Privacy

This page describes what the Count Zapula DITTA search node actually does with data. It is written to match the deployed software, not to promise more than it can prove.

What a request contains

• Protocol request bodies: a search query and its limits, a peer announcement, a peer-list request or a corpus statistics request.
• A BIP-340 secp256k1 public key, signature and request identifier that the protocol requires so a message can be verified.
• For a paid query, an L402 Authorization credential: a macaroon and the payment preimage that proves payment of one invoice.
• Network-level metadata that any internet service receives, such as the connecting IP address and timestamps.

What is stored

• Corpus and node state in a local SQLite database: the indexed public documents, their attribution and licence facts, verified peer announcements and corpus statistics markers.
• Receipt ledger for paid queries: the payment hash (not the preimage), SHA-256 digests of the original request and query, the requester public key and request identifier, the price, service identifier, credential expiry, the exact signed response body and bounded references to the sources it cited. The raw query text is used in memory to answer the request; it is not written into the ledger.
• No accounts, no user profiles, no advertising identifiers and no third-party analytics are used.

What is not stored

• No wallet keys, no wallet login and no outgoing payment data: this service only receives payments for its own invoices.
• No public Nostr notes are currently admitted or stored. Enabling note admission would require an updated description of note storage and retention on this page.
• No cookies and no tracking scripts. These pages contain no JavaScript, no forms and no third-party assets.

Retention

• Paid-query response payloads and source references become eligible for bounded pruning once the credential expires. A minimised guard keeps only the payment hash and the consumption/guard times until at least about 48 hours and 60 seconds after consumption, or a later observed credential expiry. Cleanup happens in bounded batches during receipt handling, so expiry does not guarantee immediate physical erasure.
• Corpus documents stay while they are published and licensed; removed or re-licensed documents are deleted from active search.
• Peer announcements expire on a bounded TTL (at most 30 days) and are pruned during normal handling.

Logs

The application does not enable HTTP access logging, and the internal proxy discards its own log output. That is an application-level statement only: the hosting provider and the Lightning payment provider may still process connection and payment metadata under their own policies, and this page does not claim anonymity or "zero logging" beyond the service's own configuration.

Payments

Invoices are issued through the payment provider the operator configured. The provider necessarily sees the invoice, its amount and its settlement status. The service validates the invoice locally and never accesses a wallet balance, account history, withdrawal path or any other customer's payment.

Removal and questions

The indexed corpus is public technical documentation with recorded upstream sources; removing it upstream or revoking its licence is reflected here on the next operator update. No public Nostr notes are currently admitted, so there is no note opt-out to exercise yet. If note admission is enabled later, the documented author-bound deletion and opt-out rules apply before this page is updated.