Digital Sovereignty

Sign In to Your Citizenship

Every person has rights over their data that they never use. The law already wrote them. Four steps put them in your hands: your passport, what you are owed, the letter that claims it, and the clock the company is on.

  1. Passport
  2. Rights
  3. Claim
  4. Clock

Step 1

Your Passport

A digital citizen is a person who uses the rights the law gives them. Your passport records two things: your name, as you will sign your letters, and where you live, because your rights come from the law of the place you live, not the place the company is. It is issued here and kept in this browser; nothing is sent to us.

Step 2

Your Rights

Six jurisdictions, each with the statute, the rights it grants, the company's deadline and the regulator who hears complaints. Your passport's country is open; the others are here to read.

United KingdomUK GDPR and the Data Protection Act 2018

Your Rights

  • Access: a copy of everything they hold on you, free of charge
  • Rectification: have wrong data corrected
  • Erasure: have data deleted when there is no good reason to keep it
  • Restriction: have them stop using it while a dispute is settled
  • Portability: your data in a machine-readable file
  • Objection: to direct marketing, always; to other uses, with reasons
  • Automated decisions: not to be subject to one with legal effect without a human

Their Deadline

One month from the day they receive it. They may add two months for a complex request, but must tell you within the first month.

If They Miss It

Complain to the Information Commissioner's Office (ICO).

Companies may refuse a request they can show is manifestly unfounded or excessive, and may ask for proof of identity first.

European Union and EEAthe General Data Protection Regulation (EU) 2016/679

Your Rights

  • Access (Art. 15)
  • Rectification (Art. 16)
  • Erasure, the "right to be forgotten" (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Objection, including to profiling and direct marketing (Art. 21)
  • Not to be subject to a solely automated decision with legal or similar effect (Art. 22)

Their Deadline

One month from receipt, extendable by two months for complex or numerous requests, with notice in the first month.

If They Miss It

Complain to the data protection authority of your country (the EDPB lists every one).

The same rights apply across all 30 EU and EEA states; you complain to the authority where you live, work or where the breach happened.

California, United Statesthe California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 and following)

Your Rights

  • To know what personal information is collected, from where, why, and with whom it is shared or sold
  • To delete personal information the business collected from you
  • To correct inaccurate personal information
  • To opt out of the sale or sharing of your personal information
  • To limit the use of your sensitive personal information
  • Not to be discriminated against for using these rights

Their Deadline

45 days from receipt, extendable once by a further 45 days with notice.

If They Miss It

Complain to the California Privacy Protection Agency (CPPA).

Applies to for-profit businesses above the law's thresholds (revenue, volume of data, or share of revenue from selling data), not to every company.

Brazilthe Lei Geral de Proteção de Dados, Law No. 13.709/2018 (LGPD)

Your Rights

  • Confirmation that they process your data, and access to it
  • Correction of incomplete, inaccurate or out-of-date data
  • Anonymisation, blocking or deletion of unnecessary or excessive data
  • Portability to another provider
  • Deletion of data processed with your consent
  • Information about who they have shared your data with
  • To revoke consent

Their Deadline

A simplified answer at once; a full declaration of your data within 15 days.

If They Miss It

Complain to the Autoridade Nacional de Proteção de Dados (ANPD).

The LGPD applies to any processing carried out in Brazil or aimed at people in Brazil, wherever the company sits.

Canada (federal, private sector)the Personal Information Protection and Electronic Documents Act (PIPEDA)

Your Rights

  • To be told whether they hold personal information about you, and to see it
  • To know how it has been used and to whom it has been disclosed
  • To challenge its accuracy and completeness and have it amended
  • To withdraw consent, subject to legal and contractual limits
  • To complain to the Commissioner if you are refused

Their Deadline

30 days from receipt, extendable by up to 30 more days with written notice and reasons.

If They Miss It

Complain to the Office of the Privacy Commissioner of Canada (OPC).

Quebec, British Columbia and Alberta have their own private-sector laws with their own regulators; Quebec's Law 25 adds erasure and portability.

Australiathe Privacy Act 1988 and the Australian Privacy Principles (APPs)

Your Rights

  • Access to the personal information an organisation holds about you (APP 12)
  • Correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13)
  • To know the purposes of collection and who it is disclosed to (APP 5)
  • To deal with an organisation anonymously or under a pseudonym where lawful and practicable (APP 2)
  • To opt out of direct marketing (APP 7)

Their Deadline

A reasonable period; the OAIC's guidance treats 30 days as the outer limit for an organisation.

If They Miss It

Complain to the Office of the Australian Information Commissioner (OAIC).

Most small businesses with annual turnover under A$3 million are outside the Act; there is no general right of erasure yet.

Step 3

Claim Your Data

A formal access request, written under your country's law, asking for everything a company holds on you, where it came from, who it went to and how long they keep it. Copy it into an email or their privacy form. Nothing you type here leaves your browser.

Step 4

Their Clock

Every request you mark as sent is counted down here against the legal deadline. When a company is late, the entry turns red and names the regulator to write to. The list is kept in this browser only; we never see it.

  1. No requests yet. Write a letter above, send it, and press "I Have Sent It".

Why a Citizenship

The institutions people used to lean on, the school, the lawyer's office, the library, have moved onto the internet, and the internet has no citizens: only users, with accounts owned by someone else. Everything you have online, your words, your money, your name, your record, sits on another company's machines under another company's terms.

Digital sovereignty means you own what is yours online and know where it is. The law already says so in most of the world; what has been missing is anyone using it. This is not a VPN and not hiding. It is enforcement: the rights, the letters, the clocks, and when a company is late or something is taken, the regulator, the law and our own software, in that order.

We will never sell a citizen's data, read what companies return to you, or keep what you type on this page. That is the whole constitution. The same rule runs through our software for businesses: the AI Trust Proxy keeps a company's customers' data on the company's own machines instead of leaking it through an AI model. One side of the law for the citizen, one for the company.

General information about the law as it stood on 31 October 2026, not legal advice. Statutes and deadlines are cited so you can check them; a lawyer in your country can tell you how they apply to you.