The plan for preventing fraud, waste, and abuse, including identity theft, for every person who takes part here. And how the rules stay current, in every place we serve, as laws change. Cybersecurity (locks, keys, wires) is its own plan; this plan is about people, money, and trust.
We never build a pile of everyone's information. Your archive lives with you; every access asks first and is written down; money for shared purchases never passes through us; community money sits in public view. That removes, by design, most of what a fraud department exists to police: there is no central store of identities to steal, no silent snooping to detect after the fact, no platform account to embezzle. The design alone leaves four questions open, and the rest of this page answers them: who a person really is at the moments where trust or money changes hands, what a trusted human can do to a vulnerable person, how community and government funds stay honest, and how a victim gets made whole.
The consent gate says no by default. A grant admits exactly what it names. Anything it does not name stays shut. Every request becomes one permanent line in a log you can read; if the log can't be written, the door doesn't open.
Identity theft is a crime of aggregation: it scales where identities pool. Your archive stays in your house, at whatever rung you choose. A thief who wants a thousand records here has to rob a thousand houses.
When neighbors buy together, the money moves between neighbors. We never hold, route, or take a cut of it. Community funds sit with an independent fiscal host, in escrow, released by named people, on a public register.
Records are superseded. The old version is kept. Provenance rides every item. Tampering leaves tracks.
AI agents propose; named humans decide — consent changes, money movement, anything published. Every agent's work is logged and reviewed. A poisoned document alone can't cause fraud.
Time in the application is an anti-metric: it should go down as tasks end. Because attention is not sold, the product has no business reason to prolong a session.
The inversion: monitoring runs where your data lives. The watchdog is in your house and reports to you. We see only the seams: pairings, public money flows, session confirmations.
We prove who people are at the seams. Joining to hold your own archive needs almost no proof: you can't steal value by claiming an empty archive you then fill with your own life. Proof rises only where a claim touches someone else's data, money, or trust: granting a person access to your partitions, emergency access, a Host's certification, a circle's shopping run, a builder taking community funds. We never use "security questions" like a mother's maiden name, because a thief can already find the answers in breached data. Identity here is proven by documents where the stakes demand it, and by relationship (people who already know each other, vouching) everywhere else.
Medical identity theft (someone getting care, prescriptions, or insurance money as you) poisons the records institutions keep about you, and can hurt you in a hospital bed. A person-held archive is the best detection instrument that exists for it: your right of access pulls the institutions' records to you, where your own local watchdog can compare them against your lived life (a claim you never made, a prescription you never filled, a visit you never had), flagged in plain words, in your house. And if it happens, recovery is a runbook: detect, preserve (your archive is your evidence locker), report, correct, follow up, with letter templates in English and Spanish. A person-held archive is how you fight back.
The "we will never ask" list. The moment this place has a name, someone will call a senior claiming to be from it. So, printed on every handout:
Draft wording 📋 — the founder writes the final version of this list, because it will be quoted back to us for years.
Community-funded jobs: pledges sit in escrow with an independent fiscal host; money releases at milestones, by a named job owner; every pledge and release is on the public register. A job's owner and its chosen builder are never the same household. A stalled job is a published process: re-bid or refund.
Buying circles: we never touch the money, so we also cannot claw it back. Protection happens at formation instead: known people, small first runs, receipts with provenance, savings counted only against real prices ("never invented"). The person who shops holds the group's money for an afternoon. Choose them the way you'd choose who holds the potluck cash.
Hosts: paid flat, fair rates. Pay never varies with referral, enrollment, or product placement. Your benefits results are compensation-blind, so nobody can buy a place in them. Sponsors fund capabilities that belong to everyone. They never buy access to members.
Government money: grant and Medicare dollars carry the strictest rules in this plan, including truthful certifications, separate books, exclusion screening, and a family-relationship firewall documented in the open, because sunlight is the credible answer.
The word "abuse" here means a human using the system's trust against a person. Each pattern has a design answer:
The working plan maps duties to their triggers: offering consumer health tools (FTC health rules; California's medical-information law reaches consumer software directly), serving members in each state (a growing patchwork of state health-privacy laws), partnering with health systems (HIPAA, including criminal penalties for snooping), taking grant or Medicare money (false-claims and anti-kickback law), and operating in Europe (GDPR and the EU AI Act). Every unverified legal claim is marked "cited, pending verification" until supported by a dated primary source; counsel must review the highest-impact claims. The full trigger map, seams table, and operating plan live on the technical page.
Sense. Scheduled agents re-walk primary sources (legislatures, regulators, courts) on a calendar; credentialed community members and Hosts flag what they see; alerts from trackers are tips. Only a primary source settles what changed.
Triage. Each change is matched against what it touches (a duty, a consent sentence, a runbook, a page) with a severity class and a deadline. Patch management, for law.
Verify. AI drafts the summary from the primary source; a credentialed professional is paid for the judgment; every page carries a verified-as-of date.
Fund. Jurisdiction pages are community-funded public goods: maintenance retainers, and sponsors including governments funding their own state's page. An unfunded page goes visibly stale. It is never silently wrong.
Tell people, where they live. One verified change becomes: a public register entry · a plain-words note in English and Spanish scoped to your place (a Tampa member gets the Florida sentence, and only the Florida sentence) · updated printed job aids · Host training — the human last mile.
Implement. The change flows through the published change cycle: runbook versions, consent wording (always a human decision), enforcement updates, tests re-run, with the old version kept beside the new, dated, the way law itself works.
Two rules hold it honest. Our own compliance is never crowdfunded. Care Delivery Inc pays for its own legal duties. And jurisdiction is first-class: duties attach to where you live. Our headquarters has no say in it. When a circle spans two states, the more protective rule governs what's shared 📋 (proposed; counsel confirms).
Why jurisdiction comes first, the plain-words story of one global vision honoring each place's own words and laws, has its own page: Your records live where you live.
The plan is v1.0, written July 11, 2026 — a working draft for counsel. No certification exists. Its architecture controls (the gate, the logs, person-held archives, no-cut money) are built and tested today; its people-layer controls (trusted second contact, Host register and codes, the watchdog's weekly "who looked at your archive" note, recovery runbooks) are designed and phased: before public launch, through the first paid roles this fall, and to the strictest tier when government-program work begins in 2027.
Every legal statement is marked "cited, pending verification" until the source-by-source sweep and counsel review complete. This page will say so, dated, when that changes.
Carmen's review of this page is pending: wording of promises is hers, and two items on it (the "never ask" list and the sanctions ladder) ship only in her voice.
Suspect fraud, a scam, or someone being taken advantage of? On the main site: Write to us → "feedback," or call the number and tell a person. Reports can be anonymous; retaliation is forbidden in writing; every report is logged and answered.
Security researchers: good-faith testing is welcomed, credited, and protected by the safe harbor in our Terms, §15. Write to us → "security."
Want the detailed controls? The technical page contains the seams table, money controls, law map by trigger, and open decisions. The builders' page separates current test enforcement from future commitments.