# Sphinixx Public-Surface Privacy

Protection of streamers, viewers and individual participants is a core Sphinixx design objective. The public surface explicitly considers children and people exposed to stalking, grooming, harassment, coercion or doxxing, including risks disproportionately experienced by women.

The website must not become a participant directory or general contact-data collection layer. Public/social identity is tag-first. Do not add public participant email, phone, address, precise-location, financial, credential, secret or unnecessary real-name fields.

The homepage's mailing-list join is a narrow email-only exception for occasional development, testing and release updates. It requires explicit opt-in, asks for no name or profile data, and uses the visitor's email application rather than transmitting or storing an address in the static page. Mailing-list addresses must never become public participant identity, must not be reused for unrelated purposes, and must be removed when a recipient asks to leave the list.

Chat is not private. The Content Server owns authoritative deterministic privacy enforcement. Client masking is immediate protection only. Optional AI/provider review is advisory and cannot override deterministic rejection.

Public images and downloadable media should be checked for unnecessary EXIF/GPS metadata and filenames/captions that disclose private identity before publication.