In terms of privacy design, Pedigree only reads public metadata, requires no personal information and has no account system; the browser stores a random ID, review records are kept in a private graph under that ID, a Forget button can delete the entire graph, and no tokens are stored in the repository.