The thresholds, written down.

What a partner receives.

Sponsors, employers, and public agencies receive aggregate counts. They do not receive individual movement histories, message content, or rider identities. The mechanisms that enforce that boundary are described below, along with the limits of each one.

A cell publishes, or it disappears.

Every aggregate that reaches an agency dashboard or an export file passes through one shared suppression routine. The charts on screen and the CSV an analyst downloads apply the same rule, which means an evaluator has one thing to reason about rather than two.

Coarsened before aggregation — and that alone is not enough.

Mobility records are keyed to a privacy cell produced by rounding latitude and longitude to three decimal places. Rounding happens before aggregation, so downstream analytics never see a finer coordinate than the cell. In Nashville that cell is roughly 111 meters north to south and roughly 86 meters east to west, because a degree of longitude narrows as latitude rises.

We want to be exact about what this buys, because it is routinely oversold. A hundred-meter cell in a dense downtown block covers a great many people. The same cell on a rural road can cover one driveway. Coarsening on its own is not anonymity. It is a coordinate reduction that makes the minimum-cell-size rule meaningful, and it is that rule — five distinct riders, ten for sensitive categories — that does the protective work.

For the same reason, coordinates are not the only thing coarsened. Agency datasets are grained to the week, and the published-analysis standard allows hour-of-day and year buckets but never a per-event timestamp, because a precise time attached to a coarse cell can re-identify as effectively as a precise coordinate can.

Three states, and only one of them leaves.

Our written data governance policy classifies every dataset into one of three states. Data may only move toward less identifiability, never back, and each transition has a named mechanism rather than a convention.

• State 0, raw: direct identifiers present — phone numbers, emails, names, precise per-user traces. Production database only, reachable over a private network, owner-held credentials.
• State 1, pseudonymized: direct identifiers dropped at extraction, records keyed by opaque ids. Never exported.
• State 2, aggregates at k ≥ 10: no user-level records, every published row reflecting at least ten distinct users. This is the only state eligible for sharing with a partner, an agency, or a publication.

The step from State 1 to State 2 is enforced inside the aggregation SQL itself, with a HAVING count(DISTINCT …) >= 10 clause, so a sub-threshold aggregate is never materialized anywhere to be leaked later. The loaders that write those tables re-check the floor independently and reject rows below it, because a control that exists in exactly one place is a control that eventually gets refactored away.

Note the two floors are different on purpose, and we would rather say so than average them into one marketing number. The live agency reporting surface has a floor of five, raised to ten for sensitive categories. The published-analysis pipeline, whose outputs are designed to leave our systems entirely, holds every row to ten.

Deletion is a scheduled job, not a policy sentence.

Retention windows that live only in a document tend not to happen. Ours run as background jobs started when the service boots, on a fixed six-hour interval, coordinated across application instances by a lock so that two servers do not duplicate the same purge.

What the servers write down.

Reporting that says what it doesn't know.

A privacy claim and an accuracy claim fail the same way, by rounding an estimate up into a fact. Every row in a Hytch impact report carries an evidence tag of observed, derived, or modeled. The tag is part of the row's data type rather than a presentation detail, it renders as a badge in the report view, and it survives into the exported file as its own column, so it cannot be lost when the numbers are pasted into a grant application.

The exported report states the distinction in words as well: counts labeled observed come from aggregate trip records, while derived and modeled outcomes are estimates rather than direct emissions measurements. Avoided single-occupancy miles and reduced CO₂ are both tagged modeled, and the export prints its own methodology — the CO₂ factor per avoided mile, the assumed fuel economy, the counterfactual, and the source list — alongside the numbers, so a reviewer can recompute them.

The same discipline applies to service data. The parking API returns a live_availability field that is false, alongside plain-language caveats stating that candidates are built from static public parking data and that live occupancy is not available yet. Those strings ship in the API response itself, which makes the limitation hard to lose in translation between our system and a partner's.

The limit we will not soften.

The absences, stated plainly.

A procurement reviewer's time is mostly spent finding out what a vendor left out. These are ours, up front.

• We hold no SOC 2 report, ISO certificate, third-party security audit, or compliance attestation. Our internal governance policy names SOC 2 as a roadmap item triggered by the first agency data agreement entering diligence, and until that happens we will not imply otherwise.
• Message content is not end-to-end encrypted at launch, as set out above.
• Coarsening coordinates to roughly a hundred meters is not anonymization on its own, and we do not describe it as such. The minimum-cell-size rule is what carries the guarantee.
• Modeled figures, including avoided vehicle-miles and reduced emissions, are estimates rather than direct measurements. They are labeled modeled in every report and export, and the factors and assumptions behind them are printed with the numbers.
• Deleted rows can persist inside encrypted backups until those backups age out, and we would rather say so than describe deletion as instantaneous.