Privacy

Last updated: 5 October 2026

Epistery is operated by Rootz Corp. This page describes what the Epistery console and its apps hold, what the relay network can see, and what is written permanently to a public blockchain.

The short version: there is no account, no password, and no email address. Content inside a session is encrypted on the device before it leaves, and the relay is handed ciphertext it has no key for.

No account

Epistery does not ask for a name, an email address, a phone number, or a password, and does not operate a sign-in service. On first use a device mints a key — a rivet — locally. That key is the whole credential. It is generated inside the device, is not exportable, and is never transmitted.

Nothing on this page should be read to mean a rivet is anonymous. A rivet has a public blockchain address, and that address is visible to anyone it interacts with.

What stays on the device

• The rivet's private key, held as non-extractable key material in the browser's key store.
• The master key that wraps it, held in the device's local database.
• Session keys, derived on the device from the rivet and public material. They are not stored on a server and are not handed out.
• Local caches of content already decrypted for display.

Clearing the app's data, or deleting the app, removes this material. Where no other device holds the same identity, that identity becomes unreachable. This is the intended behaviour of a non-custodial design: there is no operator copy to restore from.

What the relay can see

The relay network routes bytes between devices and the blockchain. It is blind by construction, and holds no key to session content. Routing still requires it to observe:

• The blockchain address of the device making a request.
• The size, timing, and structural shape of the sealed payloads it stores and serves.
• The network address the request arrives from, as any internet service does.
• Ordinary server logs of requests, retained for operation and abuse investigation.

It does not see session keys and it does not see plaintext content. It renders no access decision of its own; it reads decisions the blockchain already records.

What is public and permanent

Membership is recorded in an Identity Contract on the Polygon public blockchain. That record is public, is readable by anyone, and cannot be deleted — by Rootz Corp or by anyone else. It contains:

• Device addresses that are members of an identity.
• Session identifiers and the role each member holds.
• The transaction history of those changes.

It does not contain content, keys, or any information a device did not deliberately write there. A name registered against an address is public in the same way.

Removing a device revokes its authorization going forward. It does not erase the historical record that the device was once a member, because a public blockchain does not support erasure.

Search

Search queries typed into the console are sent to Epistery servers to be answered, and are logged in aggregate to operate and improve the index. Search results describe pages published elsewhere on the public web; opening one leaves Epistery and hands the request to the browser, at which point the destination site's own practices apply.

The discovery index

Epistery Scan indexes public websites that publish a signed /.well-known/ai declaration. A site is submitted by its operator — directly, or through a tool such as a WordPress plugin — by sending the site's domain name. Scan then fetches the site's public declaration and related public files, verifies their signatures, and lists the domain, the declared information, and the verification results in the public index.

Only the domain name is submitted, along with the network address and request details any web request carries. The index holds only what the site itself publishes. A site operator can ask for a listing to be removed at the address below, though anything the site keeps publishing stays public on the site itself.

What Epistery does not do

• No advertising identifier is requested or used.
• No third-party analytics, attribution, or tracking software is embedded.
• No data is sold, and none is shared with data brokers.
• No profile is built across other companies' apps or websites.
• No content inside a session is read, scanned, or indexed by Epistery.

Content in shared spaces

A session is a shared space. Material placed in one is readable by the other member devices of that session, which is the point of it. Epistery cannot see that material and therefore cannot moderate, retrieve, or remove it. Membership is controlled by the devices that hold owner or admin roles on the contract.

Deleting things

• A device: removed as a signer from the Identity Contract, in the console, by that device or by another with authority. Its authorization is revoked and its session keys go dead.
• Local material: cleared by deleting the app or clearing its storage.
• Session content: deleted through the session it lives in, by a member with a role permitting it.
• The public record: not deletable. See above.

Requests about data held by Rootz Corp can be sent to the address below. What can be acted on is limited by the design: material the operator cannot read, and records written to a public blockchain, cannot be produced or erased on request.

Children

Epistery is not directed to children under 13 and does not knowingly collect information from them.

Changes

Material changes to this page will be dated at the top. Continued use after a change indicates acceptance of it.

Contact

Rootz Corp — privacy@epistery.com