Mumbooth
§PPrivacy, itemised8 lines
What the server sees.
What it stores. What it can’t tell.
MUMBOOTH separates paying from talking. The wallet buys coupons in public; the coupons are signed blind, so the server can check them without linking them back. Below is every piece of data, in the words we hold ourselves to. If the code and this page ever disagree, treat the page as wrong.
| Item | Server | Exactly |
|---|---|---|
| Your purchase | Seen · stored | Buying coupons is a public transaction. We store the tx hash, wallet, and coupon count — the same data anyone can read on the explorer. |
| Which coupon is whose | Can’t tell | We sign coupons blind (RSA blind signatures, RFC 9474). The server cannot tell which wallet a coupon came from — among the N coupons issued with the current key. |
| Your messages | Passed through · not stored | We forward your message through OpenRouter to Anthropic’s Claude models and stream the answer back. Every request is restricted to zero-data-retention endpoints (OpenRouter zdr: true, docs: https://openrouter.ai/docs/features/zdr). We do not store messages, answers, or conversation history. |
| Your IP address | Visible · not logged | Access logging is off for all /api routes and the app never writes IPs. Your IP is still visible to the server at the network level — use a VPN or Tor if that matters to you. |
| Free trial | Hashed · memory only | The free trial counter is keyed by a daily-salted hash of your IP, held in memory and dropped at 00:00 UTC. It is a per-network counter, not an identity. |
| Spent coupons | Hash · key id | Spent coupons are stored as a hash and key id only — no time, no IP, no model. |
| Timing | Not prevented | Buying and then chatting right away can be correlated by timing. Coupons are valid until the key’s end date; use them later if you want distance. |
| Model provider | OpenRouter → Claude | Chat requests go to OpenRouter with each request restricted to zero-data-retention endpoints (zdr: true) and provider data collection denied. We send no user field and no headers about you; we don’t forward your IP. How OpenRouter defines this: Zero Data Retention · Provider logging. Read their policies before sharing anything sensitive. |
§LLimits
What this does not protect
- Your network identity. The connection you buy from and the connection you chat from may be the same IP. We don’t record it, but the server can see it while the request is open. Use a VPN or Tor, or buy now and chat later from another network.
- A small crowd. Blind signatures hide you among everyone who holds coupons from the same key. When only a few purchases exist, that crowd is small. The current count is shown in the booth and on /proof: N coupons issued.
- What you type. If you put your name, address or wallet into a message, OpenRouter and the model receive it. The coupon can’t un-say it.
- Your own device. Chat history and coupons are stored in this browser as plain, readable data (IndexedDB). Anyone with access to the device and browser profile can read them. Use Forget to delete them.
- A dishonest server key. A server could try to sign some users with a different key to single them out. That’s why there is one published key and fingerprint (see /docs); your browser checks every coupon against it and warns if the key ever changes.
- Server errors. The app never writes IPs, and web access logging is off. If the backend itself fails, the web server’s error log can record the IP of that one failed request.
- The answer cut-off. If the model fails before the first word, the coupon is refunded. Once the first word is sent, the coupon counts as spent even if the stream breaks.
In your browser
No cookies, no analytics, no third-party scripts or fonts. The page talks only to this domain, plus the public Robinhood Chain RPC (robinhood-rpc.publicnode.com) when it asks your wallet to add the network. Your wallet extension talks to Robinhood Chain through its own connection.
Connections use HTTPS. That protects the traffic between you and the server; it does not hide anything from the server itself or from the model provider.