How your chats stay separate from your payment

When you pay by card, the payment company knows who you are, and we know which account paid. Anonymous day credentials keep that knowledge away from your chats: our chat server can tell a request came from a paying account, but not which one.

How it works

You pay. The payment company keeps your card and email. We store only its subscription ID next to your account, so we know the plan is paid.
Your device collects a day credential. Once a day, your app (or pai, for coding tools) asks our token service for a credential. Before sending it to be signed, the device blinds it by mixing in a random value only the device knows. The token service sees which account is asking, but it signs without seeing the credential itself, so it can’t recognize it later.
You chat with the credential. Each request that day carries it, with the blinding removed. The chat server checks our signature, which proves it came from a paying account and which plan it’s for. Nothing in it says which account, and the token service’s records can’t be matched to it.

Even with every record we hold, we can’t match a chat request to an account or a payment. That’s what we mean by separate.

What it protects, and what it doesn’t

It protects

The link between your identity and what you ask. A court order for our records gets account and payment details, with nothing that connects them to any request.

It doesn’t protect

Your IP address, which networks can see (use Tor or a VPN). Anything that identifies you inside a message. Timing: if very few people use the service at the same moment as you, timing can narrow things down; the more people use it, the better this gets. And within one day, your requests share a credential, so the chat server could tell they came from the same device that day. It only holds that in memory, and a new credential each day breaks the link.

How limits still work

A credential runs a fixed number of requests at once: 1 on the 1-day trial and Chat plans, 8 on the Agent plan. The chat server counts that in memory, so a shared credential doesn’t get more.
Each device gets at most 3 credentials a day, and an account has at most 5 devices. That’s how sharing is limited without knowing who sent what.
A credential works only on its day. At midnight UTC it stops working, and your device collects a new one.

How refunds and bans work

Both happen at the token service, where accounts are visible. A refund or a ban stops new tokens for that account, and tokens it already has expire within 24 hours. Neither needs to know what the account asked. See the refund policy and the acceptable use policy.

The standards behind it

We use published standards, not our own cryptography:

RSA blind signatures, RFC 9474 (the RSABSSA-SHA384-PSSZERO-Deterministic variant). It’s the same scheme Privacy Pass uses for the anonymous tokens Cloudflare and Apple issue.
Later, we may move to anonymous rate-limited credentials (ARC, an IETF draft), which would remove the within-a-day link above.