The short version
- No email, name, phone number or password. Your account is a random token that your own browser creates.
- No analytics, cookies, trackers or access logs on this website.
- Your wallet's requests reach us without your IP address: each one goes through an independent relay.
- By default we never see a viewing key. If you turn on scanning, your key is held only in memory, for at most 7 days.
- You can delete your account from your wallet at any time, and everything tied to it is dropped at once.
This website
lanternzero.com uses no cookies, analytics, tracking pixels, third-party scripts or embedded content, and it loads its fonts from this site. We don't keep access logs. Our hosting provider, Amazon Web Services, processes your IP address in order to deliver the page, as any web host must.
Pages are served with Referrer-Policy: no-referrer, so the sites you visit next don't learn that you came from here.
Your account
When you sign up, your browser generates the account token and sends us only a SHA-256 hash of it. We store that hash, never the token itself, and we never log either. The token goes into a connection URL that you paste into your wallet; it never passes through this website's servers.
You pay in shielded ZEC. We record that your account's invoice was paid, and when, so we know your paid period. We don't ask for, and can't see, your name or any other address of yours.
Your devices
To wake your wallet, we keep a push subscription for each device you register: the address of your wallet developer's push gateway and the keys used to encrypt pings to your device. Every ping is encrypted to your device and padded to the same size, so neither the push gateway nor Apple or Google can read it.
Requests from your wallet
Your wallet sends every request through an Oblivious HTTP relay run by an independent organization. The relay sees your IP address but can't read the request; we read the request but never see your IP address. Your wallet developer chooses the relays, not us.
Scanning mode (opt-in)
If you turn on scanning, your wallet lends us an incoming viewing key for 24 hours to 7 days. While the lease lasts:
- We can see the payments you receive to that key. If you also turn on spend alerts, we can see payments you send.
- The key is held only in memory: never on disk, in logs, in backups, in crash dumps or in metrics. A server restart drops it.
- Payment matches are deleted as soon as your wallet confirms them, or after 7 days at most. We keep no history per key.
- The key is dropped when the lease ends, when you turn scanning off, when you delete your account, or when your paid period ends, whichever comes first.
Anyone who breaches our systems or compels us by law during a lease could also see those payments. Using a separate receiving account for scanning limits what the key reveals.
With instant alerts, a push arrives outside the regular 30-minute schedule, so your push gateway and Apple or Google can tell when you were paid. Private alerts avoid this by waiting for the next scheduled ping.
What we never do
- We never ask for your spending keys, seed phrase or full viewing key, unless you explicitly turn on spend alerts.
- We never look up individual transactions in a way that would reveal which ones are yours.
- We never sell, share or analyze your data for advertising.
Deleting your account
Delete your account from your wallet. The server immediately drops its leases, payment matches, devices, webhook and token hash.
Legal requests
We can only hand over what we hold: a token hash, payment records for your account, push subscriptions, and, during an active scanning lease, the payments matched to your key.
The rules behind this policy
These practices are requirements of the open Lantern Zero protocol, which anyone can read in the protocol specification.
Contact
Questions about privacy, or a request about your data: email greg@principlezerolabs.com.
Draft of 31 October 2026.