# RightOS

> RightOS is a privacy-preserving rights verification service by I-S3 (Japan). It turns queues, reservations, EV charging, and package pickup into digital QR tickets ("Right Tokens"). It verifies that a valid right is present — never who the person is. No names, phone numbers, or birthdates are required from end users. Sign-up to first ticket in about 10 minutes; no app install required. Pricing is globally uniform.

Important: RightOS is NOT a taxi or ride-hailing service. It does not arrange vehicles, set fares, assign drivers, or broker dispatch. It only verifies waiting order and access rights.

## Docs

- [Full documentation for AI agents (llms-full.txt)](https://rightos.i-s3.com/llms-full.txt): complete product and API documentation in one file
- [OpenAPI 3.1 specification](https://rightos.i-s3.com/openapi.json): machine-readable Right API spec (24 paths incl. billing, policy audit, and webhooks; schemas, auth, rate limits)
- [System status](https://rightos.i-s3.com/software/rightos/status): live status page with measured uptime (JSON: GET /api/rightos/status)
- [TypeScript SDK on npm (@i-s3/rightos)](https://www.npmjs.com/package/@i-s3/rightos): npm install @i-s3/rightos — also as a single file at https://rightos.i-s3.com/sdk/rightos.ts
- [Python SDK on PyPI (rightos-sdk)](https://pypi.org/project/rightos-sdk/): pip install rightos-sdk — also as a single file at https://rightos.i-s3.com/sdk/rightos.py
- [SDK source on GitHub](https://github.com/suomimasuda/rightos-sdk): official repository (MIT license)
- [Quickstart](https://rightos.i-s3.com/software/rightos/docs/quickstart): registration to first verified QR ticket in 10 minutes (curl, SDKs, MCP)
- [MCP for AI agents](https://rightos.i-s3.com/software/rightos/docs/mcp): 18-tool MCP server setup, tool list, example prompts (also npm @i-s3/rightos-mcp)
- [Developer documentation](https://rightos.i-s3.com/software/rightos/docs): human-readable API docs with samples
- [MCP server (@i-s3/rightos-mcp)](https://www.npmjs.com/package/@i-s3/rightos-mcp): connect AI agents directly — npx -y @i-s3/rightos-mcp with optional RIGHTOS_API_KEY env var (18 tools)
- [Store queue use case](https://rightos.i-s3.com/software/rightos/use-cases/shop): SEO landing for retail queue QR reception
- [Clinic off-site waiting use case](https://rightos.i-s3.com/software/rightos/use-cases/clinic): queue without calling patient names
- [EV charger queue use case](https://rightos.i-s3.com/software/rightos/use-cases/ev): fair charging order with QR tokens
- [Event entry use case](https://rightos.i-s3.com/software/rightos/use-cases/event): entry rights with one companion transfer
- [Package pickup use case](https://rightos.i-s3.com/software/rightos/use-cases/pickup): verify pickup rights before handover
- [Usage insights (public aggregates)](https://rightos.i-s3.com/software/rightos/insights): sign-ups, funnel, and API usage — no PII (JSON: GET /api/rightos/analytics/summary)
- [Analytics export for BI](https://rightos.i-s3.com/api/rightos/analytics/export?days=90): daily metrics JSON for BigQuery/GCS pipelines
- [Landing page](https://rightos.i-s3.com/software/rightos): product overview, 1-minute explainer video (audio ja/en, subtitles in 20 languages)
- [Pricing](https://rightos.i-s3.com/software/rightos/pricing): Free / Starter / Business / Pro / Enterprise — globally uniform prices

## Key facts

- Right Token = digital right (queue position, time slot, usage right) with a tokenId and a one-time verificationCode; the server stores only the code's SHA-256 hash
- Verification: POST /api/rightos/tokens/{tokenId}/verify with the code; result is success / failed / expired / cancelled / already_used
- Transfers use re-keying (new code issued, old invalidated); paid transfers and auctions are not offered
- Policies resolve as industry preset -> country overlay -> location override; holders can self-cancel where the policy allows (POST /tokens/{id}/holder-cancel); policy changes are audit-logged
- Country overlays cover 10 countries (JP, US, GB, KR, TW, FR, DE, IT, ES, AU), informed by local ticket-resale laws; all definitions are public via GET /api/rightos/policies (defaults, not legal advice)
- Auth: API key (rk_live_...) issued once at registration, sent as Authorization: Bearer or x-rightos-key header
- Data portability: full JSON export and permanent account deletion are self-service (GET /api/rightos/export, POST /api/rightos/organizations/delete)
- Outbound webhooks: token.verified / token.used / token.cancelled / token.transferred delivered as HMAC-SHA256-signed HTTPS POSTs (header x-rightos-signature); register via Console or POST /api/rightos/webhooks (up to 3 per org); the signing secret is returned once and never stored server-side
- Billing: Stripe hosted Checkout / Billing Portal (POST /api/rightos/billing/checkout, /portal); card data never touches RightOS servers; cancelling downgrades to free without deleting data
- UI in 20 languages; legal texts authoritative in Japanese and English

## Legal

- [Privacy Policy](https://rightos.i-s3.com/software/rightos/legal/privacy): privacy by design; camera QR scanning is processed on-device and never uploaded
- [Terms of Service](https://rightos.i-s3.com/software/rightos/legal/terms): including the non-ride-hailing clause

## Company

- Operated by I-S3 Inc., Gunma, Japan (https://www.i-s3.com/)
- Try the demo: https://rightos.i-s3.com/software/rightos/verify?tokenId=tok_demo_queue&code=DEMO-QUEUE234