Patchwork LabsWhat we do with your data
The short version: anyone can join the community without an ID. Before you get program resources, like compute or grant money, we check your ID on a live video call that is never recorded. We delete your ID images 7 days after you pass, or 30 days after you don’t. Nobody here can read your demographic answers in Weave. When you delete your account, your readable data goes, and we tell you exactly what stays and why.
This page is for members, and for parents and guardians of members under 18. Our privacy policy covers everything else we collect.
Last updated October 23, 2026.
The community is open
No ID to join or talk
You can join the Slack, ask questions, and share what you build. You never show us an ID for that.
An ID check for program resources
Compute, server access, and grant money are real resources. So before you get them, we check that you are a real person, how old you are, and where you live. Some of this is the law. Some of it stops one person from collecting the same grant twice.
How the ID check works
Everyone goes through the same steps. Our own team does too. There are no shortcuts, because shortcuts are where fraud gets in.
Send your ID
a photo or scan, before the call
We check it
a person looks at the ID
← Problem with the ID? Fix it and go back to step 1.
Live video call
never recorded
Decision
written down, pass or not
Pass: verified
← Did not pass? Wait, then start again at step 1 with a different person.
- 1. Send your ID. Before the call, you send a photo or scan of your ID.
- 2. We check it. A person on our small verification team looks at it. If there is a problem, like a blurry photo, we tell you what to fix and you send it again.
- 3. A live video call. You hold up your ID, and we check that your face matches it. A live call is much harder to fake than a photo.
- 4. A decision. Pass or not, the person on the call writes down the result and the reason.
We never record the call
No video. No audio. No screenshots. The only thing we keep is what the person on the call writes down: who was there, when, which ID we looked at, the result, and the reason. A video we never saved can’t be leaked, stolen, or handed over.
If you don’t pass
- It isn’t the end. After a wait of 14 days, you can start again from step 1.
- Your next try is always with a different person. No one person can fail you again and again.
- If a second call does not pass, the verification team lead looks at the whole history together, so you are not stuck in a loop.
- Every try is written down and linked to the one before it, so if you disagree with a result, we can look at what really happened.
How long a pass lasts
- A pass has no time limit. You don’t check again every year.
- We ask for a new check only if your birthday or your legal name changes on your account, or after we review a block flag on your record. We tell you why.
What we collect, and why
This is the data that the ID check and our programs add to your account. Every piece has an answer to three questions: can you download it, can you delete it, and if not, which rule makes us keep it and for how long. The table under “What delete actually deletes” gives each answer.
Your ID
A photo or scan of an ID, like a passport or ID card. We use it to check that you are a real person, and to confirm your age and where you live. We use it for the ID check and nothing else.
The call record
Who was on your video call, when it happened, the type of ID we looked at, the result, and the reason. The person who did the call writes this down. There is no video or audio.
US residency
Whether you live in the US, the US state, the type of document that showed it, and the date. Some compute partners are open only to people who live in the US. We never ask about citizenship. If your ID does not show a US address, you can send a school enrollment record or a parent's or guardian's ID and address. We delete that document on the same schedule as your ID images. After the check, nobody can open it. A yes result is good for 12 months, or until you move to another state or country.
Demographic answers
Your gender, which you tell us yourself, and an age range that comes from your birthday. Funders ask us for totals, so we ask you. Only the totals ever leave the vault.
Parent or guardian contact
For members under 18, the name and email address of a parent or guardian, and their consent.
Grant records
Which grants you got, and the money records that tax law and our funders make us keep.
The Knot
A one-way fingerprint made at your ID check. It stops one person from getting the same grant twice under a new name. More about it below.
Sensitive data is encrypted when we store it. We never sell any of it, and we never use it for ads.
Members under 18
Members must be 13 or older. If you are under 18, you can’t sign agreements on your own, so a parent or guardian gives consent first. We keep their contact details on file while you take part.
- A parent or guardian must be on the video call with you. You can’t pass the check without them.
- We keep the guardian contact until you turn 18 or leave the program. When you delete your account, we delete it.
- Parents and guardians can email [email protected] any time to ask what we have, or to ask us to delete it.
Your demographic answers
Funders want to know who our programs reach, like how many members are in each age range. So we ask you some questions about yourself. Here is how we protect your answers.
Your answers come from you
On the call, we check that your legal name and birthday match your ID, and that the region you gave doesn’t clash with it. Your age range comes from your birthday. We never copy anything from your ID into your answers, and we never check gender against an ID. You know who you are.
Nobody can read them in Weave
Your answers are locked in an encrypted vault. Nobody can read them in Weave. No screen, export, or admin page shows them. The only key that opens the vault is kept offline by a few key holders. They use it only for the run that counts the totals, and every run is logged.
- The only thing that comes out of the vault is totals, like “40 members aged 13 to 15”.
- If a group is very small, we hide it, so nobody can work out who is in it. A group needs at least 10 people before we show it.
- When you delete your account, your sealed answers are cut off from your account. They wait, with no link to you, until our next report run. That run adds them to the totals as general ranges and then deletes them.
Your ID images
Your ID images are encrypted from the moment they arrive until we delete them. Sealing is how we lock them until then. It is not a way to keep them longer. Here is what happens, in order:
- 1. You send them. We encrypt them as soon as they arrive.
- 2. We check them. One person on our verification team at a time checks your ID before the call. If they hand the check to a teammate, that is logged. Each of them can see the images only until that check ends, and every look is logged.
- 3. We seal them. When that check ends, we seal the images. From then on, a team member can see them only with a written reason and the approval of two of our three key holders.
- 4. We delete them. We delete them 7 days after you pass. If you don’t pass, or we ask you for a new photo, we delete them 30 days after that result. If our verification team lead reviews your check, we wait until the review ends. If the 30 days are already over by then, we delete them at once.
If you stop before the call, we keep your images locked until you write to us or delete your account. Then we delete them.
2 of 3key holders
Three named people hold hardware keys. After the check before the call, a sealed ID image opens only when two of them approve with their keys. Then only the team member who asked, with a written reason, sees it, one time. Nobody can open one alone. There is no folder of IDs to browse.
Everyaccess is logged
If anyone opens a stored image, the key holders who approved it and the verification team lead are told right away. Our board sees every one in its regular report.
Youare told
We tell you 72 hours after the image is opened. The only exception is an active fraud investigation. Then an owner or our verification team lead must agree to the wait (never the person who asked for it), and we still tell you at most 30 days later.
Download or delete your data
You can download a copy of your data from your account. You can also delete your account and everything that no law, funder contract, or fraud rule makes us keep. This is real deletion, not just hiding your account. It follows the same written steps every time, and every run is logged.
Deleting your Weave account does not delete your Slack account or your messages. Ask us to remove those too.
If you don’t sign in for 5 years, we delete your account with the same steps. We email you 60 days and 7 days before. Any sign-in resets the clock.
You ask to delete
A person checks that the request really comes from you. That is all they check. They do not decide if you are allowed to leave. They do this check within 14 days, and the deletion is complete within 30 days of your request.
Step 1: Add you to the totals
We add general facts about you, like your age range and region, to the running totals we report to funders. Never exact details.
Step 2: Tie off the Knot
We save two things on your Knot: a yes/no flag for whether you are blocked from our programs, and which program grants you got.
Step 3: Cut the thread
We delete everything that can be read as you, and cut the link between you and what is left.
Step 4: Send your receipt
You get a list of what we deleted, what we kept, and the rule or law that makes us keep it.
Your deletion receipt
At the end you get a receipt. It lists what we deleted, what we kept, and the rule or law that makes us keep each thing. No surprises.
What delete actually deletes
Here is every kind of data, and what happens to it when you delete your account. Each one is deleted, added to anonymous totals, or kept for a set time because a rule or law makes us.
| Kind of data | In your download? | When you delete | Why, and for how long |
|---|---|---|---|
| Your ID images | In your download: No | already gone | We delete them 7 days after you pass the check, so they are usually gone before you ask to delete anything. If you did not pass, or we asked you for a new photo, we delete them 30 days after that check ends. |
| Your account and profile | In your download: Yes | deleted | Nothing makes us keep it. |
| Your Thread Count | In your download: No | deleted | An internal trust score that our staff read. It is not in your download. We delete it with your account. |
| Your parent or guardian’s contact details | In your download: Yes | deleted | We only need them while a member under 18 takes part. |
| Your demographic answers | In your download: No | added to totals, then deleted | General ranges from your answers go into the totals. Then the encrypted record is destroyed. |
| Your ID check records | In your download: Yes | kept for a set time | To stop fraud and to follow the law. We keep them for 3 years after you delete your account, then destroy them. If you are blocked from our programs for fraud, we keep the evidence while the block stands. |
| Your US residency check | In your download: No | kept, with no link to you | The yes or no result, the US state, and the type of document. We keep it like your ID check records, with no link to you. The document itself follows the rules for ID images, and we delete it when you delete your account. |
| Grant and money records | In your download: Yes | kept, then made anonymous | Tax law, audits, and our funders’ rules make us keep these. We keep them in full for 7 years, or longer when a funder’s contract says so. Then we remove your details. The amount, the program, and the year stay, with no name. |
| What you did in our programs | In your download: Yes | added to totals | General facts go into the totals. Then the link to you is cut. |
| Records a funder requires | In your download: Yes | kept, then added to totals | Only when a funder’s contract requires it, and only for as long as that contract requires. Then they go into the totals too. |
| The Knot and its record | In your download: No | kept | A one-way fingerprint, a yes/no flag, and the grants you got. It does not hold your name. Kept for ever, with no end date: the one-grant-per-program limit and the block flag both depend on it, and a block flag never fades. |
About the totals: they are just counts, like “12 members from Canada got a grant in 2026”. They have no names and no rows for single people. We hide small groups here too, so it is very hard to trace a total back to one person.
Your ID images
sealed, then deleted 7 days after you pass
Guardian contact
until you turn 18 or leave the program
Demographic answers
encrypted, only totals ever come out
ID check records
kept for a set time after you leave, then destroyed
The Knot
a fingerprint, stays after you delete
The Knot: the one thing we keep
When you cut a thread, the knot stays tied. We want deleting your account to be real. We also need to stop someone from deleting everything, coming back as a “new” person, and getting the same grant again. The Knot lets us do both.
What goes in
once, at your ID check
- strongThe number and type of the ID you show us
- strongYour national ID number, if your country gives you one for life
- softYour legal name and birthday
one-way
can’t be turned back into your details
What we keep
even after you delete
A small set of fingerprints.
- Blocked from our programs?
- yes or no
- Grants you got
- for example, Ganymede
No name. No reason. No history.
If someone comes back and verifies again
A strong match
It’s the same person. Any limit on grants per person still applies. If the flag is “no”, you just verify again like anyone else. If the flag is “yes”, the verification team looks more closely.
Only the name and birthday match
Two different people can share a name and birthday. So a second person joins your call and takes a closer look. That is all it can do. It can never turn you away on its own.
What the Knot is
- At your ID check, we turn a few details from your ID into fingerprints with a one-way function. We can check if a new fingerprint matches an old one. We can’t turn a fingerprint back into your name or ID number.
- Some fingerprints are strong: they come from an ID number, so a match means the same person. One is soft: it comes from your legal name and birthday, which two different people can share.
- If you verify again with a new ID while your account is open, the new fingerprint joins your set.
- If your legal name changes, you show us the new document. Two of our team sign off, the new fingerprints join your set, and you keep your standing.
What it holds, and what it never does
- Besides the fingerprints, the Knot holds only two things: a yes/no flag for whether you are blocked from our programs, and which program grants you got.
- The grant list is how we keep grant limits fair: one grant per person per program, for life. In a rare case, the program lead can approve one more, with sign-off from a board member and a written reason.
- It holds no name, no reason, and no history. Reasons live in the ID check records, and those are destroyed when their time is up.
- If you come back in good standing, you simply verify again like anyone else. You start fresh.
- A name and birthday match can only bring in a second person to take a closer look. It can never deny you on its own. A birthday can call a human, but it can’t decide anything.
- Honest note: a fingerprint can’t be reversed. We make the fingerprints with a secret key that we keep apart from the database. But someone who had that key and already knew your details could make the same fingerprint and compare. That is why we protect the Knot as carefully as everything else.
Questions
Something here unclear, or something you want to check? Email [email protected]. Parents and guardians are welcome to ask too. If we change how we handle your data, we update this page and the date at the top, and big changes get announced in the Slack.