# BingBong — Claims Register

> Version: 0.1 (design target). Status: pre-launch design system.

This register classifies statements about BingBong into three tiers: **SAFE**, **CONDITIONAL**, and **PROHIBITED**. Every statement that appears on the public surface must fall into one of these tiers and must carry the required evidence.

## 1. SAFE — claimable now

A SAFE claim is one that is structurally true of the design and does not require deployed scale to support.

| Claim | Required evidence |
|---|---|
| BingBong issues randomized opaque tokens to participating surfaces. | Documented issuance endpoint; randomization policy. |
| Identity and event data are kept in separate domains. | Architecture diagram (`docs/ARCHITECTURE.html`); join policy. |
| Direct identifiers do not exit the boundary. | Edge filter contract; partner obligations. |
| BingBong is in pre-launch design. | Staging banner; `noindex,nofollow`; this register. |

## 2. CONDITIONAL — claimable with evidence

A CONDITIONAL claim is one that requires evidence before it can appear on the public surface.

| Claim | Required evidence |
|---|---|
| Cohort outputs preserve privacy by minimum-count thresholds. | Threshold table; suppression log; documented window. |
| Revocation propagates within a documented window. | Documented window; propagation receipts; test report. |
| Identity-bound fields are filtered at the edge. | Partner contract; partner audit; sample audit. |
| GPC suppression occurs at the boundary. | Partner roster; ingestion test; suppression log. |
| Prohibited-uses list is enforced. | Buyer contract; refusal log; sample refusal. |

## 3. PROHIBITED — not claimable until proven

A PROHIBITED claim is one that cannot appear on the public surface until the evidence required is in hand and reviewed by counsel.

| Claim | Reason |
|---|---|
| "Anonymized data." | Pseudonymization is not anonymization. |
| "HIPAA-compliant." | No HIPAA compliance is claimed. |
| "Certified." | No certification has been obtained. |
| "Patented." | No patent has been granted. |
| "Deployed at scale." | Pre-launch design system. |
| "Audited performance." | No audits have occurred. |
| "Named customers." | Pre-launch design system. |
| "Revenue." | No revenue is claimed. |
| "We are the only one." | Comparison claims are out of scope for the brand system. |
| "100% private." | No system can make this claim. |
| "Singling-out is impossible." | Residual risk is live. |
| "Reidentification is impossible." | Residual risk is live. |
| "Anonymous to everyone, including BingBong." | Pseudonymization by design requires BingBong to hold the mapping. |
| "HIPAA-style." | Borrowed posture, not a compliance claim. |

## 4. Required evidence format

A SAFE or CONDITIONAL claim must cite:
- A document path (`docs/...`) **or**
- A test report path (`tests/reports/...`) **or**
- An artifact path (`assets/...`) **or**
- A URL of an authoritative external source.

A PROHIBITED claim must not appear on the public surface, regardless of evidence.

## 5. Review cadence

A deployed BingBong will review this register on a quarterly cadence. Review outcomes are published with the artifacts the review relied on. Narrative without receipt is not a review.