The complete guide

Every process on the desk, in the order you will meet it — from generating a handle to burning the last record. Nothing here requires a name, and nothing here is theoretical: each step describes what the system actually does.

Creating a handle

A handle is the whole account — a generated name like cyan-falcon-882, tied to nothing about you. There is no form, because there is nothing to fill in.

  1. Generate. Open /join. A handle is generated in your browser; regenerate until one suits you. The server only checks it is not taken.
  2. Choose a second factor. An authenticator app (recommended), a hardware key or passkey (strongest), or an email code — the one method that puts a contact detail on file, said plainly on the card.
  3. Verify it. Authenticator: add the secret shown, type the six-digit code. Key: your browser prompts for it. Email: a code arrives from desk@anychange.io and dies in ten minutes.
  4. Store the recovery codes. Eight single-use codes, shown once and never again. Download them and keep them somewhere that is not the device holding your factor — the checkbox is mandatory because this matters.

Lose the factor and the codes together and the handle is gone. Nobody can restore it, because nothing about you exists to verify against. That is the design, not a support gap.

Signing in, and recovery

  1. Enter the handle. The desk answers with the factor your handle actually holds — a key prompt, an authenticator field, or a code already on its way to your email.
  2. Confirm. A hardware key confirms with a touch. Codes are six digits. Wrong handle and wrong code fail identically, so the form cannot be used to test whether a handle exists.
  3. Lost the factor?. Use /recover with one of your eight recovery codes. Each works exactly once — sign in, then enrol a new factor immediately and regenerate the codes in Settings.

Getting a quote

The calculator on the home page prices any of the routes with nothing entered about you. The figure you see is the figure you receive — fee already subtracted, in the currency you will hold.

  1. Pick a direction. What you send and what you collect. Rails that carry several currencies show a segmented picker; cash legs add a city.
  2. Read the window. A published rate holds for 45 seconds — the bar under “Live rate” is that window draining. Nothing drifts inside it, and the whole site requotes on the same tick.
  3. Read the fee line. One line — rate, percentage, fixed charge — expands to the full five-row breakdown including your tier discount. Nothing else will ever be added.

If the rate feed degrades, quoting pauses rather than showing a stale price. A locked figure is honoured regardless.

Locking a rate

Locking turns an indicative rate into a binding price. The lock lives on the server — the desk settles against its own record, never against a number your browser holds.

  1. Lock. In the request flow, the review step shows the exact figure and a countdown: 14 seconds as a guest, 60 as a member, five minutes as VIP.
  2. Confirm inside the window. Submit while the bar runs and that price binds both sides.
  3. If it expires. The screen says “the rate moved” and offers an explicit re-lock at the current rate. Never a silent requote, never a charge for an expired lock.

Placing a request

  1. Amount & pair. The same fields as the calculator, at your real tier.
  2. Delivery. A cash leg: pick the city and the agent — you choose your counterparty from the marketplace, not the other way round. A remote leg: give the destination (IBAN, address, or beneficiary + BIC), used exactly as written.
  3. Leave a contact. Mandatory: one channel the desk can reach you on about THIS request — Signal or Threema preferred; Session, Telegram, SimpleX or email accepted. It attaches to the request, never to your handle, and burns with the record. Use a username, not a phone number.
  4. Review & lock. The countdown runs; confirm and the request exists with an id like AC-4F2C.

The request starts at “awaiting funds”. Your quote figures were copied server-side from the lock — nothing you send later can change them.

Sending your side

  1. Send what you locked. The wire, the coins, or notes to the agent — whichever leg you chose to fund.
  2. The desk confirms receipt. No agent may pay out before that confirmation; the rule is enforced in the database, not in anyone's goodwill.
  3. 24 hours, or it cancels itself. If nothing arrives inside a day, the request cancels automatically. Nothing moved and nothing is owed. Sent late? Message the desk with the request id and we try to match it.

Tracking a request

Every request has six visible stages, and every stage change is timestamped. Most of the frustration in this business is not knowing whose move it is — so that is the centre of the screen.

0 — submitted · 1 — quote locked · 2 — awaiting funds · 3 — funds received · 4 — ready for handover · 5 — completed

The request detail page also carries a tracking link and a QR code. Share either with whoever needs to watch: the public page shows stages only — no amounts, no code, no destination, no handle — so a leaked link costs nothing. If you burn the record, the tracking page stops existing with it.

The cash handover

  1. The code is issued. When the desk confirms your funds, a six-character collection code (like 7A-C2-1E) appears on your request. That code is the entire check.
  2. Meet the agent. The location arrives on the request thread once funds are confirmed — a fixed indoor place during published hours, never a street corner.
  3. Say the code. The agent types it into their own screen and pays out only on a match. They may not photograph you, record you, or ask who you are.
  4. If anyone asks for a document. That alone is a dispute, even if you were paid in full — and it is terminal for the agent on the first occurrence.

Remote settlement

Bank and on-chain legs need no meeting. Once your funds are confirmed, the desk settles to the destination you gave: SEPA the same business day where the cut-off allows, SWIFT at banking speed, chains at network speed with the fee quoted separately because it is not ours.

The destination is used exactly as written and purged from our records after settlement. A transfer to a wrong destination you supplied cannot be recovered by us — check it twice before you lock.

Talking to the desk

The envelope button in the app opens a direct line to the desk — encrypted at rest, answered while the desk is staffed (09–23 CET weekdays, 10–20 weekends).

The thread burns separately from your transaction records: clear a conversation without touching your history, or the reverse. A burned thread is as gone for the operator as it is for you.

Opening a dispute

Something went wrong — a no-show, a short count, a refused code, a request for documents, or anything else in your own words.

  1. Open it from the request. Pick the reason, describe what you expected and what happened. That is usually all we need.
  2. Everything freezes. The moment it opens, the request is frozen in BOTH directions — the agent cannot settle, the desk cannot advance it, and no burn job touches it. The freeze is enforced in the database.
  3. An operator answers. Within two hours during staffed hours. Straightforward cases settle the same day; you are made whole from the desk FIRST, and we settle with the agent afterwards.

Burn a record and it can no longer be disputed — open the dispute first, resolve it, then burn.

Burning records

The erase button that actually erases. Route, amounts, rate, city, agent, code, destination, note, contact and the whole timeline — gone from your view and from every operator tool, permanently.

  1. On completion. Flip “Burn on completion” in Settings and every record vanishes the moment its request settles. Most clients set this once.
  2. Daily at 23:00 UTC. A scheduled sweep of settled and cancelled records — review the day, start tomorrow clean.
  3. By hand. Select records in My transactions, or burn everything from Settings. Confirmed with your second factor — authenticator code, key touch, or emailed code — because there is no undo.

What survives: the legally required minimum — that a transaction occurred, its amount, its date — with no link to any handle, because no profile exists to link to. Disputed records refuse to burn until resolved.

Managing your factors

  1. Rotate the authenticator. Settings → Two-factor → Rotate: a new secret, verified with one code, replaces the old immediately.
  2. Add a hardware key. Keys can sit alongside any factor. Removing one is refused if it would leave the handle with zero factors.
  3. Switch away from email. Enrol an authenticator and your stored address is DELETED in the same moment — not archived, deleted. The screen says so before you click, and confirms after.
  4. Regenerate recovery codes. Behind a factor confirmation. Eight new codes appear once; the old set dies the moment you confirm.

Tiers, bands and the one question

Guest: 1.4% + €25, 14-second locks, nothing asked below €999 · Member: 0.85% + €10, 60-second locks, nothing asked below €9,999 · VIP: 0.45% flat, 5-minute locks, nothing asked below €99,999.

Volume is the only input to a tier — we review quarterly and offer the better rate; there is no application. Above your band (and always above €100,000) an operator asks one question about where the money came from — never about who you are — and the answer attaches to the transaction, not to a person. No document is taken either way.

If you run a desk

  1. Offers arrive with a clock. A route, an amount, a city, the client's handle and note — nothing else, ever. Accept or decline within ten minutes of your published hours.
  2. Never pay out early. Wait for the desk to confirm the client's funds. The settle button physically refuses before that — the gate is in the database.
  3. Verify the code, then settle. Type the client's collection code; pay out only on a match. Settling bumps your public count and your day sheet.
  4. Reconcile daily. Close the day with a counted figure. Below 80,000 EUR-equivalent float you come off routing until you top up. Payouts run Mondays.
Keep reading