Ephemeral tokens
Comm/addr tokens are short-lived, signed, verified server-side, and masked in logs (abc****xyz).
Privacy
Privacy by construction — not by policy
This site collects, stores, and logs no personal data. Not your name, email, phone, address, or payment. Not your device fingerprint or browsing history. There is nothing here to collect you with — by design, not by promise.
What we never collect
Six rows, each a hard guarantee — enforced by the build-time zero-PII gate, not by a privacy policy.
No name — no display name, no profile, no "who are you".
No email address — no newsletter, no contact form, no capture.
No phone number — no call-back, no SMS verification.
No home address — nothing to ship to; delivery is Malartu's domain.
No payment details — payments belong to Ciste, never this site.
No account or profile — there is nothing to register for.
Your identity is a credential in your wallet.
When a service needs to know something about you — that you're a real wallet holder, old enough, or entitled — it asks your wallet to present a PIC attestation. You approve in the wallet. The service sees a verified claim, never your identity. No form can substitute for this — and no form ever will.
PIC · wallet-issued ppt·8f2c****
What happens to relay data
Hashed pseudonyms only
If stored at all, identifiers are salted hashes of pseudonymous ids — no names, no emails, no IP-linked identity.
TTL purge
Relay state expires automatically and purges. Nothing sits around to be sold, breached, or demanded.
Message content routes opaquely through relays. Content-handling terms follow the regulated spec once attached — re-verified by CTO on JAL-38 §7.
No-PII analytics — or none at all
This site ships no analytics, no trackers, and no error-reporting that logs personal data. The service status indicator reads a health endpoint with status/version only. If aggregate, cookieless, privacy-preserving analytics is ever considered, it requires Security/CTO sign-off first — and it will still never capture names, emails, phones, IP-linked identity, or device fingerprints.
No cookies-based identity — no cookies at all.
No fingerprinting — no canvas, no WebGL reads.
No IP-linked logs — nothing logged to link back to you.
No marketing pixels — no social trackers, no beacons.
Prefer none until approved. That is the current design: none.
Privacy questions? Talk to us through the wallet.
The wallet is the only door in this building. No email form, no phone line, no "contact us" that asks who you are.