Privacy

The short version

A handle is the account. We do not ask who you are, and there is no field in our system where the answer would go.

This is the whole design, not a setting. Everything below is a consequence of it.

What we hold

• Your handle, which you did not choose from anything about yourself and which we generated locally in your browser.
• The transactions attached to that handle: route, amount, rate, fee, city where relevant, stage history and settlement outcome.
• A second-factor secret, so we can verify it is you returning. For an authenticator or a hardware key this never leaves your device in a readable form.
• Operator notes about the trading relationship — size, preferred cities, hours — written about a handle, never about a person.
• An append-only audit log of what our own staff did, which exists to hold us accountable.

What we never ask for

• Legal name, date of birth, address, nationality, phone number, identity document, selfie, proof of address, employer, or card details. None of these are collected, and none are stored in any form.
• Two narrow exceptions, both your choice and both said out loud where they happen. If you select email as your second factor, we hold that address because a code has to be sent somewhere — and it is deleted the moment you switch to an authenticator or key.
• And each request you place carries one contact channel — a Signal or Threema handle by preference, or Session, Telegram, SimpleX or an email — because a desk that cannot reach you cannot settle a problem for you. It attaches to that request, never to your handle, it is never used for anything but that transaction, and it burns with the record. Use a messenger username, not a phone number, and the exception costs you nothing.

Burning records

• Burning removes a record from every screen and every operator tool at the moment you burn it, permanently. It cannot be reversed by you, by the desk, or by anyone asking on your behalf, and there is no support process that restores it.
• Residual copies inside our short-lived database backups age out on a fixed schedule measured in days, after which nothing of the record exists anywhere. We state this rather than hide it, because a backup we pretended not to have would make the whole promise worthless.
• Where law obliges us to retain a minimal record of a transaction, we retain that alone: the fact, the amount, the date. It carries no profile, because there is no profile to attach.

Logs and third parties

• No analytics, no advertising pixels, no session replay, no fingerprinting, and no third-party scripts. See the No trackers page for how to check this yourself.
• Connection addresses appear in a short-lived rate-limiting window measured in minutes and are not written to durable storage or joined to a handle. Over the onion service there is no address for us to see at all.
• Encrypted messengers you contact us on keep their own metadata. That is between you and them; we receive the message, not their records.

Requests from authorities

• A lawful order compels us to produce what we hold. What we hold is a handle, transactions attached to it, and where obliged the minimal retained records described above.
• We cannot produce a name, an address, a document or a device identifier, because none exists in our systems. We will not fabricate a link between a handle and a person, and we will not add collection in order to satisfy a request.
• Where we are permitted to tell you that a request was made, we will.

Retention

• Unburned transaction records remain while your handle is active. Burned records leave every read path the moment you burn them, and leave backups within days on the fixed schedule above.
• Minimal retained records are kept for the period the applicable law requires and are then deleted.
• The operator audit log is retained permanently. It records our conduct, not yours.

Your controls

Burn on completion, burn on a daily schedule, burn selected records, or burn everything. Wipe this device on sign-out. Hide rates in your own history.

Abandoning a handle deletes nothing by itself. If you want it gone, burn the records first.