Privacy modes
Anonymous and TEE side by side: who can read your prompt in each, what we store, and where each mode ends.
Anonymous hides the person. TEE hides the person and the words. We offer no "private" option between them, since that would be a promise with nothing behind it, and TEE delivers the same result with hardware you can test.
Anonymous mode hides you, not your prompt
Requests pass our gateway on their way to a provider like Anthropic, OpenAI or Google. For chat, only providers flagged as trusted are used.
- Hidden: your identity. Requests carry Angerona's name, and the gateway drops all your headers, so IP address, user-agent and wallet address go no further.
- Exposed: your prompt. Providers receive all of it, plus the reply, and can log both. Assume they retain a copy.
- In transit: our gateway must see the prompt to pass it on, and it saves it nowhere.
- Fits: any model at all, closed frontier models, images and video among them.
- The price of that: the provider can read and store whatever you send.
TEE mode hides you and your prompt
Here the model runs in a confidential-compute enclave, also called a trusted execution environment (TEE). Hardware walls it off, using Intel TDX CPUs and NVIDIA confidential-computing GPUs, and Phala or NEAR AI operates it.
A TEE request goes through four stages, encrypted the whole way:
- Browser tests enclave: it pulls the attestation using a random nonce of its own and verifies what comes back. See Attestation.
- Browser encrypts: every message, older turns included, is sealed to the enclave's key with secp256k1 key exchange, HKDF-SHA256 and AES-256-GCM.
- Gateway relays: ciphertext passes through, and plaintext gets the request rejected. The model provider hands the same ciphertext to the enclave.
- Enclave answers: it decrypts, runs the model, encrypts the reply for your browser, and signs each response.
Use it for health, legal, financial or work matters. In exchange you get 12 open-weight text models, no media, and a badge only when attestation passes for your chosen model.
Each party sees a different part
| Who | Anonymous: prompt | Anonymous: identity | TEE: prompt | TEE: identity |
|---|---|---|---|---|
| You (browser) | All of it, with history stored locally and encrypted | Not applicable | All of it, with history stored locally and encrypted | Not applicable |
| Angerona's gateway | Passes it in transit, keeps nothing | Knows the wallet it bills, keeps only a credit counter | Unreadable ciphertext | Knows the wallet, keeps only a credit counter |
| Model provider | Reads it all, may log it | Unknown, since requests come from Angerona | Passes unreadable ciphertext | Unknown, since requests come from Angerona |
| Host or datacenter | Could technically read it | Unknown | Locked out of a genuine enclave, as attestation proves | Unknown |
Two others also sit on the route:
- Cloudflare hosts the site and gateway, so it handles your connection and sees your IP address. Anonymous prompts are processed in memory on its platform by our gateway. TEE traffic stays ciphertext there.
- A moderation classifier, hosted by a model provider, screens image and video prompts ahead of generation. Chat skips it. See Data handling.
We keep counters and no content
| Stored | Never stored |
|---|---|
| One credit counter per wallet: Main balance plus today's Bonus usage | Prompts or replies, in any mode |
| Hourly token-balance samples per wallet: wallet, token, balance, hour. All of it is public chain data | Images or videos once their link dies, after about 20 minutes |
| Hash and amount of every credited top-up, which blocks double crediting | IP addresses, user-agents, device fingerprints |
| Daily global totals, with no per-wallet data | Email, phone, any account profile |
| Analytics, trackers, per-request logs |
Those balance samples, gathered at the top of each hour and compared with your live balance, produce your tier and say nothing about your questions. See Tiers. For every record, short-lived ones too, go to Data handling.
Anonymous mode ends here
- No cryptographic proof of no logging: each provider follows its own retention policy, and no technical barrier stops it keeping your data.
- No proof of the model: nothing cryptographic confirms which model answered.
- Words can give you away: type your name, address or anything unique and the provider can read that.
- Attachments stay as they are: we scrub location and device metadata from images we generate, not from photos you add. Clean your own location data before attaching.
- Video prompts can stick around: video is an asynchronous job, and on our route job requests remain as operational data while finished files last about 3 hours.
- Trusted-only routing covers chat for sure: the same isn't confirmed for all image and video providers, so count media prompts as visible to the provider generating them.
The gateway asks for trust only in Anonymous mode
There, "we store nothing" is a claim you have to believe. The gateway sits outside any enclave, so no outsider can inspect how it treats plaintext. TEE mode removes the question, as ciphertext is all it ever touches.
TEE mode ends here
- Encryption is code served by angerona.chat: true for all web-based end-to-end encryption. A hacked site could skip the step. Your developer tools can confirm it hasn't: messages should leave as long hex strings. See Attestation.
- Metadata leaks: the gateway and provider can tell which model, what time, rough message length and billed token counts. The gateway also knows the sending wallet.
- Text alone: attachments, tools and image or video generation are out.
- Attestation is per model and may fail: a model that fails carries no badge.
- The response signature is narrow: it shows that the enclave's attested key produced a reply with a given ID. Small rewrites happen on the way in and out, so you have no way to rebuild the signed hashes.
- Hardware is trusted: you rely on Intel and NVIDIA chips, their attestation services, and no undiscovered chip flaws. TEE shrinks the circle of trust without erasing it.
- No moderation: what we can't read, we can't moderate.
Your own device is part of the system
Malware on your machine, or a person at your unlocked browser and wallet, can read your chats. Neither mode stops that.