Privacy
Privacy by physics.
Most privacy is a promise. A company holds your data and says it will not look.
Ours is about where things are. Your key is made on your device and stays there. What never reaches us cannot be leaked, sold, subpoenaed or switched off. Not by an attacker. Not by a court. Not by us.
Money nobody can take from you. Words nobody else can read.
Made here. Stays here.
We store it. We have no key to it.
A promise
We hold it. We will not look.
The data sits on a server. A policy, a contract and good intentions stand between it and everyone who wants it. Each of those can change.
Physics
It never arrives. There is nothing to look at.
The key is made where you are and goes nowhere. What crosses to us is sealed before it leaves. Nothing has to be trusted, because nothing is there.
The threat model
The threat model is a table.
Every surface says what it holds by physics, and what it gives up. Both columns, written down before anyone has to go looking.
Surface
Holds by physics
Gives up
HoldsMade in your browser, from randomness only your device had. The 24 words and the 64 characters are never sent to us. We cannot leak, sell or hand over what we never had.
Gives upLose every device and the 24 words, and nobody can bring it back. Not even us. Until you lock it, the open key sits in this browser’s storage, and anyone holding your unlocked device holds it.
HoldsSeal to Touch ID and we keep a locked copy that opens only with your finger, on your device. Back it up and it is encrypted on your device first, with a key only your 24 words make. We store the box. We do not have the key.
Gives upWe can see that a box exists, its version, and when it was last saved. Nothing inside it.
HoldsA note sealed to your lock opens in your browser, never on our servers. It is standard age encryption, so you can open it with any age tool on your own machine and check us.
Gives upAn API key you seal for an agent is opened by ONE at the moment the agent uses it. That one is a promise, not physics, and we say so where you seal it.
HoldsEvery payment is signed in your browser and goes straight to the chain. Wallet to wallet, ONE is not in the middle. We take nothing and we cannot stop it.
Gives upA public chain is public. Anyone can see a payment between two public addresses, and nobody can remove it. Paying a name through a fresh one-time address hides who paid whom, and that runs on Sui testnet today. On mainnet, a payment goes to the public address.
HoldsEach agent gets a key of its own, inside limits you set. It can work for you, sell for you and pay for you. It can never become you.
Gives upTo answer you, an agent sends your words to an AI model provider. Your key and your 24 words are kept out of what it is told. Your words are not.
HoldsThe chat beside your keys is told what state they are in, never what they are. The key surfaces are fenced off from it in the page itself.
Gives upChat is stored on our servers so you can come back to it, and we can read it. Do not put a secret in a chat. Seal it instead.
HoldsYour profile starts private. Your wallet addresses stay hidden until you choose to show them.
Gives upShow an address and everything that address ever did is readable by anyone. Hiding it again hides the link to you, not the history.
Check it yourself
Do not take our word for it.
Each line in the table is a thing you can watch happen, or not happen, from your own machine. Three ways in.
-
Watch the key not leave.
Open your browser’s network tab, then make a key. Read every request. The 24 words and the 64 characters are in none of them.
Make a key -
Open a note without us.
Seal a note, save your opener, and open the note with age on your own machine. If it opens there, it never needed our servers.
Seal a note -
Follow a payment on the chain.
Send a test payment and follow the link to the explorer. The transaction is from your address to theirs. There is no ONE address in it.
Open wallets
PUT /api/vault/syncsealed box · 1 blobPOST /api/auth/passkey-webauthn/registerTouch ID · no PRFPOST /api/ask/wallet:getpublic address onlyPOST /api/chatyour words · key state only
0
matches in every request this page makes
What never reaches us cannot be leaked.
The key is yours before it is anything else. Make one and watch where it stays.
What we collect, who we share it with and how to ask for erasure is on the policy page. Every line on this page is checked against the code that makes it true.