Pilot privacy architecture · version 2
Useful without becoming another identity database.
Public official facts, device-private case tools and optional pilot measurement are deliberately separated.
The status interpreter, request builder and workspace run in your browser. There are no accounts, payments or document uploads. Optional measurement records only coarse product events after consent—never status text, case numbers, PINs, names or documents.
Pilot measurement
Your current choice
Optional measurement and categorical feedback are deleted after 12 months.Movement contribution data
A Movement Radar contribution contains only the selected legal-route code, filing channel and country, interview or registration month, current canonical stage, month first seen, interface language and consent record.
It does not accept a name, nationality, date of birth, address, email, case number, Ministry PIN, exact appointment date, status free text, screenshot or document. Because a route and stable deletion key can still be sensitive or pseudonymous, Prepiska does not describe the raw record as anonymous.
The browser creates a private management key. The server stores only its one-way hash. The key lets you update or delete the contribution; Prepiska cannot recover it. Public cohort cells remain hidden below 20 distinct active reports, and raw contributions are never published.
Contributions stop affecting the public radar after 90 days without confirmation and are deleted after 36 months without an update. Before public recruitment, the final operator identity, contact channel, hosting/processor register and full rights procedure must be published here.
To slow automated flooding, a one-way daily hash derived from the network address and browser signature limits new contributions from one connection. It is not used for the radar or advertising and is deleted after two days.
1 — Public official data
Official Pulse and the Atlas use published government documents at aggregate level. Every figure retains its publisher, period, unit and source link. Maps show sourced places or applicant-nationality totals; they never infer an individual’s ethnicity or eligibility.
2 — Your device-local workspace
Status text, generated letters, neutral case labels, timelines, language and checklists stay in this browser. The active copy uses ordinary browser storage and can be read by someone with access to the same browser profile.
Encrypted backups are protected in the browser with your passphrase. Prepiska never receives the backup or passphrase and cannot recover them.
3 — Optional pilot measurement
If you choose “Share basic usage,” Prepiska records only the page or completed tool, interface language, broad screen size and a random identifier that rotates every 30 days. It stores a one-way hash of that identifier, not the identifier itself. This is minimised, pseudonymous measurement—not a claim of perfect anonymity.
Feedback contains only the rating and reason categories you select. There is no free-text field. Choosing “Keep everything private” disables product measurement without reducing functionality.
4 — Unknown status wording review
If the interpreter does not recognise a Bulgarian status, you may deliberately send only that sentence for private review. Prepiska blocks wording that appears to contain a case number, PIN or other identifying number. The sentence is stored separately from community timelines, deduplicated by a one-way hash and never published automatically.
What Prepiska never requests
- Ministry PIN, password or portal credential
- Official file or application number
- Passport, identity card, birth certificate or document upload
- Full legal name, address, phone number or date of birth
- Children’s identity details
Hosting and technical requests
Opening any website sends technical requests to its hosting and security infrastructure, which may process IP address, browser details and short-lived security logs. Prepiska does not copy those details into its pilot tables or attach them to a case record.
Control and deletion
Local cases can be removed individually or erased together. Encrypted exports remain wherever you saved them. Pilot identifiers rotate automatically; the pilot stores no identity lookup capable of linking a measurement record back to your name.
Independent product
Prepiska is not operated by Bulgaria’s Ministry of Justice, Presidency or another government body. The Ministry portal remains authoritative for an individual public status.