← Back to the beta forms · Beta page
Earned Trust Beta Trial · Draft 24 · 12 September 2026 · This is the version you are agreeing to.
Draft 24, 2026-09-12. The BLANK form is published with the study design, which is published at its permanent web address (its DOI, 10.5281/zenodo.22547805), and is frozen for the phase. Your SIGNED copy is not deposited and not published — a publishing rule about what the study prints, not a privacy promise. This form discloses; the Terms of Participation, signed with it, sets the limits; the duty map lists the whole undertaking. Keep a copy of all three signed documents.
Words you’ll meet
Your code — the short tag the study gives you when you’re enrolled. It looks like ET-0906-03. Every form after Apply asks for it.
Your window — the weeks your enrollment confirmation gives you to finish. Its last day is in that email.
The Reader — the study’s web page at earnedtrust.org/reader. It opens your QR card, checks your kit download, and holds the exit form.
Locked box — your working record (drafts, notes, AI chat logs) bundled into one file and locked with a passphrase, using the free program 7-Zip. Only you can open it.
Seal manifest — a short text file listing each of your files and its fingerprint. It proves nothing changed after you sealed.
Fingerprint — a short code computed from a file (a checksum). If the file changes by one character, the fingerprint changes.
Deposit — the set of files you publish on Zenodo: your work, your QR record card, your seal manifest, and (if you choose) your locked box.
Zenodo — the free public archive, run by CERN, where you publish your deposit.
DOI — the permanent web address Zenodo gives your deposit. It looks like 10.5281/zenodo.1234567. It is the one thing you give the study at the end. Give the version DOI — the one shown on the record page for that version, not the “all versions” DOI.
Mint — to publish your deposit on Zenodo so it gets its DOI.
The ledger — the study’s published count of every message it sent or received during the trial.
This is a publicly offered trial whose results are published. Enrolling carries no expectation of privacy in anything you send the study.
Email is a postcard, not a locked safe. Send us nothing you could not bear a stranger reading.
Our one commitment is the big one: we never see, hold, or review your work — your public deposit excepted: the five checks download it and recompute its fingerprints, and read none of it. This trial studies the process, never the work.
If you take part, your name and — when you make a deposit — your work’s DOI will be published in the report. That is what makes the trial checkable by anyone. When there is a deposit, the DOI is required and public. The name that prints is the author name on your Zenodo record — a pen name is fine, but it has to be the name on the DOI publication, because the DOI is the check. The name you enrolled with is held privately; your letter and citation come to you under it. Whether the name on your record is legal, common, or chosen is your own business, settled before you contact us; we do not verify it, do not administer it, and make no promise about it. You will see exactly how you print before you send your exit form, and that recheck is the last word — there is no later change window.
The first field test of the Earned Trust method with independent adopters — designed, run, analyzed, and reported by the standard’s creator, William Stafford, its principal investigator (PI), an independent researcher with no institution behind him. You bring a real project of your own and use the public method exactly as any stranger would; the study measures whether the public materials alone carried you to a checkable record. We review the process, never the work. One honest condition on the name: the report keeps the title “field test” only if six or more people were enrolled when enrollment closed; fewer, and the same report is published, titled a pilot. This consent form binds to the study design published at 10.5281/zenodo.22547805; that document is public and stamped with a checksum, so any change would show.
Applying is one published form, one send, reached from the “Apply” button on the study page: the nine screening questions, then the acknowledgments below, your typed name, and the date. No code is needed to apply. The study checks your application against the published list of who gets in. If you are enrolled, your confirmation email carries your code — a short code we build from the date your application arrived (it looks like ET-0906-03) — and every form after that asks for it first: intake, the exit form, and, if ever needed, Name and DOI correction or withdrawal. The form itself can’t check your code; we check it when your email arrives: the code must match one the study issued, and the form must come from the email address the code was sent to. A form that fails either is not filed, and answered with the notice: “NOTICE: your ETR code was not accepted. Please check your code and try again. The form must also come from the email address your code was sent to.” Every form you send is answered by a scripted email: confirmed, or not accepted. The first valid form of each kind is the one that counts. A later duplicate is logged in the contact ledger and cannot replace it. The code is not a disguise: the author name on your Zenodo record is the name that prints.
Sending the application authorizes only the handling of application data that this form describes; consent to participate takes effect only on enrollment. If you are screened out, you are not a participant and none of the participation acknowledgments below binds you. The study keeps your name, email, exclusion reason, and date on one screened-out list until the trial’s last phase closes, so it can recognise a repeat application; the list records whether the reason was about you, about that project, or about the phase, and only a reason about you closes the door to a later application — a new project, or a later phase, is screened afresh; your form itself is deleted 30 days after the phase closes. Screened-out applicants print only as a count.
Enrollment stays open until the principal investigator closes it. Six is the target for phase 1, unless an early close is announced. The PI does not close it before six people are enrolled, except by an announced early close — its date, the count, and the reason go on the beta page. Enrollment closes no later than twelve months from the first enrollment (from opening day, if nobody has enrolled by then). There is no fixed cap. The decision to close may not use any exit answer, DOI check, result, wall, or interim finding; no interim result is published before enrollment closes; the date, the count, and the reason are recorded before any analysis. If demand outruns the phase, the answer is a second phase. The phase ends when the last tester’s window closes.
At least three working sessions across at least two weeks, inside your own window — four to six weeks for a light project (roughly 4–6 hours), eight to twelve weeks for a heavy one (15–50 hours) — starting the day we confirm your enrollment. Your confirmation states your window as a number of days and a closing date. It also names the kit version your trial runs on, and links that version’s own file. The kit may be updated during the phase when the PI rules an update is warranted; every version stays on the site at its own address, and the Reader verifies every version issued in the phase. Use the kit you downloaded. If the website shows a newer version during your trial, ignore it — your trial runs on the version named in your enrollment email. You’ll carry the process to the end: your record kept as you work, your working record locked by you on your own machine, your deposit minted by you on Zenodo, and your exit form sent. At the end you publish three files on Zenodo — your work; a small card with a QR code; a short list of file checksums (the “seal manifest”) — and, if you choose, a fourth: your password-locked working record. Scanning the QR opens the log of what your AI did, in our web viewer (the Reader).
What taking part may cost you, in money: the hours above are one cost; here is the other, stated once so nobody finds it out halfway through. What you’ll need. An AI you already use, on a plan that can hold a long conversation — the protocol alone is about twelve thousand words, and you’ll be working with it for weeks. Free plans often can’t; a paid plan usually can, and a month or two usually covers a project — check your plan’s cancellation terms. Check what your plan includes before you start. You’ll also need a second AI service for one step — the hostile read — and a free account there is fine. If you truly have only one AI, a fresh conversation with it will do for that step; your record will say so; for work that makes checkable claims — a family history with dates, a researched essay — a second company is required, not optional. The finishing steps run two small scripts from the kit; that needs Python on your computer — a free, five-minute install your AI walks you through. Taking part may cost you a month or two of a subscription; the study pays nothing and asks for nothing.
Two sentences to hold onto:
Emails during the trial will not receive a response.
If you do not complete the trial within your window, you will be logged as
incomplete.
The exit form is your last step, and it is one form, one send. You fill it in on the exit page of our website (the Reader), in your own browser — picklists, checkboxes, dates, numbers, and your DOI; no free text anywhere, and every list ends with “other,” filed exactly as that. When you press Submit, the page shows you back everything that will be used — your answers, your name exactly as it will print in the report, your DOI, whether you worked mostly on a phone, mostly on a computer, or a mix — under one line: Check this before you send. This is how you will appear in the report. Please make sure your name and your DOI are correct. That recheck is the only correction point: what you confirm there is final. Then one button opens a message already written, and Send is the only action left. Keep a copy of the coded text the page produces — it is your proof of what you sent, and ours.
When you press Submit, the exit form makes two lines from your answers. Your public line holds everything that prints — it goes in the report’s appendix word for word, and it is the only thing in the QR image. Your private line holds the five report-private answers; the study keeps it, counts it into totals, and never prints it. Both lines go in the same exit email. Your private line is held by the study and never printed; it is not encrypted, and email is a postcard.
Your DOI, once, carefully. Copy it from your Zenodo page — don’t type it. The DOI you give must be the version DOI — the one shown on the record page for that version, not the “all versions” DOI. Before the checks, the study confirms the record holds your Earned Trust deposit (your card and your manifest) and that the author name on the Zenodo record is the name on your exit line. If either does not match, you get one email saying which, and the correction form takes your name and DOI together. That email names what failed — your DOI did not open · you gave the “all versions” DOI instead of the version DOI · the record does not hold your Earned Trust deposit · the author name on the record does not match the name on your exit line — and points you at the Name and DOI correction form; a correction is accepted until your window closes, or 14 days after that email, whichever is later. If the check still fails, or no answer comes, one note tells you the record is counted as “no deposit found.” Those are the only messages about a check. If your exit form says you made no deposit and the DOI field is blank, your record is counted at once as “no deposit found” within completed or stopped, as your form says. You get the confirmation of your exit and nothing else — no correction email, no note, no documented-participant letter.
Don’t start your first recorded session until you receive your enrollment confirmation email — applying is step one, not the green light.
Your application’s email address and timestamp; your code, if enrolled; your nine screening answers, on the same form as this consent (if you are screened out: your name, email, exclusion reason, and date on the screened-out list until the trial closes, and nothing else); the enrollment name you give us, held privately — the name the report prints is the author name on your Zenodo record; your three signed documents — this consent form, the Terms of Participation, and the duty map; your intake answers, every one a picklist (project type; AI service and tier; experience level; the devices you expect to work on, and whether mostly a phone, mostly a computer, or a mix; whether you’ve used the protocol before), plus the version number and checksum of the kit you downloaded, and your tick that you had not yet started a recorded session; your exit form — two coded lines: your public line, carrying your DOI and your structured answers (and, if you take the optional tagging exercise, its structured answers the same way), and your private line, carrying the seven report-private items (your private line): the date you opened your locked box, the three questions about whether anyone asked for your passphrase, whether anything on your card makes you uneasy, where your sessions happened (phone, computer, or both), and whether another living person’s story entered your work. Those seven are printed only as totals. They never print beside your name — only as totals. Your private line is held by the study and never printed; it is not encrypted, and email is a postcard. Also: any Name and DOI correction return you send; and the dates and times of all of it, with every scripted answer the study sends you, counted in the published tally of every message the study sends or receives (the “contact ledger”). Nothing else — and never your manuscript, your transcripts, your working files, or your passphrase.
This short list is your Study Records; everything else — your project, your files, your transcripts, your locked box, your passphrase, your accounts, and the deposit you create — is your Participant-Controlled Materials, defined the same way in the Terms. It never comes to us, with one public exception, the same one the Terms names: your deposit, which you chose to publish — we look at it only the way any stranger could, through the five public checks the playbook describes (your DOI opens to your record; your files download; your QR card scans and opens the index in the Reader; your seal manifest is there and complete; and every fingerprint matches), after the two confirmations described above — that the record holds your deposit and that the name on it is the name on your exit line — and not before your exit is in. Your locked box stays on your own machine, in your custody alone, unless you choose to publish a copy as your fourth file; the study never instructs you to upload it anywhere, and nothing in the method ever tells you to delete a file that holds your work. Everything we hold lives in the study’s email account (Proton Mail) and the researcher’s local folders, kept five years from the report’s publication, then deleted. The study’s records are seen by the PI and any named co-PI, and by no other person at the study; the providers we name handle what passes through them as any mail or AI service does. The study’s mail is hosted by Proton, and the study’s drafting uses AI tools under the standard, as this form says here: our drafting — including the report — uses AI assistance under the Earned Trust Protocol, so your answers may pass through a commercial AI service during drafting. If that matters to you, do not put it in a message to us — email is a postcard here as everywhere.
The report and its appendices are effectively permanent public deposits — plan as if permanent. They will contain: your findings under the author name on your Zenodo record, with your DOI; the support log and the contact ledger, as counts; and the exit appendix: every public line, verbatim — any reader can decode the study’s raw data in the Reader, which is the point. One exception, named item by item in the published design: seven of your answers — the seven report-private items (your private line), the three questions about whether anyone ever sought your passphrase among them — are printed only as group totals, never per person: a per-person “yes” beside a public record would hand attackers a map. The private lines are held by the study and never printed. These are the study’s published editorial rules — descriptions of what we print, never privacy promises owed.
The report puts every enrolled tester into one of four outcomes: completed — exit form sent, “I completed the trial” · stopped — exit form sent, “I’m stopping here — count what I filed”; your name and answers stay in · incomplete — the window closed with no exit form; counted, never named · withdrawn — the Withdraw form, by your own hand, only; your data comes out, and an exit line already sent still prints. A withdrawal filed after your exit cancels every letter not yet sent and keeps your filed exit line, which still prints. “No deposit found” is counted separately within “completed” or “stopped,” whichever the exit form said. Running out of time is never written down as a choice you made. An enrolled tester who disappears is counted, never erased.
What “permanent” really means — for our deposits and for yours. Treat every public deposit as permanent, because in practice it is. The platform’s own rules — not the study’s — decide what is possible: as of 2026-08-15, Zenodo lets a record’s owner delete it within 30 days of publication, and after that allows deletion only “in duly justified cases, such as copyright infringement or exposure of personal data,” on request through their support line; a record that is removed leaves a permanent tombstone page with the citation. Those rules can change, requests can be refused, and anything already downloaded, indexed, cached, or cited by someone else is beyond anyone’s reach. So: plan as if nothing can ever be taken back. Zenodo’s published removal procedure is linked in the published question list — during your trial nothing here is answered, so the published procedure is the answer. The QR card you publish is public under whatever Zenodo account name you publish it with. Before you mint, run the privacy check in the published materials with your AI — the check is public, and running it is part of the method being tested.
Your name in the report is the author name on your Zenodo record — a pen name is fine, but it has to be the name on the DOI publication, because the DOI is the check; the name you enrolled with is held privately, and your letter and citation come to you under it. You see the name, exactly as it will print, on the exit form before you send; and after your exit is filed you receive one letter — your documented-participant letter — a receipt showing your citation line exactly as you confirmed it on the exit form’s recheck screen, generated from the exit line you filed or corrected, never retyped (the report’s line for you is generated the same way); nothing is substituted. It offers no change window: the recheck was the last word. One editorial rule, stated plainly: persona details are published only as group totals, never joined to your findings — a rule about what we print, not a promise of anonymity, because in a group of six, a detailed description can identify a person, and no editorial rule can change that. Your DOI, when you make a deposit, is published, and anything public on that deposit (including your Zenodo account name) travels with it.
A record minted under the standard carries the standard’s duties, which outlast this study: the record is kept at least five years, stamped with checksums so anyone can later confirm a copy is unchanged. Whether to open your working record for any particular person is, and stays, your choice — the standard assigns no cost to declining. A safety rule to keep forever: no legitimate request asks for your passphrase, your keys, or your whole sealed archive. Your passphrase should never leave you — never typed into any website, never pasted to any AI, never emailed to us. If it ever does leave, treat it as exposed. Choose a new passphrase and make a new locked box from the working folder on your computer, by repeating the kit’s locking step. A passphrase on an existing box cannot be changed; you make a new box. Then tell us on the exit form: that is a finding about our materials, not a failure by you. Keep it somewhere you will always find it — this is not your bank password; the box keeps strangers out, not family — and keep it as long as you keep the record.
We are not a service, and we are not experts you have hired. This is one person’s research project. There is no institution behind it, no company, no staff, no ethics board, and no independent complaints route. The PI may add additional principal investigators as the trial needs them. Each is named on the beta page and in the report the day they join, with the date, and is bound by every rule that binds the PI. A co-PI is not staff, and is named. Everything here is free, and nothing here is a professional service of any kind.
Nobody here is licensed to help you with anything personal. Not counseling, not medical advice, not legal advice, not financial advice. Neither the researcher nor any AI used in this project is qualified for those things, and none of them is being offered.
We are not your support desk, and during your trial no human answers you. The method is the thing being tested, so the study cannot teach you anything the published materials don’t already teach. Your own AI, holding the published protocol, is your working support — on the kind of plan “What taking part may cost you, in money” describes, above — and the study never walks you through anything, because walking-through is the AI’s job and measuring whether it does that job is the study’s whole point. Every message you receive from the study during your trial is machine-sent or scripted. The PI composes nothing to you, answers nothing, and reads nothing beyond what a script requires. The FAQ is the only place answers come from, and the automatic reply points you to it. Nothing else answers. Anything outside the protocol — Zenodo, accounts, tools, your own project — belongs to your own AI. A question the FAQ does not answer is a study finding, recorded as a count. No answer is composed, then or ever. Emails during the trial will not receive a response; anything sent that the study did not ask for is not read and not answered.
You never compose a message to the study. Every message we ask you for is written for you by one of our published forms; you only press Send. The complete list is apply · intake · the exit form (your DOI on it) · Name and DOI correction · withdraw — every one after apply asks for your code. Names, dates, DOIs, and fixed choices are data fields, not narrative. Send is the only action left.
One of those returns is an administrative action, not a conversation: withdraw. A fixed exit-form choice records whether the published materials lost your record.
The honest limit, said plainly. A person can always type into an email client, and no rule of ours stops that. What the study does with it is one sentence: it is not read and not answered. The PI owns the mailbox, so we do not claim that no human ever sees anything — that promise could not be kept, and we will not make it. What we promise is the part that can be kept: no human answers, and the PI authors nothing to you during your trial. The contact ledger publishes the count, expected to be zero during the run, and prints whatever it actually is.
We hold none of your work, and cannot protect what we do not hold. Your Participant-Controlled Materials stay in your custody, on your machines and accounts, for the whole study. We have no control over your computer, your phone, your accounts, your AI service, your cloud storage, or your Zenodo account, and we are not responsible for anything that happens to them — including loss, corruption, theft, hacking, a mistaken upload, or a passphrase you can’t recover. What we do hold is the Study Records list above, with ordinary care, in the places and for the period named above. We do not promise it can never be breached, because nobody can honestly promise that. If the study’s inbox or machine is ever compromised, that fact is published in the report’s list of things that went wrong and every enrolled tester is told.
Free, as-is. The protocol, the kit, and the site are free, published under their stated open licenses. They come with no warranty of any kind — no promise that they are correct, complete, fit for your purpose, that they will produce any particular result, or that they will stay available. There is no money in this project and none is owed to you.
If another living person’s words, story, or personal details enter your sessions (a relative, a friend, anyone), that person’s consent is your responsibility as the author, exactly as it is for any writer — the study does not ask for it, record it, or confirm it. The screening form and the exit form record only the fact that another living person’s story is in the project, as a cohort count. We never seek that person out; if they ever contact us, we hold nothing of theirs to delete and have no relationship to act on. The standard’s advice stands: before you mint, run the privacy check with your AI, and make the decision deliberately — a deposit is permanent.
If a child is in your story — decide slowly. Family cookbooks and memoirs are full of grandchildren, and this study recruits exactly such projects, so we won’t pretend an absolute rule could hold. The working instruction is the published one: before you mint, run the privacy check with your AI, and take any child’s detail out or replace it with a relationship word — “my grandson,” not a name and a birthday. We cannot check this and will not police it — we never see your work — and a deposit is permanent. Make it a deliberate decision, not a fast one.
There is no payment — we say so here so credit is never payment for praise, and bad news costs you nothing to deliver. After your exit is in — never before — one scripted courtesy message arrives: the confirmation of your exit — one opening if you completed the trial, another if you stopped, as your form says — plus two prompts you can paste into your own AI, one to see your work as a styled webpage and one to put it online free, step by step. The prompts are the whole gift: we never receive, build, host, or see your page or your work. Then, if your DOI check passes, your documented-participant letter: a receipt of how you print, as you confirmed it. Both are logged in the contact ledger, and ignoring either costs you nothing. When your exit is in, the trial is over for you, and the PI’s duties to you as the person running the study end. This study has no institutional ethics board behind it and no independent complaints route; no formal review was obtained. What stands in its place is this form, the published design nobody can quietly change, the data minimum above, the name rule, the exit-time recheck, the receipt letter, and your withdrawal rights.
By signing below, you are also saying, specifically, that you have read “What this study is not” and that you understand:
Tester initials: ______ Date: ________
This consent form, the Terms of Participation, and the duty map are signed together and read together: this form tells you everything; the Terms sets the limits; the duty map lists the whole undertaking. Nothing in this form waives any right — it discloses only — and the Terms says the same of itself toward this form, in its opening savings clause.
Tester (typed name): ______________________ Date: ________
William Stafford, Principal Investigator — signature: ______________________ Date: ________
The published apply form generates one fixed return containing your nine screening answers, your typed name, date, and acknowledgment choices. That is the study’s signature process, and it signs this form, the Terms, and the duty map together. Download or print all three signed documents and keep them — that is your copy; the study keeps its own and sends none back. These documents were not drafted or reviewed by an attorney.