Privacy

What ZecPort keeps, what it never has, and what is public. This page describes how the software works.

What ZecPort never has

• Your ZEC. Payments go straight from the payer's wallet to yours.
• Your seed phrase, or any key that can spend or see your funds.
• Whether anyone paid you, or how much. ZecPort does not watch any wallet.
• The amounts and notes of your requests. They live in the link after the #, which browsers never send to a server, and the QR code is drawn in your browser.
• Your email, phone number, name or password. None is asked for.

What ZecPort keeps

• Your username and the address it points to. Kept while your account exists. Earlier addresses are kept as history and never shown again.
• Your passkeys' public keys. The private part stays on your device; what is stored cannot sign in on its own.
• Sessions. A random value in a cookie, stored only as a hash, for up to 30 days or until you sign out.
• A security log. Account events such as "address changed" or "passkey added", by account number, for 400 days.
• Rate-limit counters. Per network address, in memory only and never written to disk.

Database backups hold the same data and are kept for 14 days.

What is public

Anyone can look up a username and see the address it points to. Everyone who pays you through your username pays that same address, so payers who compare notes can tell they paid the same person, and anyone who sees the address elsewhere can connect it to your username. Use an address you keep for ZecPort only.

In your browser

"My requests" is saved in your browser's own storage, on that device only. The only cookie is the session cookie. There are no analytics, no ads, no trackers and no third-party scripts or fonts.

The developer API

Apps can look up usernames and build payment requests without an account. Nothing they send is stored or logged. An app that sends an amount to ZecPort's API has it used to build the answer and then discarded; apps can also build requests entirely on their side.

Deleting your account

Settings → Delete account. Your username stops working at once, your address is removed, and you are signed out everywhere. The name stays reserved for 30 days so nobody can impersonate you straight away, then the account is erased. The security log keeps its entries for their 400 days; backups age out within 14 days.