Trust Without Tracking

Published on 7 October 2026 by David

Communities can make trustworthy commitments and decisions while keeping identity disclosure limited, authority local and participation open. That is the proposition. This post describes three places where we think it could be tested, what we would build, and what we would ask of the people there.

Everything here is a proposal. We have not approached anyone named below, and nothing has been agreed with any state body, timebank, university or newsroom. The research behind each paragraph is on the wiki, starting from Trust Without Tracking, and the plan with its empty checkboxes is on Three Pilots Plan.

One Use Case

Every community we know runs on the same small acts of trust. Someone gave two hours of repair help. Someone is a member in good standing. Someone was asked by their circle to speak for it until Friday. Today those facts are either taken on faith or proved by handing over far more than the fact itself: a name, an address, a history of everything else you ever did.

The use case that joins all three pilots is to verify a contribution, a membership or a mandate without exposing a person’s whole identity or participation history. The Towel holds the keys and signs the bounded act. The community decides who is a member and what a member may do. The timebank recognises the work. The wiki holds the evidence and the approved record, and nothing else.

Three Places

We chose three American states, for what each one constrains as much as for what it offers.

Utah: start where a timebank already works. Salt Lake County has an active timebank with community meetings, a skill share, small children welcome and a Spanish translation team. Utah also has a public body that takes public comment on the fate of the Great Salt Lake, and a digital identity law built on wallet choice and selective disclosure. Time for the Lake would connect practical care, community research and deliberation: seven circles of six people, forty-two in all, compare proposals about the lake and send a recommendation to a body that already listens.

Idaho: voluntary is a design requirement. Idaho has made it unlawful for a public entity to require digital identification or to reduce a service because someone declines it, and it has gone further: digital identification may be used only for immediate verification, with no tracking, no data kept beyond the transaction, no shared credential across agencies, and no demand for the device. That rules out the obvious design and writes the first-person alternative into law, though only for credentials the state itself issues. Neighbour Commons is a community that can verify its decisions even when some members never operate a wallet: a member joins by introduction, uses paper offers and requests, approves an exchange by telephone through a steward, and the record says which it was. Shared practical work comes before any contentious talk.

New Jersey: federate the work across towns. New Jersey has a startup timebank, the Civic Trusts of the Citizens Campaign, a college centre for community engagement, and a state-chartered consortium whose purposes include community storytelling and dialogue between communities. Civic Time Exchange lets one town obtain translation, research or audio production from another, each keeping its own membership and accounts, with a community newsroom telling the story of what was decided and what happened next.

The three laws are compared on Three State Laws. Each gives a holder wallet choice, selective disclosure and an issuer that cannot watch. None of them gives a community’s own credentials any official standing, and we are not asking them to.

One Stack, Three Doors

All three pilots run on the same Common Infrastructure: a personal Towel, a community Towel, an authoritative time ledger, a federated wiki for offers and evidence, an assembly application for agendas and mandates, federation agreements between communities, and an optional adapter for a state credential where one attribute is genuinely needed. What differs is the door: how a person enters, and how much, if anything, they must disclose to do so.

A community node is a small computer at home, with a relay if a town needs one. One device per participant is unnecessary. Hosting the node confers no authority over membership, balances or decisions, and the architecture has to make that true rather than merely promise it.

The Mandate

The decisive use case is the Verifiable Mandate. A circle of six issues a short signed record:

Maya may present proposal version three to the federation until Friday. She may negotiate wording, but any spending commitment requires our further approval.

The record names the issuing group, the approved document, the permitted actions, the expiry and how it is withdrawn. Other groups verify it before accepting Maya’s word as the circle’s. Seven circles examine the same question, each approves a short position including its disagreements, representatives produce a synthesis, the synthesis returns to the circles for correction, and the federation publishes the result with the minority positions. That is a visible route from discussion to collective statement. A signed summary from a chair would not be.

A signature proves who authorised what. It does not make a proposal true, and it does not make it safe to publish. Those are judgements the assembly still has to make.

Time Is Not a Vote

The timebank’s job in a democracy is to recognise the work that makes deliberation possible: translation, transport, research, facilitation, venue preparation, maintenance and reporting. Time Is Not a Vote sets the rule that follows. Time balances never determine voting weight. Someone with no credits has exactly the voice of someone who has given hundreds of hours. Expenses and, where needed, cash are paid too, because time credits cannot clear every barrier.

Between communities, recognise membership and completed-work receipts first, then trial a small number of authorised exchanges. Accepting another group’s credential is not accepting its debts.

The First Experiment

We would begin with one community of forty-two people and run a six to eight week cycle on one practical question, with seven circles and a small supporting time exchange. Five things get tested: joining without digital ID, confirming a service, issuing a bounded mandate, correcting a disputed record, and ratifying a shared recommendation. Then one research or translation task is exchanged with a second community.

If forty-two people can make a decision they can all verify, without any of them handing over more than the decision needs, the proposition holds. If they cannot, we will say so, on the same pages.

Join the Build

This is an open, iterative development process, not a programme with a launch date. The research pages carry the claims we have checked and the ones we have not, on Claims to Check. The plan page carries the checkboxes, most of them empty. The state of the Towel itself is on Towel Status.

If you run a timebank, sit in a circle, host a newsroom or hold an office in a town we have named or one we have not, you are who this is for; Bring a Community says what we would ask and what we would bring. Read the pages and argue with them. Tell us which door your community would need. Bring the practical question you would want forty-two people to answer. The first experiment starts when a community says yes.