# Collector privacy and certificate claims

Open Print certificates are public records. A name placed inside a certificate
travels with every downloaded copy, archive, registry mirror, and backup. It
should be treated as published information, not as an account profile.

Open Print offers three collector choices:

1. No public name. The certificate stores `displayName: null`.
2. A public display name. The chosen label becomes part of the signed
   certificate and cannot later be removed without creating a different
   certificate.
3. A private local label. The adopting application stores it separately and
   never places it in the certificate or public archive.

The package prepares those two destinations explicitly:

```ts
import { prepareV1Collector } from "@open-print/core";

const collector = prepareV1Collector({
  publicDisplayName: null,
  privateLabel: "reading-room loan",
});

claims.collector = collector.claims;
// Store collector.privateLabel locally, if it is needed at all.
```

Blank labels become `null`. Public and private labels are trimmed, limited to
120 characters, and cannot contain control characters. The library does not
try to guess whether text is a real name or an email address. An adopting
application must not place email addresses, account IDs, payment references,
postal addresses, or other persistent identifiers in `publicDisplayName`.

Private labels are not Open Print records. They should be deletable without
changing the certificate, its fingerprint, or its registry event. The
certificate schema rejects a `privateLabel` field inside collector claims.

If a published collector name is wrong, do not edit the signed certificate.
The issuer can cancel or supersede it with a later registry event and issue a
replacement according to its correction policy.

## What verification can establish

When every corresponding check passes, Open Print can establish that:

- the certificate claims still match their recorded digest;
- the signature was made by the private key corresponding to a key in the
  supplied issuer record;
- the certificate fingerprint appears in the supplied signed registry;
- the supplied registry reports the certificate as active, cancelled, or
  superseded;
- the issuer's statement names a particular edition, source revision, license,
  sequence, and optional public collector label.

These conclusions are only as trustworthy as the issuer record and registry
supplied to the verifier.

## What verification cannot establish

Open Print does not by itself prove:

- who created the artwork;
- the real-world identity or authority of an issuer;
- copyright or any other intellectual-property right;
- possession of an artwork file or access to a display;
- legal ownership or transfer of rights;
- scarcity of copies of the artwork;
- authenticity outside the issuer's signed statement;
- monetary or financial value.

Every conforming 1.0 certificate carries the same notice:

> An Open Print certificate is a signed statement by its issuer about a
> specific edition record. It does not by itself prove authorship, copyright,
> possession, legal ownership, transfer of rights, or financial value.

The certificate schema requires that exact wording. Verification reports and
the command-line verifier also return a stable assurance statement describing
the same boundary.

This document defines the technical meaning of an Open Print record. It is not
a substitute for an issuer's license terms, privacy notice, collection policy,
or legal review.