Xaere trust model
This page describes the technical behavior enforced by the current service and SDK. It is not a substitute for the final legal notice, controller identity or customer agreement required before commercial launch.
Purpose: organisations, projects, campaigns, access control, quotas and issuance, resolution and revocation of signed XR Codes.
Receives: verified account subject, tenant configuration, opaque broadcast token, intended action, Code lifecycle metadata and operational billing/support state.
Does not receive from the receiver: raw microphone samples, a persistent device identifier or an Audience HMAC secret. A normal Code resolution works with Audience disabled.
Purpose: consent-bound measurement of cryptographically authorised XR interactions in a separate database, role and retention domain.
Receives: one closed event containing an event id, XR Code id, occurrence time, coarse receiver class, random rotating measurement token, integration id, optional two-letter country code and short-lived Core proof. The integrator backend adds the HMAC credential.
Stores: the measurement token only as a one-way hash, verified event dimensions, replay state and bounded UTC-day integrity counters. Reports and exports return aggregates, not raw tokens.
Excluded by contract: account id, advertising id, installation id, precise location, arbitrary profile fields and raw microphone audio. A request containing an unreviewed field is rejected.
Purpose: capture audio locally, decode an opaque ggwave frame, verify the signed Core resolution and present the resulting intent to the host application.
Network boundary: the SDK contains no publisher API key or Audience HMAC secret. Optional Audience delivery goes to the integrator-owned backend, never directly to the public Audience ingestion endpoint.
Purpose choices: Audience measurement, advertising and personalization are separate and off by default. The current SDK acts only on Audience measurement; the other two choices have no capture, resolution, reporting or profiling behavior.
Lifetime: the measurement token is random and in memory, rotates every 30 minutes by default and rotates immediately after consent withdrawal. An optional retry queue is encrypted with a host-supplied key and cleared on withdrawal.
microphone → local decoder → opaque token → Core resolution
explicit Audience consent → integrator backend → HMAC event → XR Audience
Reducing an integration's retention immediately purges newly expired events and integrity days. Project deletion and organisation closure invoke a separately scoped Audience purge for integrations, events, replay state, integrity aggregates and isolated legacy aggregates. External payment, invoicing and support providers retain their own records according to their configuration and applicable obligations.