Pseudonymous reach, documented contracts, prohibited uses.
Buyers do not receive direct identifiers, raw events, or per-user lookups. They receive cohort-shaped aggregates with provenance and a documented retention horizon.
What a buyer gets.
Stable cohort reach
Recognize a stable pseudonymous cohort across participating surfaces, without direct identifiers leaving the boundary.
Aggregate-shaped
Build reach, frequency, lift, and overlap measurements inside a contract that names the prohibited operations explicitly.
Provenance metadata
Every aggregate carries a provenance hash, a retention horizon, and a revocation flag — auditable downstream.
The shape of a buyer output.
Each field below is part of the contract. Optional fields are documented per cohort; missing fields are not silently synthesized.
| Field | Type | Purpose |
|---|---|---|
| cohort_id | opaque string | Stable identifier for the cohort over the contract window. |
| cohort_size | integer, rounded | Rounded to the cohort's minimum-count threshold to defeat near-singling-out. |
| window | {start, end} UTC | Time window covered by the aggregate. |
| aggregate | cohort-level measure | Count, ratio, lift, or other cohort-level measure bounded by the contract. |
| provenance | hash | Hash of the cohort definition, ingestion policy version, and suppression policy. |
| retention_until | UTC timestamp | After which the buyer's local copy is out of contract. |
| revocation_flag | boolean | Indicates whether the contributing token set has been affected by a revocation. |
The prohibited-uses list.
These are not edge cases. They are excluded by contract. A buyer who requests one of these gets a refusal and a recorded attempt.
- Per-user lookups, replay, or deanonymization attempts.
- Linking BingBong cohorts to direct identifiers without a documented boundary event.
- Sensitive-class inference or targeting (health, finance, sexuality, religion, race, political affiliation, minors).
- Cross-context correlation with third-party identity graphs.
- Retargeting beyond the documented contract window.
- Sub-supplying cohort data to parties not on the buyer roster.
Request buyer access.
Access requests are reviewed against the prohibited-uses list and the contract template. Submitting this form is non-binding on the operator and is not a service activation.