Skip to content
orangecheck
Get started

Privacy

What we see. What we don't. Side by side.

The product is an identity that pays you. Its privacy is what sets it apart from Sign in with Google, and every row here is a claim you can check. The formal policy is at /privacy.

Against the sign-ins you know

  • Sees which sites you sign in toEach site checks its own envelopes against its own scoped verifier. Our servers take no part in that check.
    Sign in with GoogleYes, every one
    Sign in with AppleLimited, Apple-mediated
    orangecheckNo. Sites verify locally
  • Cross-site behaviour graphSites cannot correlate you with each other: each checks its own scoped envelopes. Your activity across sites is joined only in your own ledger at /me/activity. We don't build or sell a graph of where you sign in.
    Sign in with GoogleYes
    Sign in with ApplePartial
    orangecheckNo. Sites get scoped ids
  • Third-party advertising tied to identity
    Sign in with GoogleYes
    Sign in with AppleNo
    orangecheckNo
  • Personal data needed to sign up
    Sign in with GoogleName, recovery details, often a phone
    Sign in with AppleAn Apple ID (name, email)
    orangecheckNone with a Bitcoin wallet. Or an email address
  • KYC or personal data kept by the provider
    Sign in with GoogleYes
    Sign in with AppleYes
    orangecheckNo KYC. Email sign-in keeps only an encrypted address
  • Sybil resistance
    Sign in with GoogleOpaque provider rules
    Sign in with AppleOpaque provider rules
    orangecheckBIP-322 sat-bond attestation, paid-action history and gates each app sets
  • Moving to keys you hold
    Sign in with Google—
    Sign in with Apple—
    orangecheckGraduation to your own keys is not live: no federation is bound yet.
  • Works without the provider online
    Sign in with GoogleNo
    Sign in with AppleNo
    orangecheckYes. Envelopes verify offline against Bitcoin headers

Every byte that crosses an edge

The whole data graph, laid out so you can audit it. Nothing happens that is not on this list.
  1. You to the app you useAn envelope with your scoped id, the action you authorized, and your signature.
  2. The app you use to orangecheckThe event's billing record: what was authorized, by whom, for what fee. This is what the app pays for, and what flows back to you as your share.
  3. orangecheck to youA credit against your identity, with full provenance at /me/activity: site, action, fee, your share, envelope id and a verify link. OrangeCheck holds what accrues until a federation takes over.
  4. orangecheck to publicEach envelope's hash, anchored to Bitcoin through OpenTimestamps, and a salted commitment to it on Nostr relays. Neither names you, the site or the amount. The envelope itself is served only to whoever holds its id.

What this site keeps in your browser

One cookie, set by ochk.app for ochk.app alone, and one local setting.
__Host-oc_session
Your session here. The token is minted by the ochk.io sign-in host for this site only (audience https://ochk.app) and signed with its Ed25519 key. HttpOnly, Secure, SameSite=Lax, Path=/ and no Domain, so it is sent to ochk.app and nowhere else. It is set when you finish signing in on this site, and expires with the token. Signing out here clears it; signing out everywhere on ochk.io does not reach it.
Light or dark
Kept in your browser's local storage under theme. Not a cookie, and never sent to us.

The orangecheck sites under ochk.io share their own session cookie on .ochk.io. A browser never sends that cookie to ochk.app. No tracking cookies, no advertising ids, no third-party pixels.

Page views are counted by Plausible and by our own insights beacon. Neither sets a cookie, and Plausible stores no personal data. We see totals, not individual journeys.

Delete your identity

In your settings, under advanced, you can permanently revoke your identity. Graduation to your own keys is not live: no federation is bound yet. Deleting does not settle your accrued balance, so settle a non-zero one first. Hashes anchored to Bitcoin and commitments published to Nostr cannot be changed, by design. We cannot delete them, and neither names you. We delete the operational records about you.