compliance

Version 1.0, 11 Oct 2026. Elliott Wave LLC makes khensu.ñü.

khensu.ñü complies with privacy and data protection law the strongest way there is: by not having your data. Messages, calls, payments, files, contacts and search stay on your devices, encrypted end to end with post-quantum cryptography. Nothing is processed on a server. This document lists every place personal data could exist, the laws that apply, and how each requirement is met.

1. personal data inventory

Everything khensu.ñü, its network or its sites could touch, and what happens to it.

There are no accounts with names, phone numbers or email addresses in the app. There is no advertising, no profiling, no data sale or sharing, and no data broker relationship of any kind.

2. roles

• Elliott Wave LLC is the controller for the website, the email you send us, the credential issuer and the push gateway.
• Node operators run independent software that forwards sealed, fixed-size packets. The only personal data a node handles is the IP address of a device connected to it, in memory, for transmission. The node software has no IP logging and no way to read packet contents.
• You control everything in the app. Your devices do all the processing.
• Developers building on webË are controllers for their own apps. Section 6 covers what khensu-core does for them.

3. privacy and data protection laws

3.1 coverage

3.2 principles (GDPR article 5)

• Data minimisation and purpose limitation: the protocol has no field for a name, phone number, email address, location or contact list. Data that doesn’t exist can’t be misused, breached or repurposed.
• Storage limitation: every server-side item in section 1 is transient or deleted on a fixed schedule.
• Integrity and confidentiality: ML-KEM-1024, ML-DSA-87, AES-256-GCM and SHA-512 everywhere, with no classical fallback (section 5).
• Accountability: this document, the open specifications and reproducible builds let anyone check every claim.

3.3 lawful bases

No processing relies on consent that could be withdrawn and no processing involves special category data (Article 9). There is no automated decision-making or profiling (Article 22).

3.4 rights

3.5 international transfers

Content never leaves your devices readable, so no readable personal data is transferred anywhere. Packets cross borders the way any internet traffic does, sealed. Email and website delivery use providers bound by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework where applicable.

3.6 security and breaches

• A breach of any node, mailbox, the issuer or the gateway exposes sealed packets, nothing readable (THREAT-MODEL.md).
• Breaches of the data in section 1 that we control are notified to the supervisory authority within 72 hours and to affected people without undue delay (GDPR Articles 33, 34; state breach laws).
• Data protection by design and by default (Article 25) is the architecture: stealth and end-to-end encryption can’t be turned off.
• A data protection impact assessment (Article 35) covers the app, the network, the issuer and the gateway, and is published with the specifications.

3.7 children

khensu.ñü is for people 13 and older, or the age of digital consent in their country if higher (16 in some EU member states). The app collects no personal information from anyone, so it collects none from children. Parental controls on Apple devices (Screen Time) apply as with any app.

3.8 representatives

Elliott Wave LLC is established in the United States. Our processing of people in the EU and UK is occasional, low-risk and involves no special category data, so the Article 27 representative requirement doesn’t apply (GDPR Article 27(2)(a)). Contact for every privacy matter: hello@elliottwave.studio.

4. platform and content rules

5. cryptography and security standards

6. for developers on webË

Apps built on khensu-core inherit the architecture above:

• Content is end-to-end encrypted on device; there is no server-side API to send user data to.
• Stealth and post-quantum encryption can’t be turned off, so a webË app can’t leak who talks to whom.
• Sites can’t reach the ordinary web or third parties unless their policy lists them, so third-party tracking is blocked by construction.
• The App Store privacy label for a webË app built only on khensu-core is Data Not Collected, unless the developer adds collection of their own.

A developer who adds their own collection is the controller for it and must meet these laws themselves. App commerce (design/app-commerce.md) gives buyers anonymous entitlements, so developers receive no buyer identity.

7. accessibility

8. export controls

khensu.ñü’s encryption is mass-market software under the US Export Administration Regulations (ECCN 5D992.c under License Exception ENC, section 740.17(b)(1)), with the annual self-classification report filed with BIS and the NSA. Open-source repositories are published under section 734.3(b)(3) with notice to BIS. App Store export compliance documentation is filed with Apple. The app isn’t offered in countries under comprehensive US embargo.

9. payments

• Network payments are self-custodied: khensu.ñü never holds your funds or keys.
• No card data touches khensu.ñü, its nodes or its sites, so PCI DSS scope is nil.
• Where a licensed third party provides card payments or on-ramps, that party meets its own licensing, anti-money-laundering and sanctions obligations.

10. suñůlink.shield

suñůlink.shield ships with:

11. contact

• Privacy and data protection: hello@elliottwave.studio
• Security: security@elliottwave.studio, /.well-known/security.txt
• Legal process: hello@elliottwave.studio

Elliott Wave LLC.