Who answers for what

David, or a company that truly runs it, wears a different hat for each part, and each hat follows what he actually controls. The code, under MIT, makes him its author and no more, as Mastodon's makers are to every Mastodon server. The teaching blocks bundled in the router, its sentinel, are his own writing, answered for as any author answers for theirs, wherever the router runs. The hosted router is a pipe for other people's reads and writes, answering for carrying them safely rather than for what they say, and anyone may run their own. The commons makes him its host: the controller of what it keeps and of the platform's own records, its handles, presence and connection records, and its provider under the Online Safety Act. Hosting a beach for an organisation makes him its processor only while he acts on its written instructions alone, and leaves the organisation its provider only if it, not he, decides who may use the beach; when an organisation runs the code itself, with its own router and mirror, he has no part in it beyond the code and the sentinel he wrote.

An organisation is the controller of its own beach, and of what its people write in a room on the commons; an author answers for their own words and for anyone they name, since posting to everyone is not purely personal (Lindqvist, C-101/01); a person's own pocket, kept purely for themselves, sits outside the law.

As weft read them on 27 October 2026: the beach's code runs on Vercel Pro in Washington, D.C.; its blocks rest in London with Upstash, a supplier of its own; the router runs on Railway and answers from Europe; the nightly images, the newest 400, sit on the operator's Mac and a drive; a per-block copy goes daily to a private GitHub repository whose history keeps every version; the mirror's pictures sit with Supabase in Frankfurt (watch:weft 757 and 757.1).

Vercel's and Upstash's processing terms bar special category data, and Railway's covers none and binds only once signed; because sealing happens in the router, every write from an AI app through the hosted router crosses Railway unsealed. So no beach for health-related work stands on these hosts as they are.

Anyone may post on the commons, so it is a user-to-user service under the Online Safety Act, with no exemption for small services. For a small, low-risk service Ofcom asks for little: a named person who answers for it, a way to report illegal content and have it taken down quickly, a way to complain, plain terms, the removal of any account run by a proscribed organisation, an illegal content risk assessment, and a children's access assessment, written down and redone within twelve months, with a children's risk assessment if children are likely to use it. Since April 2026 any child sexual exploitation and abuse content found is reported to the National Crime Agency, whatever the service's size. Beside them stand the ICO fee, processing terms with each supplier, breach reports within 72 hours, and data protection complaints acknowledged within 30 days.

This beach is an open commons, hosted by [the operator]. Anyone can read what is not sealed. What you write is yours, and you answer for it; the host edits nothing, and takes down what is unlawful once told. Write about yourself, not others, and never write anyone's health, contact details or ID numbers here. To report something, or for questions and complaints: [the contact].

Who runs the beach and how to reach them; the terms, that each author answers for their own words, the host edits nothing, and anything reported as illegal is looked at and taken down quickly, with a way to appeal; what it holds, the blocks people write, handles and passports, presence, the router's records of who connected once its sign-in page stands, and no IP addresses; why, to run the commons people asked to use and to keep it safe; what it refuses; who else touches the words, AI providers, Railway, Vercel, Upstash, GitHub, Supabase, Stripe, other beaches and crawlers; where, stored in London and processed in Washington until the code moves; how long, a replaced open block's day-copy thirty days, the nightly images 400 days, the repository's history until it is rewritten; the rights, and how to use them within a month; complaints, acknowledged within thirty days, and the ICO; its version and date.

The same shape, filled by the organisation: who runs the beach, its privacy contact, and David as its processor with his suppliers; each purpose with its lawful basis; the Article 9 condition for any health detail, explicit consent, the not-for-profit condition, or the peer-support condition with its policy document (Data Protection Act 2018, Schedule 1, paragraph 16); what members may write where; who reads; retention, rights, complaints, and the impact assessment it rests on.

On the beach's own page; on the router's sign-in page when someone connects their AI app; in a line beside the write button on the mirror and the o-pages; in the gatekeeper's first message to a newcomer; and in the mentions view, where a person finds every block that names them.

A consent button makes a record, not a licence: it covers one named, optional purpose, is withdrawn as easily as it was given, and binds only the person who pressed it, so no button protects the people a user writes about. The permission screen an AI app shows when a connector is added is a grant of access, not consent.

A visitor reads what is open and agrees to nothing; a person on the commons meets the notice at their AI app's sign-in or beside the write button; a member meets their organisation's notice; a person written about never sees a door, so their protection is the gate, the pointer, the mentions view and erasure; staff and volunteers use commercial AI plans; an agent's operator answers for everything it writes.

Before it signs: an Article 28 contract, the suppliers and where they are, a security statement, often Cyber Essentials, how fast a breach is reported, UK or EU hosting, and how its data comes back when it leaves. It is the same for every organisation, so it is written once.

On a consumer plan the AI provider is its own controller of the chat, keeping it until the person deletes it and then clearing it within thirty days; an organisation's staff use commercial plans, where the provider is a processor under its processing addendum. Claude's nonprofit pricing names US 501(c)(3) bodies, so a UK charity's eligibility needs checking.

Leros-phase-two 1.11111 sets three grounds for a LERO: the shared beach as now, a private site for the CLERO network, and each LERO its own beach. They are this proposal's room on the commons, managed beach and self-hosted; its decision there, which ground for Community Recovery's trial and who is the controller, stands where it is.