A data economy where privacy is engineered, not promised.
DAT4RA is a working proof of concept: people pool their own platform data, buyers pay for group statistics, and every privacy and payment rule is enforced in code, tested, and checkable by anyone without trusting the company.
Platforms profit from what people do. People get neither a say nor a share.
The question behind DAT4RA: can a person's own data, the exports platforms already have to give them, become statistics a buyer pays for, in a way that provably never exposes any individual, and with the person paid for every sale?
That needs three things at once: privacy with a stated, tested bound, consent people control, and proof that does not depend on trusting the company.
What makes it trustworthy
Differential privacy
Every release adds discrete Laplace noise through OpenDP, with each person's contribution capped and a yearly privacy budget per pool. A simulated membership attack checks that no attacker beats the stated bound.
Group floor and differencing gates
No group under 1 000 is published. Gates hold any release where subtracting one table from another, counties from a country or one audience from another, would reveal a small group.
Transparency log
Every signal and release is committed to an append-only Merkle log (RFC 9162) with signed tree heads and consistency proofs, so history cannot be rewritten unnoticed.
Stand-alone verifier
One short Python file, using none of the system's own code, verifies a member's receipt, a buyer's proof pack and the revenue split to the öre.
Crypto-shredding
Each member's data is encrypted with their own key (AES-GCM). Leaving destroys the key, so stored data becomes unreadable. Identity, data and keys live in three separate databases.
Rules enforced in the database
Consent, money, licences and every choice are append-only, enforced by database triggers. Sensitive buyer types start off for every member, and health data needs its own yes per pool.
From a member's export to a verified release
- SourcesExports from Google, Meta, Spotify, Apple Health and Fixmeapp
- Parse and filterField allowlists; other people, sensitive topics and legal limits removed
- Vault and logEncrypted per member; commitments in the public log
- Release engineCap, count, noise, floor, gates, sign
- DeliveryBuyer portal, proof pack, member receipts and payouts by rule
Python, FastAPI, SQLAlchemy, OpenDP and the cryptography library. A buyer portal and a member app prototype as plain web pages on the same API. Built on synthetic data only: no real source is connected and no real money moves.
Product decisions first, every claim backed by a test
Johanna Viio sets the product direction, the rules every part must follow, and every product decision.
DAT4RA is an ongoing project, engineered by master's and bachelor's students from KTH and Aalto University together with Johanna. The research and the code live together in one repository. Claude Code is used as an AI engineering partner, working from a written roadmap and binding rules.
The Wibson protocol, an earlier marketplace where people sell their own data, was an inspiration. Early members of the Wibson team have given valuable feedback.
A claims register is the gate: nothing about privacy, value or earnings may be said unless a test in the repository shows it. A threat model, a waiting list of open legal and partner questions, and a log of every session keep it honest.
Code and documentation available on request.
Knowing exactly what is proven is part of the work
A claims register gates every sentence: a claim is made only when a test shows it. What needs a lawyer, a partner or real buyers is on a waiting list with the default used meanwhile.
Proven by tests
No published group under 1 000. A buyer cannot tell whether one person is in a release, at the stated epsilon. Receipts and proof packs verify without trusting the company. Leaving makes stored data unreadable. Sensitive buyers only reach members who opted in. The split adds up to the öre.
Not proven yet
Legal review of each platform's terms and of health data. A licensed payment partner for real payouts. An external review of the privacy parameters. Real buyers paying, which is the only proof that the data is worth something. Backups and key management beyond a proof of concept.