The sovereignty contract

0. What we mean by “your record”

Your record is everything a student captures over time and chooses to seal: courses, work samples, jobs, reflections, and the transcripts they get issued from all of it. Each piece is sealed with SHA-256 and gets a short id that anyone can verify without an Eformogi account.

• tr_: a transcript you issued. A printable, verifiable summary a receiver can open with no login.
• cr_: a single course on a transcript. A teacher can cosign it, and a school that issues on the record can declare it; either way the signature is its own receipt.
• ws_: a work sample. Something you made, read, won, worked at, got better at, learned from, or showed up for.
• att_: an attestation. A signature from a teacher, coach, counselor, mentor, supervisor, employer, peer, or family member, naming what they witnessed.
• wn_: a weekly note (the Sunday Note). Reflection in your own voice. Never transcript evidence; never countersigned.
• wl_: a curated wall. A handful of things you pinned for a specific person to see.
• tl_: a private timeline entry. Captured on your device; not published unless you publish it.

When the clauses below say “your record,” they mean all of the above, together and in any combination. Adding a new kind of receipt does not shrink any clause; the contract binds Eformogi to every prefix it has ever issued.

1. Students own. The record is free for the learner, forever.

The record belongs to the student. The record, the receipts, the transcripts, the cosignatures, the exports, and the revocation tools are free to students and families in perpetuity, by contract. No paid plan holds your own record hostage, and no paid plan gates the basics. Capturing, witnessing, issuing, exporting, and verifying never cost the family anything.

In New York, each student's first IHIP of the season is free, rendered from the record the family already entered. Families who want the rest of the season's filed paperwork, the four quarterly reports and the annual assessment, and every other state document rendered and filed can add Family Pro for $99 per year, which is included for every learner an issuer enrolls; the enrollment and service-hours letters cost $12 each, the good-student letter is free while insurers are new to family-issued records, and the record itself is never behind any of it. Declining every one of them never locks, degrades, or deletes the record.

This clause survives acquisition, change of control, and bankruptcy. The only permitted off-ramp is one (1) year of written notice plus full export in an open, machine-readable format at no cost to the student or family. If we ever cannot honor this, we shut the service down on those terms. We do not sell the off-ramp. We do not sell the family.

2. Sovereignty by default.

No piece of your record leaves the device, no receipt is issued, no agent gets a token, and no receiver gets a verification check without an explicit act by you or someone you have named. Defaults are off. Sharing is opt-in, per share. Revocation is one tap and propagates to every copy that checked.

The audit log is yours. Your record is encrypted before it is stored, and key custody is now moving to families themselves. The Own Your Keys ceremony in Settings creates a family passkey and a one-time recovery code, proves you hold them, and ends with Eformogi deleting its own copy of your key. A family that has completed that ceremony holds the only keys to its record: for that family, not even Eformogi can read inside the record, and that is enforced by math, not by policy. The verify page states it on that family’s signed receipts. Until a family chooses the ceremony, its record stays encrypted with a key Eformogi still holds, and this page will not pretend otherwise (see our Security posture).

Eformogi cannot share on your behalf. Eformogi cannot grant any third party (including any AI agent, any school, any college, any employer, any government agency) a standing authorization to your record. Standing authorizations do not exist in this product, by design.

3. Who pays, and who never does.

The record is free for the learner, forever: capturing, witnessing, issuing, exporting, and verifying never cost the family anything. Schools, microschools, and counselors who issue on the record get a free founding year through June 30, 2027, then pay $49 per learner per year, billed to the issuer and never to the family; founding issuers keep that price for as long as they issue, and if an issuer stops paying, its learners keep the record and its export. Receivers verify a single link free, forever; an office that wants a hosted verification service at volume can ask us. In New York, each student's first IHIP of the season is free, rendered from the record the family already entered. Families who want the rest of the season's filed paperwork, the four quarterly reports and the annual assessment, and every other state document rendered and filed can add Family Pro for $99 per year, which is included for every learner an issuer enrolls; the enrollment and service-hours letters cost $12 each, the good-student letter is free while insurers are new to family-issued records, and the record itself is never behind any of it.

That is the whole price list. It lives, in the same words, on the pricing page. Anything a family pays is optional paperwork they asked us to render and file, and the record is never behind it.

4. The institution never owns the record.

Issuers of every kind (microschools, learner-driven networks, online schools, independent counselors, and eventually districts) may pay to issue on this record. What they may never do is own it. The learner holds the keys and the export. No issuer, receiver, or state ever holds the only copy.

In practice that means four things. A school that issues a course row on a learner’s record is naming itself as the source of that row, not taking custody of the record around it. A family can claim, keep, and carry the record whether or not the school is still in the picture. An issuer that stops paying keeps nothing and takes nothing: its learners keep the record and its export. And a learner who leaves the school leaves with everything, including the rows the school declared.

The founding terms are published, not negotiated in private: a free founding year through June 30, 2027, then $49 per learner per year, billed to the issuer and never to the family, and founding issuers keep that price for as long as they issue. They are written out at the founding-issuer page.

5. Witnesses verify for free, forever.

The people who add their signature to a student’s work (teachers, coaches, counselors, mentors, supervisors, employers, peers, family members) are not customers and are never charged. Cosigning a course (cr_) or a work sample (ws_) is free, requires no Eformogi account, and produces a receipt (att_) the signer can verify on their own.

Witnessing and issuing are different acts, and only one of them is ever billed. A counselor or teacher who signs what they saw is never charged for signing, no matter how many students they sign for. A school, microschool, or counselor that issues on the record gets a free founding year through June 30, 2027, and then pays $49 per learner per year, billed to the issuer and never to the family.

What this means in practice

• Your record (courses, work samples, jobs, reflections, walls, transcripts) is free, in perpetuity, for students and families.
• You can export all of it, in an open format, at any time, without asking us.
• You can revoke any share you have made, and the revocation propagates to every copy that checked.
• We do not sell your data. Not aggregated, not anonymized, not for research, not under any future name.
• Witnessing a student’s work is free, in perpetuity, for teachers, coaches, counselors, mentors, supervisors, employers, peers, and family signers.
• A school or counselor that issues on the record pays per learner and owns none of it.
• If we get acquired, the new owner inherits every clause above. There is no version of this product that charges students or witnesses for their part of the record.
• If we shut down, you get one year of notice and a full export in an open format. Your record does not vanish.

Why this is in the open

Personal-data products tend to start with promises and end with renegotiated terms-of-service the morning after an acquisition. We are publishing these clauses as a contract, on the open web, before we are large enough to be tempted to break them. If you ever read a future version of this page that softens any of them, you should leave the product and take your record with you. The export will work. That is the point.