Privacy

What decrypt.aauth.dev stores, what it sees, and for how long. Plain and short.

What it stores

• An identity: the pairwise identifier your Person Server (Hellō) presents to this service. It is different from the one it presents to any other service, and it is not an email address. This service never learns your address or your name.
• Your keys: P-256 private keys, AES-256-GCM wrapped under a key only this service holds, plus their public halves and a key id. A rotated key is kept until nothing can still be encrypted to it, then purged.
• Events: for each call, the operation, the time, a hash of the identity, the key id, and the ciphertext size. Never the plaintext, never the ciphertext, never who sent a message or to whom.

What it sees

• Plaintext, while decrypting. readMessage decrypts a message and returns its text to your agent. The plaintext exists in memory for that call and is not kept. This is why the service asks for your consent by name and is not folded into the messaging service's consent: anything that sees plaintext should be one you approved.
• Ciphertext, when you ask it to fetch. readMessage fetches one message from your messaging service, over a call chain: this service asks your Person Server for a token for that service, downloads the message (which marks it downloaded there), and decrypts it. It sees the message id, sender and recipient addresses and the sender's name, and the ciphertext for that call, and keeps none of them. It fetches only the message your agent asked for, only when asked.
• Nothing during setup. When secret.agent.coop calls getKey for you over a call chain, this service sees a token naming your identity here and that secret asked. It learns nothing else.

What it does not do

• It does not fetch ciphertext on its own. It fetches a message only when your agent calls readMessage for it. When you rotate your key it tells your messaging service the new public key (setPublicKey), and nothing else.
• It does not share keys or events with anyone. Events go to the operator's log pipeline for reliability and abuse handling only.

Run your own

None of this has to be trusted to us. The code is open and runs at any origin; the messaging service accepts any key you register. See the front page.

Contact

feedback@agent.coop · abuse@agent.coop. The operator is the same as secret.agent.coop's; its policy is at secret.agent.coop/privacy.