Data handling
Where history lives, what the gateway and database hold, when media links die, which metadata we remove, and who else is on the route.
Chats live with you. The gateway moves requests along without saving a word. The database counts credits.
Each kind of data has one home and one lifetime
| Data | Location | Lifetime |
|---|---|---|
| Chat history | Your browser (IndexedDB), encrypted | Until you delete it or wipe site data |
| Prompts and replies | Nowhere on our side, just gateway memory | The length of the request |
| Generated images and videos | Our media store, behind a link nobody can guess | About 20 minutes |
| Session | A signed browser token holding only your wallet address | 24 hours |
| Credit counters | Our database, a row per wallet | Ongoing |
| IP address, user-agent | Not stored | Not applicable |
Chat history lives only in your browser
It sits encrypted in IndexedDB. The key grows out of a wallet signature and stays on your machine, leaving Angerona with no copy and no means of reading one.
Four things follow:
- No sync: a chat on one device or browser stays there.
- Wiping site data erases it: low disk space can also make a browser evict it. Save important conversations elsewhere.
- Regular wallets rebuild the key: an EOA normally repeats the same signature for the same message. A smart-contract wallet may not, and then earlier history stays locked in a new session. For that reason Coinbase Wallet is supported in regular-account mode.
- The device is the wall: whoever has your unlocked browser and your wallet can open everything.
TEE sessions add a separate encryption key pair per chat session, with the private key held in memory and never written down.
Sign-in leaves only a wallet address
Login uses Sign-In with Ethereum (SIWE, EIP-4361) and skips email, phone and password. You receive a 24-hour session token containing your wallet address and nothing else. It has no refresh, so expiry means a new signature. The single-use sign-in nonce survives 5 minutes.
The gateway handles a request in five moves
- Confirm your session and find your tier, which sizes your Bonus balance.
- Block enough credits to cover the call.
- Send it on as Angerona, leaving your headers behind, along with IP address, user-agent and other identifiers.
- Stream the reply to you untouched and unbuffered.
- Bill real usage to your counter.
Bodies of requests and replies never touch a log or a database. An error message states its class and contains no request data.
The database holds six tables
Nothing else exists.
| Table | Contents | Left out |
|---|---|---|
| Wallets | Address, Main balance, today's Bonus usage with its UTC day, plus your last active UTC day (date only) | Your questions, your models, exact times |
| Balance samples | A row per wallet per hour: wallet address, token contract address, balance at the top of the hour, the hour. Public chain data | Content and request details |
| Deposits | Hash and credited amount of each top-up, to block double crediting | Your wallet address. The transfer is public on Robinhood Chain regardless |
| Daily totals | Global sums per day: Bonus and Main spent, our running costs, deposits, request count | Per-wallet data |
| Settings | Global values like the fuse multiplier | Not applicable |
| Video settlements | A random job ID and a coarse hour, preventing a second refund for one video | Your wallet, your prompt |
Samples exist for tiers: the lowest in the past 24 hours, joined by your live balance, decides yours. Each one is read from chain on the hour and saved, which spares the gateway a repeat read and doubles as a backup when the chain won't answer. See Tiers.
Short-lived records delete themselves
| Record | Holds | Gone after |
|---|---|---|
| Sign-in nonce | A random value | 5 minutes |
| Tier cache | Your tier and token balances, both public chain data | 30 minutes |
| Rate-limit counters | Per-wallet counts for the universal limit of 120 requests per minute. Sign-in uses a keyed IP hash that is never stored | 60-second windows |
| Media | The output file, or a pointer to the provider's copy | About 20 minutes |
| Video job | Your wallet (so nobody else can check the job), model, job ID, credit hold. No prompt | 3 hours |
Media links die fast and images get scrubbed
- Links: outputs come back on a temporary URL with a random 128-bit ID nobody can guess. About 20 minutes later it answers "not found". Replies are flagged
no-store, which keeps browsers and proxies from caching them. Download a file or put it in local history before then. - Metadata removed from generated images: the GPS block with location data, and device and camera fields like make, model, serial numbers, lens, owner and maker notes. No re-encoding happens, so quality holds.
- Labels left in: C2PA content credentials and AI-provenance marks stay on purpose. Transparency law such as Article 50 of the EU AI Act demands them.
- Video: delivered exactly as generated, with no rewriting.
- Your uploads: photos added in chat or fed to an image-to-video model reach the provider untouched. Clear location data from personal pictures beforehand.
- Provider copies: the generating provider can hold its own copy for some time. On our route, finished files last about 3 hours, and requests for asynchronous jobs like video remain as operational data.
Moderation covers image and video prompts
Chat goes unscreened. Media prompts face two checks ahead of generation:
- A blocklist inside the gateway, needing no network call.
- A classifier model, hosted by a model provider, replying only "allow" or "block".
It stops sexual content involving minors and sexual imagery of real, identifiable people. Prompt and verdict both go unsaved. Should the classifier go down, media generation halts (fails closed) instead of running without a check.
The site runs no analytics and no trackers
Until a wallet connects, the Angerona site calls no third party at all.
Once it does, your browser pulls chain data like balance and network status from a Robinhood Chain node. That node's operator can log your IP address and the addresses queried. Wallet software may collect telemetry of its own, beyond our reach.
Five parties sit on the route
| Party | Job | Visible to it |
|---|---|---|
| Cloudflare | Hosts site and gateway | Your IP address and connection metadata, plus Anonymous prompts while the gateway handles them in memory on its platform |
| Model providers (Anonymous) | Run Anonymous models from names like Anthropic, OpenAI and Google | Prompt and reply, which they may log. Your identity, never |
| TEE model provider | Passes TEE traffic to the enclave | Ciphertext, model, timing, sizes, token counts |
| Phala, NEAR AI | Operate the enclaves | Nothing inside a genuine enclave |
| Robinhood Chain node | Serves chain reads for browser and gateway | Your IP (browser reads) and public addresses |
Privacy modes splits this by mode.