Privacy Policy
Effective: January 2026 | Last updated: 26 September 2026
Overview
Thurin Labs LLC ("Thurin Labs," "we," "our," or "us") builds Thurin.id (thurin.id), PGP keys on Ethereum addresses. Thurin.id is a lookup site and an attest page (thurin.id/attest) that puts a PGP key on an Ethereum address, with proofs linking it to accounts on other platforms. This policy covers thurin.id, thurinlabs.id, docs.thurin.id, mathom.thurinlabs.id, the keyserver at keys.thurin.id, the relay at relay.thurin.id, and the copies of those sites served under our ENS names.
Thurin.id has no accounts and no database of users. Everything you publish goes on the Ethereum blockchain from your own wallet, or through a permission you signed that the relay or another wallet sends, and checking an identity runs in your own browser. The only Thurin Labs systems that see any traffic are the web servers and three small services described below: the keyserver, the relay, and the share-card service.
What Goes On-Chain
Publishing a claim writes the following to the PGPRegistry contract on Ethereum. It is public and permanent: anyone can read it from any Ethereum node, forever. A claim can be revoked, which marks it inactive, but nothing on a public blockchain can be deleted, by us or by anyone.
| Data | Where it comes from | Notes |
|---|---|---|
| Your Ethereum address | The address the claim names | You publish from it, or sign a permission that the relay or another wallet sends for you |
| Your PGP public key | Pasted by you | Includes the name(s) on the key and every subkey on it, including an SSH (authentication) subkey, which links that SSH key to your address. Photo IDs and other people's signatures are left out. By default Thurin.id leaves out any name that contains an email address or carries a note (a notation) holding one, and refuses a signature with your email written into it; you can choose to include your email, and that choice cannot be undone for that claim |
| Proof links | Notations on your key | URLs of accounts you have chosen to link (for example a GitHub repository, a domain, a Mastodon profile). Adding a proof is your choice; each one publicly ties that account to this identity |
| A signed statement | Made by you with your PGP key | The text "I control the Ethereum address: …", signed. It proves the key holder chose this address |
| Timestamps | The blockchain | When the claim was published, updated, or revoked |
| Who sent it | The transaction | Your address, or the relay or wallet that sent your permission. Public, like every transaction |
| Revocations | Set by you, if you revoke | When, and the reason you gave. Marking a key compromised is permanent for that address. Cancelling unused permissions is recorded too |
| Records | Set by you, if you choose | Short texts on a claim, such as a security contact, a canary, or a release list. Clearing one takes it off the claim, but every value it ever had stays readable in the blockchain's history |
Before you publish, the attest page shows you exactly which names, proofs, and other notations are about to go on-chain. Nothing about you goes public unless you put it there. Replacing the key on a claim later, say to remove a proof, doesn't erase the old key: it stays readable in the blockchain's history, like everything else published there.
Processed only in your browser
- Attesting: your PGP private key is used on your own machine, in your own tools, to sign the statement. The private key never leaves your machine, and no Thurin page ever asks for it.
- Looking up an identity: your browser reads the claim from the blockchain and checks the signature against the stored key. Proofs are checked against the platforms they point at only when you press Check proofs (or chose Always check in the footer). The results are computed on your device and not reported anywhere.
What we do not collect
- Accounts, logins, or passwords: there are none
- Private keys (PGP or Ethereum)
- Names, dates of birth, government identifiers, photos, or biometrics
- Email content or contacts
- Analytics, telemetry, or usage data: we run none
Web Servers and Logs
Our sites are static pages served through a web server (nginx) we operate, which fetches them from copies pinned to IPFS. It keeps no access logs: no record of who visited, which pages, or with what browser. Only a request that fails can leave a line with its IP address in the server's error log, which is rotated away after two weeks. When it fetches a page from the IPFS gateway, it sends nothing about you (no IP address, no browser details, and not which identity you are looking at).
Two small services answer requests directly: the keyserver (keys.thurin.id), which serves PGP keys from the blockchain to tools like gpg, and the relay (relay.thurin.id), which publishes a claim for you when you choose to have Thurin Labs pay for it. Neither records IP addresses. The keyserver's log says only what kind of lookup it answered and whether it found a key, never what was looked up. The relay logs what it published, which is public on-chain anyway, and for a request it turns away only that it did so, not who asked. It limits how often one caller can use it by counting requests in memory under a salted hash, dropped once an hour has passed or the service restarts.
The share-card service draws link previews, and the card images people put in READMEs and on pages (thurinlabs.id and thurin.id show one). It reads the same public on-chain data your browser would, fetches profile images only from the sources listed below, caches the result for about an hour, and keeps nothing else, apart from error messages about an identity it failed to draw. When a social platform or GitHub's image proxy asks for an image, it sees that request, not yours; when a page shows a card image straight from thurin.id, your browser asks our server for it, the same as for any page.
Our ENS-hosted copies (thurinlabs.eth, id.thurinlabs.eth, docs.thurinlabs.eth) are served by third-party IPFS gateways such as eth.limo, which keep their own logs under their own policies.
Third Parties Your Browser Talks To
Thurin Labs sends nothing to third parties, and our pages tell outside services nothing about which page asked (no referrer). Your browser contacts these services directly, and each sees that request in the ordinary way:
- An Ethereum node to read claims. By default thurin.id and the library use PublicNode's free public endpoint (ethereum.publicnode.com), which sees your IP address and the identities you look up. You can choose your own node in the thurin.id footer; the choice is saved only in your browser. Any node works.
- ENS, via the same node, to resolve names. Profile images load only from content-addressed storage (through the Filebase IPFS gateway, with Pinata's as a fallback, or arweave.net) or from euc.li, where the ENS app stores uploaded avatars. An image on a server the name's owner controls is not loaded, so that owner cannot see who views the page. A name that keeps its data on a server of its owner's choosing (an "offchain" name) is followed only when you type that name yourself, and that server then sees your IP and the name; names the page looks up on its own are never followed.
- The platforms behind proofs, only when you press Check proofs (or chose Always check): GitHub's API, Codeberg's API, Cloudflare's DNS-over-HTTPS resolver, and the Mastodon server named in a proof, which the identity's owner picks and so may see who checks. Farcaster proofs are checked through a public Farcaster node run by Quilibrium (haatz.quilibrium.com), with no account or key.
- The command-line tool talks to the same services, plus a relay only if you set one. It checks proofs when you ask it to look someone up (
thurin status --no-proofsasks only the Ethereum node), and if you set your own Neynar API key, Farcaster proofs go to Neynar's hub instead. It never checks for updates and reports nothing.--show-networklists every host a command contacted, and saves nothing. - Links on identity pages to Etherscan, the ENS app, and EFP contact nothing until you click them.
- Your wallet. If you connect a mobile wallet by QR code, the pairing goes through WalletConnect's relay. Nothing is sent to WalletConnect until you choose to connect, or, after a QR-code connection, when the page reconnects it.
We use no third-party analytics, advertising, or tracking services, and no data is shared with anyone for marketing.
Cookies and Browser Storage
Our sites set no cookies. Your browser keeps a few things locally: your theme preference; on thurin.id, the wallet library's settings, and the wallet and address you connected so it can reconnect; the Ethereum node you chose, and whether to always check proofs, if you chose those; and, while you use a link from the Thurin CLI, that link, kept only in that tab and dropped once used. All stay on your device and can be cleared at any time.
Your Choices and Rights
- What is public is your choice. You decide which names, which email (if any), and which proofs go on-chain, and the page shows you before you publish.
- Revocation. You can revoke a claim at any time from thurin.id/attest, with
thurin revoke, or through a signed permission. Revoked claims are marked inactive and are no longer treated as your identity; the record of them remains on the blockchain. - Updating. You can replace the key stored on a claim, for example to remove a proof, without a new claim. The old key stays readable in the blockchain's history.
- Deletion. Blockchain data cannot be deleted by us or by anyone, including an old key you replaced and a record you cleared. This is a property of public blockchains, and it is why the attest page asks you to choose carefully.
- Access. Everything Thurin.id knows about an identity is on the identity page, readable by anyone, including you. There is nothing further to request.
Security
- All signing and verification happens on your device
- The PGPRegistry contract has no owner, no administrator, no fees, and no upgrade mechanism; its source is published and verified
- The verification library (identity-kit), the sites, and the contract are open source
- No Thurin Labs system holds any secret of yours
Children's Privacy
Thurin.id is not directed at children. Publishing a claim requires an Ethereum wallet.
Changes to This Policy
We update this page when the products change. Changes are posted here with a new date.
Contact
- Email: hello@thurin.id
- Website: thurinlabs.id
Legal Basis (GDPR)
For users in the European Economic Area: the only processing carried out by Thurin Labs systems is the error and service logging described above, which records no IP address except on a failed web request, on the basis of our legitimate interest in operating the sites. Everything else, including every claim and proof, is published by you, from your own wallet or through a permission you signed, to a public blockchain, by your own choice, and is processed on your device. Thurin Labs is not the controller of data you choose to publish on a public blockchain.
We do not collect your data because the design never needs it. What you publish is yours, public, and permanent, and the page tells you so before you do.