What is true today, and what is not claimed.

Access is passkey-only

There is no password to phish, reuse, or reset, and no reset flow to social engineer. Authentication is a passkey bound to a device; the private key never leaves it and is never transmitted to us. Signing in requires the device to verify you — a biometric or a PIN — every time.

Sign-up is open, and an account reads nothing

Anyone may create an account. It costs no email address and no password, because neither is collected — the account is a passkey and a workspace of your own. What it grants is deliberately small: an identity, and an empty workspace. Connecting a repository is open on this deployment. A repository is read only after the account holder connects it, and only that account's workspace can see what was measured. The gate that matters is the one in front of your code, and it is not open to anybody.

The operator console at /xi is a separate boundary with a separate record of who may pass it. Creating an account does not grant it.

You can delete your account

From your workspace, in one step, without asking us. It removes the passkeys registered to you, your workspace and its name, your membership, and the account row itself. What is deleted is deleted — there is no archive copy and no soft-delete flag, so we cannot restore it and neither can you.

One thing is kept, and naming it is the point of this page. An append-only event log records that an account was created and that it was deleted, with timestamps and the account’s random identifier — never a name, a workspace title, a passkey label, an address or a device. After deletion that identifier refers to no row anywhere, so the line shows that an account existed and ended, and cannot show that it was yours. It is kept because a deletion nobody can evidence is not a deletion anybody should be asked to trust.

This site collects nothing

No cookies, no analytics, no tag manager, and nothing loaded from a third party — no fonts, scripts, or embeds from another host. There is no consent banner because there is nothing to consent to. The pages you are reading do not know who you are.

The control plane is separated from the site

The console and everything serving it — /xi, /login, /settings, /preview, your /workspace and the API — are excluded from search indexing and from the sitemap. /signup is not excluded, because it is a public door and hiding it would be pretence. That exclusion is a request to well-behaved crawlers and not a security control; the session gate is what actually protects the console, and it still does. Both statements are true and the second is the one that matters.

Reporting something

Send it to Cognithamus@proton.me. It reaches one person and there is no triage queue in front of it. There is no bug bounty, so nothing is offered in exchange beyond an answer and a fix.