Your Palm Is Your Citizenship (and Nothing Is Stored)

A plain-language explainer + a live code audit of the SOV palm-biometric protocol.
Every claim here maps to the exact source that implements it — file and line references are included so it can be independently checked. Nothing here is marketing; it's what the code actually does.

The one-sentence version

SOV uses your palm to prove you are a unique human — once — without ever storing your palm, your photo, or anything that could identify you in the real world. What the network keeps is a scrambled, revocable math token that can only answer one question: "is this the same SOV citizen as before?" — never "who is this person?"

Why a biometric at all? (why it's necessary)

Every open network has the same enemy: Sybil attacks — one person creating thousands of fake accounts to stuff votes, farm rewards, or drown out real people. Crypto's usual answers are bad:

Proof-of-Work → burn electricity (wasteful, centralizes to whoever has cheapest power).
Proof-of-Stake → the richest rule (plutocracy — one coin, one vote).
KYC / ID upload → hand your passport to a company (surveillance, breachable, exclusionary).

SOV needs one human = one citizen so that governance is one person, one vote and rewards are fair. The palm is how the network proves humanness without mining, without wealth, and without collecting your identity. It's the fairest known answer — if it can be done without storing real biometric data. SOV does exactly that.

What actually happens (step by step)

1. On your phone — a number, not a picture

Your phone camera looks at your palm and a small on-device AI model (TFLite) turns it into a list of numbers (an "embedding") — a mathematical summary of the shape, with no picture in it.

The palm photo never leaves your phone. It isn't uploaded, and it isn't even saved.
An embedding is a one-way summary: you cannot rebuild the palm image from those numbers (and the image is gone anyway).

2. Your palm becomes your key — and the key is never stored

SOV runs a fuzzy commitment scheme (Juels–Wattenberg, 1999 — the basis of modern biometric cryptography):

A random master key K is generated and wrapped in an error-correcting code.
It is blended with your palm template into a single blob called Helper Data.
K is used to derive your Ed25519 keypair → your Sovereign ID, then immediately discarded. The master key is never stored anywhere.
Only H is sent to the network. H looks like random noise and reveals nothing about your palm or key.

When you come back and re-scan, the error-correcting code fixes the small differences between scans and recovers the exact same K → the same Sovereign ID. That's how you restore your wallet with your palm instead of a seed phrase — and why a slightly different scan (or the wrong hand) simply fails.

3. What the network stores — a scrambled, revocable token

For the one-human-one-account check, the network keeps a representation of the embedding. But it does not store the raw embedding — it runs it through cancelable-biometric protection:

stored = R · normalize(embedding)

R is a secret orthogonal transform derived from a per-network seed. That seed is not published anywhere. It is not a value in the source code, so reading the software tells you nothing about how to undo the scrambling — and a copy of a node's database, on its own, is useless. Being precise about what remains: the operators who run nodes do hold that seed, so an operator could undo it. Splitting it into a witness-signer key that no single node can hold is planned and not yet shipped, and we would rather say so than imply a protection you do not have.
The node stores the cancelable-transformed template (R·embedding), never the raw biometric.
A stolen node database yields scrambled, non-raw unit vectors — useless without R.
It is revocable: rotate the network seed → re-transform everyone → any stolen copy instantly becomes dead garbage. You can never revoke a leaked fingerprint — SOV can.

4. What it's used for — and the only question it can answer

One human, one citizen: a new enrollment is compared against the existing protected templates, and one that is close enough to an existing citizen is blocked as a repeat enrollment. The scrambling matrix is cosine-preserving, so the check still works mesh-wide without ever unscrambling anything.
Seedless recovery: re-scan → recover your keypair (above).
Hand binding: the template is bound to LEFT/RIGHT, so the wrong hand fails even if similar.

The stored token can answer exactly one thing: "does this match an existing SOV citizen?" It cannot be run against a police fingerprint database, a passport face system, or any real-world record — it isn't a fingerprint or a photo, it's a scrambled vector that only has meaning inside SOV.

SOV "soft" biometry vs real-world biometry

	Real-world biometry (passport, police, phone FaceID DBs)	SOV soft biometry
Stores your actual fingerprint/face image?	Yes	No — the picture is discarded on your device. Only numbers ever leave it
Stores the raw biometric template?	Often	No — only `R·embedding`, scrambled
Can identify you in real life?	Yes (that's the point)	Palm: no — nothing in the world holds palm records to match it against. Face: only by someone holding a stolen node database, the network seed and a photo of you
Reversible to the original?	Frequently	Palm: no, by construction — the reading is a texture summary that throws away where each pattern sat, so there is no picture left to rebuild. Face: scrambled and revocable, but we do not claim it is mathematically irreversible
Revocable if leaked?	No — you can't change your hand	Yes — rotate the seed, stolen sets die
Who can read it?	The authority holding the DB	Today: a node operator holding the network seed could unscramble it. Planned: a split key no single node holds
What it proves	Who you are	That you're a unique, returning citizen

"But is it really safe?" — the honest answer

Yes, by design — and here's the precise reason: the network never holds anything that maps back to a real person. Three independent walls would all have to fall at once, and even then you'd get nothing usable:

No image is ever sent — not of your palm, not of your face. It cannot be stolen from the network because it was never there.
The stored vector is scrambled and revocable. The scrambling seed is a per-network secret that appears nowhere in the published source, so a stolen database is useless on its own. Its limit, stated plainly: node operators hold that seed, so an operator could undo the scrambling. Splitting the key so no single node holds it is planned work, not shipped work. The seed can also be rotated at any time, which re-scrambles every template and kills any copy taken earlier — that has been exercised on the live network, not just designed.
Your identity key is recomputed from your live palm and never stored at all.

What SOV deliberately keeps is the minimum needed to enforce one-human-one-citizen and to let you recover your wallet with your hand — and not one bit more. It is a representative token that "could be anything," carries no real-world meaning, and cannot be used to trace, surveil, or de-anonymize the human behind it.

The promise, restated: SOV never learns your name, your email or your phone number, and it never holds a picture of you. What it keeps is computed data — numbers derived from a scan and then scrambled — whose only purpose is to answer one question: is this the same citizen who already enrolled? It gives you a digital identity that proves you are a real, single human without describing which human you are. And it keeps that in a form it can throw away and reissue at will.

Why we also read your face — and what that means

SOV binds one face to one citizen. The reason is narrow and worth stating plainly: without it, a person could enrol their left palm as one citizen and their right palm as another, and the one-human-one-account rule would quietly fail. The face reading is what links the two attempts to the same person.

What is captured: a photo is taken on your device, converted to a list of numbers, and the photo is discarded. The numbers are scrambled before storage, exactly like the palm. No face image is stored, sent, or held anywhere on the network.

Where face differs from palm, honestly: the palm reading is a texture summary — it counts patterns and discards where each one appeared, so there is no picture left inside it to recover. The face reading is produced by a neural model, and that kind of representation retains more of the original. We scramble it and we can revoke it, but we do not claim it is mathematically irreversible the way the palm reading is. That is why the face record is the one we protect most carefully, and why the scrambling key is being split so no single operator holds it.

Neither reading can be checked against a passport, police or phone-vendor database. Those systems store their own formats, computed by their own models; a number produced by one system has no meaning in another.

For auditors, regulators & reviewers

Every claim on this page is a property of the software itself, and every operator runs the same software — there is no privileged server holding a different version. The node is open source, so each statement below can be confirmed by reading it.

We deliberately do not print the tuning constants of the biometric system on this page: the error-correction strength, the matching threshold, the scan-acceptance window. Those numbers are exactly what someone would need to calibrate an attack against, and publishing them protects nobody. They are visible to anyone reading the source, which is the right place for them — a reviewer gets the whole picture, while a casual attacker does not get a checklist.

What is guaranteed	What that means in practice
No palm image ever leaves the phone	The camera frame is turned into numbers on the device and discarded. There is no upload, and nothing to steal from the network, because it was never there.
No raw biometric template is stored	What the node keeps has been put through a secret, cosine-preserving transform. A stolen database yields scrambled vectors, not palms.
The scrambling key is a secret, shared between operators, and being split	The seed is a per-network secret and appears nowhere in the published source, so a stolen database alone cannot be unscrambled. Operators who run nodes do hold it, so an operator could — splitting it so no one operator can is planned work. Rotation has been exercised on the live network: every stored template was re-scrambled under a new key and verified to be the same biometric afterwards. We publish the current state rather than the intended one.
Your identity key is never stored	It is recomputed from your live palm each time and thrown away. There is no copy on any node to seize, subpoena or leak.
The helper data reveals nothing on its own	Without a live palm it is indistinguishable from noise. It is not a template and cannot be turned back into one.
The stored token answers one question only	"Is this the same citizen who already enrolled?" It cannot be matched against a police, passport or phone-vendor database: those systems hold their own formats, computed by their own models, and a number produced by one system has no meaning in another.
A leak is recoverable	Rotating the network secret re-scrambles every stored token and turns any stolen copy into dead data. This is the thing a fingerprint database can never do.
The scheme is not homemade	It is a fuzzy commitment (Juels–Wattenberg, 1999) combined with cancelable biometrics — both long-standing, peer-reviewed constructions, not something invented here.

Compliance summary (one paragraph for a data-protection enquiry)

SOV does not collect, transmit or store biometric images. Palm capture happens entirely on the citizen's own device and the image is discarded immediately. What reaches the network is a protected, revocable token that cannot be reversed to a biometric, cannot be linked to any real-world identity record, and is used for exactly two purposes: preventing one human from holding multiple citizenships, and allowing that human to recover their own wallet. No name, address, phone number, email or government identifier is collected at any point. Because the protection is revocable, a compromise can be remediated by rotating the network secret — a property conventional biometric databases do not have.