User-held by architecture
The private record belongs to you, not to Olocus. The relay
holds only encrypted scoped-proof bytes the device chose to
upload, and only for as long as the user keeps them active.
EU jurisdictional anchor
The relay's data plane is provisioned with the strongest
available EU data-residency setting. The self-hosted maps
backend at maps.olocus.com runs under the same
posture — EU-pinned storage, the same honest-metadata invariants
— so map tiles, geocoding, and routing never leak to a
third-party CDN. Workers run at the edge nearest each user;
durable state stays inside the EU jurisdiction boundary.
No public graph, no broker
Olocus does not maintain a directory, a feed, a reputation
score, or a contact-discovery surface. Witnesses are bounded
corroborators — never generic endorsers.
Selective disclosure by default
Proofs answer specific questions. The underlying graph never
leaves the device. Relationship leakage — what a proof reveals
beyond its question — is treated as disclosure, not a footnote.