People raise this one two ways and they contradict each other. Either it is dangerously anonymous and therefore suspicious, or it is a permanent public record and therefore the end of privacy. Both cannot be true, and the reality is more interesting than either.
What is genuinely public
On a public blockchain, every transaction is visible to anyone, for ever. Amounts, timestamps, and the addresses involved. Nobody can edit it and nobody can take it down.
That is real, and it is not a flaw — it is the mechanism that makes the whole thing work without a company in the middle deciding what is true.
What is not
An address is not a name. It is a long string of characters, and standing alone it says nothing about who holds it. Someone reading the chain sees that money moved between two strings.
So the sensitive thing was never the amounts. It is the mapping — the link between a string of characters and a person. Hold that mapping and the whole permanent public record becomes a biography. Without it, it is arithmetic.
The amounts were always public. The names never were. That is the part anyone serious should be protecting.
Where the mapping usually leaks
Being honest about the limits, because "it is anonymous" is not true and you should not act as though it is.
- Exchanges knowBuying or selling through a regulated exchange means they hold your identity against those addresses. That is the law, and it is the right law.
- Deliveries knowAnything sent to your house connects an address to an address.
- Reuse connects thingsUsing one address everywhere lets anyone tie your activity together into a single picture.
- And it works backwardsOnce the link exists, it applies to everything that address ever did — including before anyone was looking.
Privacy here is more like a pen name than a mask. It holds until it does not, and then it does not hold retrospectively.
What we do about it
We hold a mapping, because we have to. To show you a receipt that says "Alpha Roasters" rather than a string of characters, something has to know which is which.
So that layer — the link between an address and a person or a business — is encrypted before it is stored, under a key belonging to that one business alone. Read our raw database and you find transactions against addresses, with no way to tell whose they are. The amounts and dates stay readable, because that is what lets VAT and reports work and because those were never the sensitive part.
The key is per business, which means the same email address in two different businesses produces two different unreadable values. Nothing correlates across the platform, by us or by anyone.
And the one that matters most to you. In the app you can see everything you have bought, everywhere, in one place. That view is the single most sensitive dataset in this product — it is a record of where you shop, when, and how much.
No merchant can see it. A business sees the customers who bought from it and nothing beyond. The cross-merchant view is held under your own key, and there is no merchant-facing route to it at all.
We also do not sell data, share it with advertisers, or use it to train anything. Everything stays in the United Kingdom, and you can export or delete it yourself without asking us.
What we cannot claim
Encryption at rest protects against a stolen database, a stolen backup, a compromised replica. It does not protect against a compromise of the running application, an insider with production access, or a valid court order — because we have to be able to decrypt in order to show you your own receipts.
Any company claiming it physically cannot read anything, while still showing you your own purchase history, is telling you something that cannot be true. We would rather say where the line is than be vague about it.
The exception is your keys and your money, and that exception is absolute. Those never reach us at all.
The app is free and asks for an email address. No identity documents, no proof of address, nothing we do not need.