Privacy
Privacy modes
Exactly who can see your prompt in Anonymous mode and in end-to-end encrypted TEE mode, what we store, and the known limitations of each.
On this page
Tacita has two modes. Anonymous hides who is asking. TEE hides who is asking and what you ask. There's no in-between "private" mode, because that would rest on a promise alone. TEE gives you the same thing with a hardware guarantee you can check.
Anonymous mode#
Your request goes through our gateway to a model provider, such as Anthropic, OpenAI or Google. Chat requests are routed only through providers marked as trusted.
- What's hidden: who you are. Every request is sent under Tacita's own identity, never yours. Our gateway forwards none of your headers. Your IP address, user-agent and wallet address never reach the model provider.
- What isn't hidden: the prompt. Model providers see the full text of your prompt and the response, and they may log them. Assume the provider keeps a copy.
- Our gateway sees your prompt in transit, because it has to forward it. It writes the prompt to no log and no database.
Good for: every model, including closed frontier models, images and video. The trade-off: the model provider can read and keep what you send.
TEE mode (end-to-end encrypted)#
The model runs inside a confidential-compute enclave, also called a trusted execution environment (TEE). The enclave is isolated in hardware, built on Intel TDX CPUs and NVIDIA confidential-computing GPUs, and operated by Phala or NEAR AI.
Every TEE request is end-to-end encrypted:
- Your browser checks the enclave first. It fetches the enclave's attestation using a random nonce that it generates itself, and verifies the result. See Attestation.
- Your browser encrypts every message to the enclave's key. This uses secp256k1 key exchange, HKDF-SHA256 and AES-256-GCM. Earlier turns of the conversation are encrypted too.
- Our gateway relays only ciphertext. It rejects any TEE request that contains plaintext. The model provider relays the same ciphertext to the enclave.
- The enclave decrypts, runs the model and encrypts the answer back to your browser. Each response carries the enclave's signature.
Good for: sensitive text such as health, legal, financial or work questions. The trade-off: 12 open-weight text models, text only, and the attestation has to pass for the model you pick.
Who can see what#
| Who | Anonymous: your prompt | Anonymous: who you are | TEE: your prompt | TEE: who you are |
|---|---|---|---|---|
| You (your browser) | Everything. History is stored locally, encrypted. | — | Everything. History is stored locally, encrypted. | — |
| Tacita's gateway | Sees it in transit. Doesn't store it. | Knows your wallet address, because it bills it. Keeps only your credit counter. | Ciphertext only. Can't read it. | Knows your wallet address. Keeps only your credit counter. |
| The model provider | Sees it in full and may log it | Doesn't know. Requests arrive under Tacita's identity. | Relays ciphertext and can't read it | Doesn't know. Requests arrive under Tacita's identity. |
| The host or datacenter running the model | Can technically see it | Doesn't know | Can't read inside a genuine enclave, which is what attestation proves | Doesn't know |
Two more parties sit in the path:
- Cloudflare hosts our website and gateway. As the host, it handles the connection and sees your IP address. In Anonymous mode the gateway processes your prompt in memory on Cloudflare's platform. In TEE mode it only ever handles ciphertext.
- The moderation classifier. Image and video prompts are checked by a classifier model, hosted by a model provider, before generation. Chat is not moderated this way. See Data handling.
What we store and what we don't#
| We store | We don't store |
|---|---|
| A credit counter per wallet: your Main balance and today's Bonus usage | Prompts or responses, in either mode |
| Hourly token-balance samples per wallet: wallet, token, balance and hour, all public chain data | Images or videos after their link expires, about 20 minutes |
| The hash and amount of each credited top-up, so a transaction is never credited twice | IP addresses, user-agents or device fingerprints |
| Global daily totals with no per-wallet data | Email, phone or any account profile |
| Analytics, trackers or per-request logs |
Your tier comes from the lowest of your hourly balance samples over the last 24 hours, taken at the top of each hour, plus your current balance. The samples hold public chain data and nothing about what you ask. See Tiers.
The full list, including short-lived records, is on Data handling.
Known limitations#
We'd rather you hear these from us.
Anonymous mode
- No cryptographic no-logging guarantee. Model providers apply their own logging and retention policies, and nothing technical stops them from keeping what you send.
- The model that answered isn't proven. There's no cryptographic proof of which model served an Anonymous-mode request.
- Your words can identify you. Anonymous mode hides your identity, not your content. If a prompt contains your name, address or other unique details, the model provider can read them.
- Attached images go to the model provider as they are. We strip location and device metadata from images we generate for you. Photos you attach are forwarded unchanged, so remove location data from your own photos before attaching them.
- Video prompts may be kept. Video is generated as an asynchronous job. On our current route, job requests are stored as operational data and finished files are kept for about 3 hours.
- Trusted-only routing is confirmed for chat. We haven't confirmed that the same restriction covers every image and video provider. Treat media prompts as visible to whichever provider generates them.
Our gateway
- In Anonymous mode, our no-storage claim rests on trust. The gateway does not run in an enclave, and you can't verify from the outside what it does with plaintext. In TEE mode you don't need to trust it, because it only ever sees ciphertext.
TEE mode
- The encryption runs in code your browser loads from tacita.chat. This is true of any end-to-end encryption on the web. If the site were compromised, it could skip encryption. You can check that it doesn't: open your browser's developer tools and confirm that messages leave as long hex strings. See Attestation.
- Metadata is still visible. Our gateway and the model provider can see which model you use, when you use it, roughly how long your messages are, and the token counts used for billing. Our gateway also knows which wallet sent the request.
- Text only. You can't attach images, use tools, or generate images or video in TEE mode.
- Attestation is per model and can fail. As of 27 October 2026 it verifies for 9 of the 12 TEE models. Kimi K3, Kimi K2.6 and Qwen 3.8 27B currently do not verify, so they show no Verified badge.
- The response signature has a limit. The signature proves that the enclave's attested key produced the response with a given ID. The request and response are rewritten slightly on their way to and from the enclave, so you can't recompute the signed hashes yourself.
- Hardware trust. Enclaves depend on Intel and NVIDIA hardware, their attestation services, and the absence of unknown hardware flaws. A TEE greatly narrows who you have to trust. It doesn't remove trust entirely.
- Moderation isn't possible. We can't read TEE conversations, so we can't moderate them. You remain responsible for how you use them.
Everywhere
- Your device is part of the system. Malware on your computer, or someone with access to your unlocked browser and wallet, can read your conversations. No mode protects against that.
- Routes change. We describe how each mode works today. If that changes, we'll update this page.