A session is made from the machine and the work.
A session is one recording of one person working, sealed when it is made. It carries what the hands did, how the machine answered, and what the person could see — and it carries, inside itself, who made it and what they permitted. It is personal information in every regime that matters, and it is handled as personal information at every step after it.
One person, one sitting, sealed at the moment it is made.
A session is not a shift of telemetry gathered in the background and sorted out later. It is one recording of one person working one machine, opened once, closed once, and sealed when it closes. Sealing is what makes every later step checkable: an admission decision, a registry entry and a count line all refer back to an object that cannot have been altered afterwards without the seal saying so.
The narrowness is deliberate. A record that cannot be resolved to one person cannot carry a per-person count or a per-person withdrawal, and a promise made over such a record is a promise about something nobody can address. One person, one sitting, one family of machine — that is the unit, and everything this company undertakes is undertaken at that granularity.
- One person
- One named operator, in their own seatNot a crew, not a shift, not a site
- One sitting
- Opened once and closed onceNot a day's accumulation
- One family
- The family of machine that was being workedAn entry does not generalize sideways
- Sealed
- Closed when it is made, and marked soA digest of the contents travels with it
Identity and permission travel inside the record, not in a register beside it.
A register kept beside a record is a second object, and a second object can drift from the first. Ours does not exist, because there is nothing left for it to hold.
Who made it, and what they permitted
The name the record was made under travels in the record, and so do the permissions that were live at the moment of recording. Nothing downstream has to look a person up to know whose work it is, which means nothing downstream can look the wrong person up, and nothing downstream can read a permission that was written after the fact.
What the hands did
The work itself: what was asked of the machine's controls, in the order it was asked. This is the substance of a way of working. It is also the part that makes the person identifiable, which is why the rest of this page reads the way it does.
How the machine answered
What the machine did in response. Without it there is no way to tell a way of working apart from the iron that was carrying it — the same input on a different machine is a different job, and a record that omits the answer cannot support that distinction.
What the person could see
The state of the work in front of them at the time. A decision separated from the situation it was taken in is not a way of working; it is a movement. Judgment lives in the relation between the two, and a record that drops one half of it keeps nothing worth licensing.
A record is made from the machine and the work.
What enters a record, and what is kept outside it.
The dashed rule is the whole figure. What sits on the far side of it is not a thing we hold back on request; it is a thing the record was never built to contain.
Fig. 1 — What enters a record and what is kept outside it. The dashed rule is a boundary, not a setting.
It is personal information, and the reason is identifiability.
Four definitions were read at first hand for this site, and every one of them turns on the same thing.
PIPEDA s.2(1), Alberta's Personal Information Protection Act s.1(1)(k), British Columbia's Personal Information Protection Act s.1 and GDPR Art. 4(1) all define personal information by whether a person can be identified from it. Not one of them contains any concept resembling authorship or contribution. The person recorded is protected because they are identifiable in the record — not because they made what is in it.
That distinction runs through everything here. The law protects the person in the record and says nothing at all about the person whose skill it is. Those are two different claims about the same human being, and only one of them has an instrument behind it.
The movement is the identifier
This is not a theoretical property of the material. In Unique Identification of 50,000+ Virtual Reality Users from Head & Hand Motion Data (Nair, Guo, Mattern, Wang, O'Brien, Rosenberg and Song, 32nd USENIX Security Symposium, 2023), more than fifty thousand people, drawn from several hundred thousand sessions of ordinary play with no biometric enrolment of any kind, were identified from motion alone — from around a hundred seconds of head and hand movement, better than nine times in ten.
Take that as an order of magnitude rather than a constant, and take it for what it was measured on and nothing else. Nothing is read across from it to any other kind of movement; no study at comparable scale exists for how a person walks, and we do not borrow one. What the result establishes is narrow and sufficient: fine-grained movement, recorded at length, identifies the person who produced it, without anyone setting out to collect an identifier.
There is no anonymous version of it
A movement trace with the individuating detail taken out is a movement trace with the skill taken out.
We never describe a record as anonymous, anonymized, de-identified or aggregated, because it is none of those things and nothing here rests on it being any of them. The detail that makes a way of working worth licensing is the same detail that makes the person identifiable. Take it out and there is nothing left to license; leave it in and the record identifies its maker, permanently. Every rule on the rest of this page follows from accepting that rather than working around it.
A record is held, and a record is never supplied.
-
01
Never to assess the person A record is never supplied to assess the person, to an insurer or to anyone else. It exists to build an entry and to answer an audit of the count. It does not exist to support a view about how someone works, and it is not released to anyone who wants to form one — not an employer, not a licensee, not us.
-
02
Never to a machine A machine never receives a session. What crosses to a machine is a release: a sealed package built for the controls that machine already has, carrying a digest of what went into it and never the contents. No recording, no part of one, and nothing identifying the person beyond the name the licence runs under.
-
03
Held separately addressable One person's records stay one person's records, addressed by name, one at a time. That is what makes a per-person count and a per-person withdrawal honourable rather than decorative — a promise to remove a person's contribution is worth what the architecture makes it worth, and no more.
-
04
Ended on the person's word Permission is ended free, on the person's own say, effective on receipt, needing nobody's agreement. Two dates follow and the person is told both, never one: the out-of-service date, when the entry stops being choosable, and the true date, when the last copy is gone, backups included. The shorter is never allowed to stand in for the longer.
The law hands a holder nothing, so the protection has to be built.
There is a reason the four rules above are written as things we undertake rather than as things a statute already requires of us. In the instruments surveyed for this site, there is no provision anywhere conferring on the holder of a recording any positive entitlement in respect of it. No right to exclude. No right to be compensated for another's use. No term, and no registry. And if a recording of a worker escapes, the person with a remedy is the worker, not the holder.
Read that the right way round and it is the argument for this whole company. The law gives the person in the seat a protection that is real but narrow — they are protected because they can be identified, not because the work is theirs — and it gives the holder of the record nothing at all to trade on. So a promise to a person in a seat has to be built, in the architecture and in the paper, or it does not exist. That is what the record is shaped for.
Need to know what your corpus can and cannot contain?
Admission is the step that answers it. The licence sets the terms; the record sets what there is to license.