Privacy

This site has no accounts, sets no cookies, and makes no third-party requests from any page; the content security policy permits this origin only. The browser wallet uses first-party IndexedDB storage on this device.

• Browser-wallet state. Token secrets, exact retry records, balances, and local activity stay in this browser's IndexedDB storage. They are not uploaded except through the protocol's blinded issue and zero-knowledge spend messages. Clearing site data deletes the wallet; there is no server-side recovery.
• Request logs. The service runs on Google Cloud Run, whose infrastructure records request logs that include client IP addresses, as on any web server. Log retention is the platform default. The application's own logging on token endpoints records request method and path only, and deliberately does not correlate request contents with client addresses.
• The /e beacon. Each page load sends one first-party, cookieless beacon carrying only the page path and the referrer's host name. No identifier is created, stored, or derived from it; the hit lands in the request log and nowhere else.
• What the protocol stores. Spent nullifiers with their stored responses (kept for the life of the key epoch, as double-spend prevention requires), and proof-of-work challenges with their responses (swept roughly a day after expiry). None of it contains or references an identity.

The cryptographic privacy properties, and their limits at the network layer, are described on the security page.