A Democratic Model for
Ethical Civic Data
A participant-owned system for collecting, protecting, and commercializing civic sentiment — designed so that the people who generate the data govern and benefit from it.
Participant-Owned. Democratically Governed.
The Forum Initiative operates as a data cooperative — a legal and technological entity in which participants collectively own, govern, and benefit from the system they contribute to. Think of it as a self-funding focus group that owns its data and the infrastructure it runs on.
Member Ownership
Participants are not users of a platform — they are members of a cooperative. Ownership of the system and its data is distributed among those who contribute to it.
Democratic Governance
Decisions about data use, revenue allocation, and system policy are made collectively. No single actor — including the founders — holds unilateral authority over member data.
Accountability by Design
The cooperative structure creates a formal relationship of accountability to its members — not to advertisers, platforms, or third-party data brokers.
Technical Incapacity by Design
Privacy is not a policy promise written into a terms of service. It is an architectural commitment — built into the system so that certain actions are structurally unsupported, regardless of who operates it.
The surveillance or re-identification of any participant is not prohibited by policy. It is made structurally impossible by the architecture itself.
Pseudonymization
Submissions are pseudonymized by design. Raw identity is never stored alongside content — only a cryptographic hash that participants control.
Zero-Knowledge Proofs
Eligibility and identity are verified cryptographically without revealing the underlying information. The system confirms without learning.
No Raw Storage
Raw text is permanently deleted after aggregation. The system retains only processed, anonymized outputs — never source material.
Physical Isolation
A hardware-enforced data diode ensures that the analysis environment is physically unreachable from the public internet.
How a Submission Moves Through the System
Each submission passes through four discrete phases before it becomes part of an aggregate dataset. At no point in this process does the system retain the ability to connect a submission to its author.
Identity Verified. Identity Separated.
The participant's device performs a live biometric check using the phone's secure enclave. This confirms eligibility. The device then bundles a Zero-Knowledge Proof, a payout hash, and the submission into a single encrypted package — discarding the identity before anything leaves the device.
Zero-Knowledge Proof · Biometric Verification · Secure EnclaveCollected. Scrambled. Delayed.
The web server acts as a staging bucket only. It collects encrypted payloads, randomizes their order, and introduces transmission delays — severing any remaining metadata links such as IP address or timestamp that could be used to identify a contributor.
Metadata Severance · Payload Randomization · No Identity AccessOne Direction Only.
A physical data diode enforces a hardware-level, one-way transfer from the web server to the offline analysis environment. This is not a software firewall — it is a physical constraint. A compromised web layer has no pathway to access, query, or communicate with the secure environment.
Data Diode · Physical One-Way Enforcement · Air-Gapped AnalysisProcessed. Logged. Deleted.
The offline server verifies the Zero-Knowledge Proof, runs AI-assisted analysis on the content, and logs the payout hash into the encrypted database. Raw text is then permanently deleted from memory. What remains is aggregate sentiment data — with no path back to any individual.
ZKP Verification · Local AI · Permanent Raw DeletionThe Data Generates Value. Members Share In It.
Aggregate civic sentiment data has real market value to policy researchers, academic institutions, and civic organizations. Rather than capturing that value for a platform, the cooperative model returns it to participants.
Submission
A participant submits a verified response. A payout hash is generated and logged to the database.
Aggregation
Submissions are processed into anonymized datasets. Individual contributions are indistinguishable within the aggregate.
Data Sale
Aggregate datasets are made available to qualified buyers — researchers, policy bodies, and civic institutions.
Distribution
Revenue is distributed to participants via their payout hash. No personal information is required to claim compensation.