The short version
- No email, name, phone number or password. Your account is a random token that your own browser creates, and we keep only a hash of it.
- No analytics, cookies, trackers or access logs on this website.
- When you sign up, pay or use the service, your requests reach us through an independent relay, so we don't see your IP address.
- By default we never see a viewing key. If you turn on scanning, your key is held only in memory, for at most 7 days.
- You can delete your account from your wallet at any time. It's removed from our live systems immediately, and from backups within 35 days.
Who we are
Lantern Zero is operated by Principle Zero Labs LLC, a Washington limited liability company ("we"). We are responsible for the data described here, except for accounts a wallet company buys for its users (see Wallet companies). Privacy contact: privacy@principlezerolabs.com. Postal address: Principle Zero Labs LLC, 522 W Riverside Ave, Ste N, Spokane, WA 99201, United States.
This policy covers lanternzero.com and the hosted Lantern Zero service. It doesn't cover servers that other people run with the open-source software, your wallet app, the relays your wallet uses, or your wallet developer's push gateway. Each of those has its own operator and policy.
This website
lanternzero.com uses no cookies, analytics, tracking pixels, third-party scripts or embedded content, and serves its own fonts. We don't keep access logs. Pages are sent with Referrer-Policy: no-referrer, so the next site you visit doesn't learn you came from here. Because we don't track you, we don't respond differently to Do Not Track signals: there is nothing to turn off.
If you switch between light and dark mode, your browser remembers that one choice in its own storage on your device. It's never sent to us, and clearing your site data removes it.
When your browser loads a page, it connects to our hosting provider, Amazon Web Services (AWS), which has to see your IP address to send the page back, as any web host must. We don't log it. Browsers can't send ordinary page loads through a relay, so to hide your IP address from AWS too, use Tor Browser. Signing up and paying are different: those requests go through a relay.
Signing up and paying
Your browser generates your account token and sends us only its SHA-256 hash. The token stays in your browser and your wallet; we never receive it. The signup page sends the hash, and every later check on your invoice, through an independent Oblivious HTTP relay, just as your wallet does. So we don't see your IP address when you sign up or pay. The relay sees your IP address but can't read the request.
Scheduled wake-ups are free, so you can create an account without paying. To stop anyone creating free accounts in bulk, your browser may have to do a few seconds of computing work (a proof of work) before signup completes, and we limit how many free accounts are created overall. Neither involves your identity or your IP address.
Scanning mode is paid. You pay in shielded ZEC to a payment address we generate for your invoice. We record that the invoice was paid, the amount and the date, so we know your paid period. A shielded payment doesn't show us who sent it. For tax and accounting, we keep the amount and date of each payment for 7 years, without the link to your account once the account is deleted.
At signup you can say you're interested in hosted block serving. We store that as a yes/no flag on your account and publish only the total count.
Your devices
To wake your wallet, we keep a push subscription for each device you register: the address of your wallet developer's push gateway, which includes an encrypted device identifier that only the gateway can read, and the keys used to encrypt pings to your device. Every ping is encrypted to your device and padded to the same size, so neither the gateway nor Apple or Google can read it. We delete a subscription when you remove the device, when the gateway tells us it's gone, or when you delete your account.
Requests from your wallet
Your wallet sends every request through an Oblivious HTTP relay run by an independent organization. The relay sees your IP address but can't read the request; we read the request but don't see your IP address. Your wallet developer chooses the relays, not us. A relay and our server working together could link your IP address to your account, which is why we never run relays ourselves and wallets spread requests across several.
We keep short-lived counters per account and per device to stop replayed requests and to enforce rate limits. They contain no keys or payment data. We also record the day (not the time) your wallet last contacted us, so we can delete free accounts nobody uses.
Scanning mode (opt-in)
If you turn on scanning, your wallet lends us an incoming viewing key for 24 hours to 7 days. While the lease lasts:
- We can see the payments you receive to that key. If you also turn on spend alerts, your wallet lends us a full viewing key instead, and we can see payments you send too.
- The key is held only in memory: never on disk, in logs, in backups, in crash dumps or in metrics. A server restart drops it.
- Payment matches are held only in memory, and deleted when your wallet acknowledges them, or after 7 days at most. We keep no history per key.
- The key is dropped when the lease ends, when you turn scanning off, when you delete your account, or when your paid period ends, whichever comes first.
While a lease is active, anyone who breaks into our systems, or who compels us by law, could also see those payments. Using a separate receiving account for scanning limits what the key reveals.
With instant alerts, a push arrives outside the regular 30-minute schedule, so your push gateway and Apple or Google can tell when you were paid. Private alerts avoid this by waiting for the next scheduled ping.
We use your viewing key only to send you the alerts you asked for, and only because you agreed to it on your wallet's consent screen.
Merchants and webhooks
If you connect a webhook, we store its URL. When a payment matches, we send your server the payment's amount, memo and transaction ID over TLS. Deliveries waiting to be sent are held only in memory, and dropped after 24 hours of failed retries.
Wallet companies
If a wallet company pays for your account and sets it up for you, that company decides how your account is used, and we handle your account data on its behalf. Its privacy policy applies too. The company never receives your viewing key or your payments from us.
Operational logs
Our servers keep operational logs and metrics, such as error counts, request volumes and timings, for 30 days, to keep the service running and to stop abuse. They never contain tokens, token hashes, viewing keys, payment data or IP addresses.
Why we use this data
- To provide the service you paid for: your token hash, payment records, devices and counters.
- Scanning mode: your consent, given in your wallet and withdrawn by turning scanning off.
- Payment and accounting records: our legal obligations.
- Operational logs and abuse limits: our legitimate interest in running a secure, reliable service.
How long we keep data
| Data | Kept for |
|---|---|
| Viewing keys | The lease: 24 hours to 7 days, in memory only |
| Payment matches | Until acknowledged, at most 7 days, in memory only |
| Account (token hash, devices, webhook) | Until you delete it. A paid account becomes a free one when its paid period ends; a free account is deleted after 90 days without a request from your wallet. |
| Payment records | 7 years, unlinked from your account once it's deleted |
| Operational logs | 30 days |
| Backups | 35 days |
Who we share data with
We don't sell or rent data, and we don't use it for advertising. We use one service provider, AWS, for hosting in the United States, and it processes data only on our instructions. We may disclose data if the law requires it (see Legal requests).
International transfers
Our servers are in the United States. If you use the service from another country, your data is processed there.
Your rights
You can delete your account, remove devices and end scanning at any time, directly from your wallet. Depending on where you live, you may also have the right to access, correct, restrict or object to our use of your data, and to complain to a data protection authority.
We don't know who you are, so we can't look you up by name or email. To exercise a right that your wallet can't, write to privacy@principlezerolabs.com. We'll explain how to prove you control the account without sending us your token. Never send your token to anyone, including us.
Security
All traffic is encrypted. Viewing keys are locked in memory, kept out of swap and crash dumps, and wiped when dropped. If we learn of a breach that affects you, we'll post a notice on this website, since we have no other way to reach you.
Legal requests
We hold only what this policy lists: token hashes, payment records, push subscriptions, webhook URLs, each account's last-active day and, during an active scanning lease, the payments matched to your key. We can't identify an account without its token. We review every request and push back on overbroad ones.
Every six months we'll publish a transparency report on the Transparency page, counting the requests we received, by type, and what we provided. A court order could require us to keep data we normally discard during a lease; if that ever happens, the report will say so to the extent the law allows.
Age
The service is for adults. You must be at least 18 to use it, and we don't knowingly provide it to anyone younger.
Changes to this policy
We have no way to email you, so we'll announce material changes on this page at least 30 days before they take effect, and note each change at the end of this page. Any change to the protocol's privacy rules is made first in the open protocol specification.
The rules behind this policy
These practices are requirements of the open Lantern Zero protocol, which anyone can read in the protocol specification. The Transparency page shows which open-source release the service runs. See also our terms of service.
Draft of 1 November 2026.