Privacy methodology
MedCards public statistics use differential privacy (DP). Each public number gets exact discrete-Laplace noise,
computed with integers only and with the operating-system random generator.
DP outputs
| Output | Privacy unit | ε per release | Releases per year |
| --- | --- | --- | --- |
| public_deck_stats | learner-month, at most 50 decks | 1 (0.3 learners, 0.4 retention, 0.3 minutes) | 12 |
| cohort_benchmarks | learner-week in a cohort | 0.5 | 24 (at most Σε 12 per year) |
| maintainer_card_stats | learner-month per deck | 1 | 12 |
| transparency_report | account per report | 0.1 per figure | 2 |
Rules
A cell shows only when the exact count and the noisy count are both at least k = 20.
Learners round to 10, retention to 1 point and minutes to 5. Decks with 20 to 60 learners show retention as a band.
Σε per dataset, per scope and per year stays at most 12. The system refuses a release above that cap.