Privacy & security

ZeroSignal is built so that nothing ties a conversation back to you — not an account, not a payment record, not a server-side chat log.

No identity to begin with

There's no email, phone number, or card on file: your passkey is your account, and payments are pseudonymous crypto. There's no profile to subpoena and nothing for a breach to leak.

Encrypted end to end

Every prompt is encrypted on your device to the one operator you chose to run your request. In transit, the network only ever moves ciphertext. Requests travel through a peer relay, which splits what any one party can see: the relay sees your address but only ciphertext it can't read, while the operator running the model sees the relay's address — never yours (see Relays). The two are always different operators, so no single party holds both who you are and what you asked. The operator decrypts your prompt, runs the model, and re-encrypts the reply under a fresh ephemeral key. The key your prompt is sealed to rotates and is erased from memory, so a key recovered later can't decrypt what you said before.

Who ends up knowing what — the reply retraces the same path, still encrypted:

What the operator can see

Running a model means reading the prompt, so the one operator you route to does see that exchange in the clear while it answers — that's inherent to inference, and it's the single thing the design trusts the operator with. What it never sees is your real-world identity: there's no account, no email or phone, and the relay strips your network address so the request arrives without it. It does see the pseudonymous payer address that funds the request — a stable on-chain handle it can recognize across requests, but not a name or a way to reach you. Confidential compute (TEE) is the path to removing even the prompt-reading trust — sealing the prompt to attested hardware the operator itself can't read — but it isn't generally available yet.

The same boundary covers built-in tools: when a model searches or reads the web mid-reply, the operator's node makes that outbound request — not your device — so a page the model fetches sees the operator's address, never yours.

Bring your own node

Chatting isn't the only thing the app does over the network. To show your balance and to send the payments that fund each request, it also talks to the Algorand blockchain — and those on-chain calls go to a public Algorand node. By default that's a shared endpoint run by a third party. It never sees your prompts or the model's replies (those take the encrypted path above), but, like any server you connect to, it can see your IP address alongside the pseudonymous address you're checking balances and paying from.

If you'd rather not share that, point the app at a node you trust in Settings → IP Privacy → Algorand node:

• Run your own node. A node you host answers these calls locally, so your on-chain activity never leaves your control. Algorand's node documentation walks through getting one running.
• Choose a provider. If you'd rather not self-host, point at a hosted API node you pick — Nodely, for example, publishes its endpoints and offers dedicated tiers. If the node requires one, paste its API token in the same settings; most public endpoints don't need a token, so you can leave it blank.

Leave both fields blank to keep using the default public node.

Whichever you choose, remember that something always connects to you directly — the relay, or the node you query — and that first hop sees your real IP. To hide it from that hop too, put your connection behind a VPN or Tor.

Your history stays with you

Conversations are stored on your device, encrypted at rest — see Conversations & history. We don't keep server-side copies of your chats.

If you turn on syncing so your history follows you between devices, it goes somewhere you choose — a folder your computer already syncs, or an S3-compatible bucket you own — and never to us. Every file is sealed on your device first, with a key derived from your passkey, so the folder's sync app or the bucket's provider sees ciphertext and shape: file counts, sizes, timestamps, and how many devices you sync from, but never a title, a message, or who you talked to. It's the same exposure your Dropbox folder already has for everything else in it, and the reason a provider can't help you read your chats — nor can we.

Session lock

If you step away, ZeroSignal locks itself after a period of inactivity (default 30 minutes, configurable from 1 minute to 24 hours). You choose what locking means in Settings → Session:

• Lock the session (default) — chat keys are wiped from memory; unlock again with your passkey.
• End the session — additionally wipes the local session from disk, leaving the smallest possible at-rest footprint.

What is visible

Payments settle on a public blockchain, so the existence of payments between pseudonymous addresses is public — that's what makes the system verifiable and self-custodial. What's never public, and never visible to us, is what you said or what the model answered; there's no real-world identity on file to expose, only a pseudonymous payer address. And no single party can join your network address to your prompt — the relay sees your address but only ciphertext, while the operator that reads your prompt only ever sees the relay's address, never yours.