What we store

Held for each account#

• The email you signed up with, and a scrypt hash of your password — never the password itself.
• Session tokens for the desk, stored hashed, deleted when you sign out.
• API keys: a hash to authenticate, an encrypted copy so the desk can reveal it, and when each was last used.
• Your deposit addresses and the on-chain deposits made to them — these are public on their chains anyway.
• The ledger: deposits, purchases and refunds.
• The names and servers on the account, and any SSH private key we minted and kept for you.

Never recorded#

• No legal name, address, phone number, card or identity document — none are asked for.
• No web access log and no IP address history.
• No analytics or tracking scripts on the site or the desk.

If someone asks for it#

A valid legal order can reach what exists: the list above. It cannot reach what was never written down. Registrations are in our name, so the registry holds nothing of yours either.

Domain names and servers are public by nature — a name resolves, a server answers. Privacy here protects who you are, not what you publish.