Try ZCode ↗

Trust

How privacy works

The honest version: what's private today, what's planned, and what isn't. We'd rather undersell than overclaim.

Your identity

Private

No account, email or card. Your session is a random key in your browser; the server stores only its hash.

Your chats

Private

Stored in your browser, and backed up encrypted with a key that never leaves your device. We can't read the backup.

Your prompts in our logs

Private

The server doesn't store or log your questions or documents.

Your payments

Private

Shielded ZEC top-ups hide your wallet from everyone, including us: we see the amount and which session it tops up, never who sent it. In beta, Starter pack only.

Linking your questions

Planned

Today one access key links your questions together. Anonymous credits are designed to break that link.

Your questions, from ZCode

Private

Your browser verifies a Tinfoil enclave, then encrypts your question and documents to it. ZCode's server forwards data it can't read and sees only its size. The enclave decrypts them to answer, so you're trusting its hardware and published code.

Web searches

Private

With Web on, the enclave sends search queries to Exa through one shared key, with personal details masked first. Exa sees the query text but not who asked, and keeps nothing under a zero-retention agreement. Switch Web off to keep a question entirely inside the enclave.

Your network

Not private

Like any website, our server sees your IP address unless you use a VPN or Tor. To stop free credits being farmed, we keep a keyed hash of it for a day when a new session starts, not linked to your session, then delete it.

What we protect against

  • Anyone watching the blockchain learning that you paid us: shielded payments hide the sender, receiver and amount.
  • A database leak exposing your chats: backups are ciphertext we can't decrypt.
  • Being identified by an account: there isn't one.

What we don't, yet

  • A compromised ZCode site. Your browser checks the enclave using code this site delivers, so malicious site code could skip the check. Publishing the source is next.
  • Flaws in the enclave hardware or in Tinfoil's published code.
  • Someone who has your recovery code.
  • Network-level observers: use a VPN or Tor if that matters to you.

More detail in What ZCode can and can't see.