A security model explains what's protected from attackers. A privacy model answers a different question: what data exists at all, who sees it, and where does it go. This is that answer, plainly.

No ads, no data sale, no tracking pipeline

Citinet doesn't run ads. There's no analytics-and-advertising business model here to fund, which means there's no incentive baked into the product to harvest behavioral data. Nothing about how a hub works involves selling, renting, or sharing member data with advertisers or data brokers, because there's no mechanism in the product that does that at all; not "we promise not to," but "the pipe doesn't exist."

What's public, and why

If you post something to your hub's feed, a space, or a public event, that's public, the same as posting on any forum or community platform. Your hub's members (and, if you've set your hub or profile to be publicly discoverable, anyone) can see it. That's the whole point of a community feed: it's meant to be read.

Your profile; display name, bio, the tags you pick, your public posts, works the same way. You choose your profile's visibility (public, hub members only, or private), and that choice is respected.

What's private, and what "private" actually means here

Direct messages, private notes, and private files are end-to-end encrypted; encrypted on your device before they're sent, decrypted only on the receiving device. The hub's own database stores unreadable ciphertext. This isn't "we promise not to look", it's "there is nothing readable to look at" without a key that never leaves your device. The technical detail is in the companion Security & Trust Model post; the short version is: your hub operator cannot read your private notes or your messages.

The one honest exception: AI conversations (currently)

If your hub has an AI assistant enabled, conversations with it are not end-to-end encrypted, and can't be: the AI model runs on the hub's own server, and it needs to actually read your message to generate a response. There's no way to encrypt a prompt from a server-side AI and still have that AI answer it; that's true of any product with a server-side AI feature, not a Citinet-specific shortcoming.

This matters enough to say clearly, on its own, separate from everything else: "your notes are encrypted" and "your AI conversations are encrypted" are not the same claim. If your hub runs local AI, treat conversations with it more like a conversation with a person who works at the hub than like a private note to yourself.

What leaves your hub at all

Citinet hubs are independent: most of what happens on your hub stays on your hub's own database. A small amount of information does leave, and here's what it is:

• If your hub is set to be publicly discoverable, its name, location (general area by default), description, and member count are shared with a central directory so people can find it, the same way a public forum is listed somewhere. This is opt-in at hub creation, not automatic.

• Automatic HTTPS setup involves an exchange with a central certificate service that issues your hub's certificate and points your hub's subdomain at its network address, so devices on your network can reach it securely. That service manages the DNS record and certificate needed to make this work; it never sees your hub's content, and holds nothing beyond what's needed to keep that address and certificate current.

• Nothing else leaves by default. No third-party analytics, no ad pixels, no data pipeline to anywhere else.

Metadata is a real, known limitation

Encryption protects the content of a private message or note. It doesn't fully hide that a conversation exists, roughly when it happened, or its approximate size; that's a limitation shared by essentially every end-to-end encrypted messaging system that exists, including the well-known ones, not something unique to Citinet. We're not going to claim otherwise.

Your hub operator can see member-level information

Usernames, the fact that you joined, your last-active time, and (if you provided one) an email address are visible to your hub's operator, the same way any community organizer knows who's a member of their community. This is inherent to joining someone's hub, not a hidden data-collection practice.

Deleting your account

Deleting your account removes your profile and account data from the hub.

Content you posted publicly (posts, replies) that other people may have already seen, saved, or built on top of behaves the way public content on any platform does; deleting your account doesn't reach into other people's devices or unwind a public conversation already in progress. Your encrypted private content (notes, messages, files) is deleted along with your account and was never readable by anyone but you to begin with.

The short version

Public is public. Private is genuinely private; encrypted on your device, unreadable by the hub, with one clearly-marked exception (server-side AI, which can't be end-to-end encrypted by its nature). Nothing is sold, nothing is tracked for ads, and almost nothing leaves your hub at all. That's the actual shape of it: not a promise to trust, a design to check.