Data handling

In short: your conversations live in your browser. Our gateway forwards requests without writing their content anywhere. Our database holds counters, not content.

At a glance#

Chat history#

Your chat history is stored only in your browser, in IndexedDB, and it is encrypted. The encryption key is derived from a signature made by your wallet, and it never leaves your browser. Tacita has no copy of your history and no way to read it.

What that means in practice:

• No sync. History on one browser or device doesn't appear on another.
• Clearing site data deletes it. Browsers can also evict stored data when space runs low. If a conversation matters, keep a copy somewhere else.
• Use a regular wallet. A regular wallet (EOA) normally produces the same signature for the same message, so it rebuilds the same key. Smart-contract wallets may not, and then old history won't decrypt in a new session. Coinbase Wallet is supported in its regular-account mode for this reason.
• Your device is the boundary. Anyone with your unlocked browser and your wallet can open your history.

In TEE mode, each chat session also generates its own encryption key pair. The private key is kept in memory only and never stored.

Sign-in and sessions#

You sign in with Sign-In with Ethereum (SIWE, EIP-4361). There's no email, no phone and no password. The gateway gives you a session token that's valid for 24 hours and contains only your wallet address. It can't be refreshed; when it expires, you sign in again. The one-time sign-in nonce is kept for 5 minutes.

What the gateway does with a request#

1. It checks your session and looks up your tier, which sets your Bonus balance.
2. It sets aside enough credits to cover the request.
3. It sends the request under Tacita's own identity, never yours. It passes on none of your headers, so your IP address, user-agent and any identifiers stay behind.
4. It streams the answer back to you unchanged and without buffering.
5. It charges your actual usage against your counter.

At no point is the request or response body written to a log or a database. Error responses name only the error class, never request data.

What our database contains#

This is the complete list.

How the samples are used. Your tier is the lowest of your hourly balance samples over the last 24 hours, plus your current balance. The gateway reads each sample from the chain at the top of the hour and stores it, so it doesn't have to read it again. If the chain can't be read, the stored samples are also the fallback. See Tiers.

Short-lived records#

Some records exist only for minutes or hours and then expire automatically.

Images and video#

Temporary links. Generated media comes back as a temporary link containing a random 128-bit ID that can't be guessed. Links expire after about 20 minutes, then return "not found". Responses are marked no-store, so browsers and proxies don't cache them. To keep a file, download it or store it in your local history before the link expires.

Metadata on generated images. Before we hand an image to you, we strip:

• location data (the GPS block);
• device and camera fields, such as make, model, serial numbers, lens, owner and maker notes.

The image isn't re-encoded, so quality is unchanged. We deliberately keep C2PA content credentials and AI-provenance labels that mark the image as AI-generated. Transparency rules such as Article 50 of the EU AI Act require them.

Video files are delivered as they were generated. We don't rewrite them.

Your own images. Photos you attach in chat, or give to an image-to-video model, are forwarded to the model provider as they are. Strip location data from personal photos before you attach them.

Provider copies. The provider that generates media can keep its own copy for a while. On our current route, finished media files are kept for about 3 hours, and the requests of asynchronous jobs, such as video, are stored as operational data.

Moderation#

Image and video prompts are checked before generation. Chat is not.

1. A blocklist runs inside the gateway with no network call.
2. A classifier model, hosted by a model provider, answers only "allow" or "block".

What gets blocked is sexual content involving minors and sexual imagery of real, identifiable people. Nothing about the prompt or the verdict is stored. If the classifier is unavailable, image and video generation stops (it fails closed) rather than running unchecked.

No analytics, no trackers#

The Tacita site runs no analytics and no trackers. It makes no third-party requests until you connect a wallet.

Once you connect, your browser reads chain data, such as your balance and network status, from the Robinhood Chain RPC. That RPC operator can see your IP address and which addresses are queried. Your wallet software may have its own telemetry, which is outside our control.

Third parties in the path#

See Privacy modes for the per-mode breakdown.