420 Attention security and privacy

Raw browsing/viewing behavior, private targeting dossiers, full media payloads, device identifiers and unrelated personal data should not become public chain state.

Only the campaign's bound verifier may commit proofs. Nullifiers are single-use. Proof replay, proof outside the campaign window, missing consent or treasury shortfall must fail closed.

Sponsors and verifiers never receive wallet keys or arbitrary transaction authority through Attention.