Principles

Hahoe Genesis Protocol (HGP): a protocol that protects and proves the first moment (genesis) of a record a person leaves behind. It began in Hahoe.

The name is provisional. “HGP” is also the abbreviation of the Human Genome Project, so every document always writes it out as “Hahoe Genesis Protocol (HGP)” at first use.

---

1. Eight principles

These do not change when the version goes up. If a new feature breaks even one of them, it is not built; we ask first.

1. The original belongs to its owner. Recordings, scans, photos, videos and text typed by hand (the authentic layer) are never altered, moved or deleted. Transcription, correction, translation and summary (the interpretive layer) are stacked separately alongside. The owner can download all of their originals and interpretations at any time, and can delete them. Keeping something is not owning it.

2. Recording works without a network. The original is saved on the device first and uploaded when a connection is available. Even if the server or the AI stops, the record is not lost.

3. Nothing opens without the owner’s key. Originals stored in the store are locked with the owner’s key. Not even Nodeone’s operators can open them. Until they are locked, we do not hide that they are protected only by promise.

4. Authenticity can be proven. The device takes a fingerprint (SHA-256) the moment the recording ends, and the store takes it again on arrival. If they differ, the file is not stored and the owner is told. Details are in 02-Fingerprint.

5. The authentic layer and the interpretive layer are kept apart. Their permissions are separate too (01-Permissions). Sending an original to an AI (for transcription and the like) is done only for purposes the owner agreed to, and the manifest records when it went and to which company (03-manifest).

6. It shows how much AI helped. Every record in the interpretive layer carries a mark saying whether a person made it, a machine made it, or a machine made it and a person confirmed it. This mark travels with any text that goes outside. Inference is not truth.

7. One thing at a time. Tools that handle records give a person only one task per screen. Records build up only if even elders who are not used to phones do not get worn out.

8. We do not sell, and we do not train on records without the depositor’s consent. Nodeone does not sell records. Handing over records wholesale for training is also selling. AI training uses only records whose depositor separately agreed to “use for AI training”. This is the same whether Nodeone or an institution does the training. Model APIs we connect (transcription, assistant chat) are used only with settings that exclude training.

2. Three added promises

These are the ones from the “five invariant principles” of the September HGP specification that are not among the eight above. They carry the same weight.

• A record is born with a pledge. The signatures of the speaker and the witness are the record’s birth registration. A machine cannot be a witness. (HGP-0002)
• Death does not lift the scope. The scope the owner set stays as it is after the owner is gone. Succession follows its procedure but does not change the scope. (HGP-0005 section 8)
• The specification is public, and there can be many implementations. Anyone can build to these documents. They do not belong to one company.

3. Who can see it (scope)

The depositor decides for each record, and for each passage if needed. If nothing is decided, it is “private”.

Scope	Who can open it
sealed	The depositor alone. Not even the successor can open it. The key is kept somewhere not connected to the internet
private	The depositor and the people the depositor entrusted (editors, successors)
relation	The people who took part in that record, or relations the depositor chose (family and so on)
community	Members of a community (a clan (munjung), an association)
public	Anyone

• An “approval required” mark can be added to any scope. It means the depositor’s approval is asked once more before opening.
• “Do not keep” (off the record) is not a scope. That passage is never born as a record in the first place.
• A passage that could harm another living person stays closed until that person opens it.
• A scope can have a time limit (“sealed until 2050, public after that”). Only the depositor sets the time limit; a successor can only postpone or narrow it. Even when the time limit arrives, private passages about other people who may still be living stay closed (07-Deposit section 5).
• Mapping to arkive’s seven levels: public = PUBLIC, community = COMMON, private = PRIVATE, sealed = SEALED, CONFIDENTIAL = the “approval required” mark, RESTRICTED (accredited researchers and so on) = opening to named roles, OFF-RECORD = not a scope.

4. Four use consent boxes

These are asked when recording first starts. They can be changed for each record.

Box	Meaning	Default
archive only	Only kept safe. Not shown to anyone and not used for anything	on (turning it off means deleting the record)
share with family	Opens the scope to “relation (family)”. Choose whether only the transcript is visible, or the original too	off
use in books, films and the like	Books, films, exhibitions and similar works made from selected records can be released outside. The depositor checks the result every time it is released. An AI contribution mark is attached	off
use for AI training	Can be used to teach an AI. At consent, the depositor is shown who (Nodeone, an institution, or a company by name) is teaching what (for example, reading old handwriting), and use stays within that scope	off

• Consent is given separately for each box. Agreeing to one does not mean agreeing to the others.
• Consent can be withdrawn at any time, and no reason is asked. On withdrawal, what was made from that record closes too.
• There is no box for selling or for handing records wholesale to another company. Under principle 8, these are never done in the first place.
• Training, whoever does it, happens only with the depositor’s consent. “Sealed” records, and passages with another person’s voice who has not consented, are not used even if consent exists.
• After training consent is withdrawn, the record is not used from then on. It cannot be removed from a model that has already learned from it, so this is explained first when consent is asked.
• An AI that answers questions about the content (a docent, a research assistant) does not train the records into the model; it reads them each time to answer. This is because on withdrawal they must disappear from the answers too. (Memory and Authenticity Protocol, article 10)
• For a record containing another person’s voice, that person’s consent is also obtained for their passages (01-Permissions section 5).
• Task consent such as “send the original to a transcription company” is separate from the use boxes and is obtained when the service is first used (principle 5).

Records handled by institutions (arkive) use the eight-purpose consent as it is. The four boxes are a simple grouping of it.

Four boxes	arkive purpose consent
archive only	storage (keeping), processing (internal processing)
share with family	scope “relation” (handled as a scope, not a purpose)
use in books, films and the like	commercial (commercial derivatives)
(not asked of people, institutions only)	search (search), statistics (statistics), research (research)
use for AI training	ai_training (AI training)
(no box)	third_party (provision to third parties)

“Training to read” in article 10 of the Memory and Authenticity Protocol (training that improves reading tools, such as OCR and deciphering cursive script (talcho)) is one case of “use for AI training”. (Decision 0003)