver your certificate and, only if you tick the box, milestone updates. Your country, only if you choose to tell us, and whether you want it shown. Payment metadata from Stripe: a payment id, amount, currency, processing fee, status and the country of the card. The card number, expiry and security code never reach this site; Stripe handles them.

Your certificate number, its artwork and traits, the issue date, its status (active or reversed), and the country if you opted in. The public ledger also publishes a keyed hash of your email: a one-way value that lets you prove a certificate is yours without revealing the address. Your email, name and payment details are never public.

Data is stored in a Supabase database (Postgres) and processed by Stripe (payments) and Resend (transactional email). The site runs on DigitalOcean. Each of those providers has its own privacy policy and security practices. The operator does not sell, rent or share your data with anyone else, and does not run advertising or third-party trackers on the site.

The site sets no marketing cookies. Stripe sets cookies on its own checkout domain for fraud prevention. Any analytics used are aggregate and anonymous; if that changes, this page will say so first.

You get one transactional email per payment with your numbers. Milestone updates are only sent if you opted in, and every one of them has an unsubscribe link. There is no newsletter and no marketing list.

Payment and certificate records are kept for as long as the experiment and its ledger exist, and as long as tax and anti-fraud rules require. Because the ledger is hash-chained and anchored, a certificate record cannot be deleted without breaking the chain; your email can, however, be removed from the record on request while the keyed hash stays.

You can ask what data is held about you, ask for your email to be corrected or removed, withdraw consent for milestone updates, or object to processing, by writing to [email protected]. Requests are answered within 30 days. If you are in the EU or UK you also have the right to complain to your local data protection authority; in Brazil, to the ANPD.

ONE. is not intended for anyone under 18. If you believe a minor has paid, write to [email protected] and the payment will be reversed.

This page may change; the date at the top tells you when. The operator is an individual based in Brazil, acting as data controller. Contact: [email protected].