How the room is built

Everything below is checkable. Where something is a promise rather than a mechanism, it says so.

What we hold

Nothing you write. There is no account, no email, no password. The conversation runs through a proxy that does not log it. The session state lives in your browser, on your device, until you clear it. What you build is written there as you go and you download it when you finish.

We see one thing: the wallet address that paid. An address is not an identity, and we have no way to connect it to one. That is by design, not by policy.

Where a stored copy lives, if you choose to keep one

When you choose to store your kit, it is encrypted in your browser before it leaves, using a key that only your wallet can reconstruct. The encrypted copy is written to Walrus, a decentralised storage network, and leased there for the maximum the network allows, around 24 months.

The key is split across three independent operators using Seal, a threshold scheme. Two of the three must agree to release it, and they will only do so to the wallet that paid, inside its window. We are not one of the three. We cannot read the stored copy.

What reads your words while you are writing them

Here is the one place the room is not fully closed, and it is worth saying plainly.

Every reply is generated by a large language model run by a provider. To write a reply, the provider's systems read what you wrote. Every provider also runs automated safety scanning at inference time. That read is automated, not a person, and it is bounded: we route only to providers whose policy is to keep nothing afterwards and train on nothing, and that boundary is enforced in the request itself, not in a dashboard setting. We tested it by forcing each provider in turn. Two served under those terms and two refused; only the two that served are eligible.

So the accurate sentence is: we keep nothing you write, and our providers' policy is to keep nothing and train on nothing, but an automated system reads each message once to answer it. A version of this room where that read happens inside sealed hardware is on the roadmap. It is not what you are using today.

The contracts

The purchase and the session are recorded on Sui by two Move packages.

A purchase creates a Session object on chain that names the wallet that paid. It records which room, and when the window closes. It is the only credential the system uses, and it lives on chain, not in a list we keep.

The journey package keeps an upgrade capability. We have not destroyed it, and this page says why rather than hiding it: Seal is infrastructure we rely on but do not control, and destroying the capability would leave us unable to adapt if Seal's key-server interface changes. What that capability can and cannot do is written into the package's policy, which is readable on chain.

Payment

You pay once, in USDC or USDsui, from any Sui wallet. Gas is sponsored, so you never hold SUI to use the room. The payment lands in a treasury address you can read on chain.

What this page will change

When something above changes, this page changes the same day, and the change is dated here.