We are not in the data business.

Our position

Personal data is a liability, not an asset.

wellknown.id ltd does not collect personal information to build profiles, and never sells, rents or shares it for advertising or any other purpose. Our services are designed so that we can’t hold what we don’t need: wherever it is technically possible, claims about you travel over a secured channel straight from your own device to the person or service that needs them, and not through us.

That principle shapes everything below. Where we process anything at all, it is the minimum needed, for the shortest time. For a plain account of what our server can and can’t see, and what a break-in would expose, see what we can see.

Who is responsible

The controller of any personal data described here is wellknown.id ltd (company number 17105257), 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom, registered with the Information Commissioner’s Office under reference ZC258111. For anything about your data, email privacy@wellknown.id.

This website

• No cookies, no analytics, no tracking. Nothing on this site measures or follows you.
• No third parties. Fonts and everything else are served from our own site, so your browser doesn’t contact anyone else.
• One preference, kept in your browser. If you switch the UV lamp on or off, that choice is saved in your browser’s local storage. It is never sent to us. See the cookie policy.
• No request logs. Like any website, our server necessarily receives your IP address and basic browser details with each request, to send the page back. We don’t record them: our server keeps no access or request logs.

Signing in with wellknown.id

When the sign-in service is live, this is what it will involve.

• Your keys stay with you. Each site gets its own key, made in your browser, where it can’t be exported, or derived from your wellknown.id passkey if you choose one, which never leaves your device. We never receive a private key.
• Your identifier. To sign you in to a site, we receive the public half of that site’s key, its did:key, in a short-lived token your browser signs to prove you hold it. A did:key isn’t your name, but it is a stable identifier at that site, so we treat it as personal data. A site that takes that token straight from your browser (if it chooses to) means we don’t receive your did:key at all.
• What we pass on, and to whom. Only to the site you chose to sign in to, and only because you asked us to: a signed token containing your did:key, which site it’s for, and when it was issued and expires. Never your name, email address, date of birth or anything else, because we don’t have them.
• What we keep: nothing about you. There is no user database, and nothing about a sign-in is written to disk or to our logs. What a sign-in needs is held in our server’s memory only while it happens: your did:key and the site, in the one-time authorization code we hand the site, until the site exchanges it for its token or for one minute at most, whichever comes first; the one-time challenge, which names no one, within five minutes. No cookie notes which key you used at which site: the only cookies are two that tie the steps of one sign-in together, holding a random number, deleted when you’ve proved your key. Your record of where you signed in is yours: your own device encrypts it, under keys only your wellknown.id gives, before our store keeps it, so the store holds ciphertext it can’t read or link to you. Details are in the cookie policy.
• No access to anything else. The site gets a signed token naming your did:key, and nothing it can bring back to us for more: there is no endpoint that hands out information about you.
• Sites you sign in to are separate organisations with their own privacy policies. We only confirm that you hold your key.

Every site gets a different did:key, so sites can’t compare notes about you by your key.

Having a document witnessed

If you ask wellknown.id to witness a passport or identity card, the kivi app on your phone carries our service’s questions to the document’s chip and its answers back. To check that the chip is genuine and that its issuing state signed its data, we read the chip’s data page (name, date of birth, nationality, sex, document number, expiry and issuing state) and its security files. Never your photograph.

• What we keep: nothing. The data page is in memory for the few seconds the check takes, then discarded; it isn’t written to disk or logs, or passed to anyone.
• What you get: single-use credentials, signed by us, that say only what your document proves (age thresholds, nationality, issuing country), each bound to its own key on your phone.
• Why we’re allowed to: to provide the service you ask for (performance of a contract).

kivi shows you the full notice, version 1, and asks you to agree before you use the witness. It’s also published in our /.well-known/id configuration, pinned by its hash, so what we promised and when is on public record.

Who helps us

• Hosting: this site and the sign-in service run on a virtual server we rent from Fasthosts, in a UK data centre. Like any network provider, their network protection may briefly process connection details to block attacks.
• Email: our mailboxes, including hello@ and privacy@wellknown.id, are also hosted by Fasthosts in the UK. We use what you send only to reply to you.
• Backups: so you can still get back in if our server is lost, an encrypted copy of our store (what your devices keep there, which is already encrypted under keys only your wellknown.id gives) and of our witness’s signing key is kept by Hetzner Online, a German company, in its data centre in Helsinki, Finland. We encrypt each copy again before it leaves our server, so Hetzner holds only data it can’t read. Copies are kept for up to about six months.
• Domain name: our domain is registered with Porkbun, a US company, whose name servers (run through Cloudflare’s network) answer the lookups that find our servers. Those lookups come from your internet provider’s or your chosen DNS resolver, not from your browser, and tell Porkbun nothing about you.

Nobody else receives data from us: no analytics, advertising or data brokers.

Why we’re allowed to process it

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), we process your did:key to provide the sign-in you ask for (performance of a contract). We handle request information on this website to keep it secure and working (legitimate interests).

Your rights

You have the right to access, correct, erase or restrict the processing of personal data about you, to object to processing, and to data portability. Email privacy@wellknown.id. We’ll respond within one month, and very often the answer will be that we hold nothing about you.

Your keys live in your browser, or come from your passkey. To delete them, clear the site data for wellknown.id in your browser’s settings, and delete your wellknown.id passkey if you made one. Our server keeps nothing about you to delete; what your devices keep encrypted in our store only your wellknown.id can read, filed under names we can’t link to you. Encrypted copies of that store are kept in our backups for up to about six months, then deleted.

If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put it right first.

Changes

If this policy changes, we’ll update this page and the date below. We will never change it to allow selling or profiling.

Last updated 2 October 2026.