Controller: Hermes Blockchain Ventures — Matthias Winter (sole proprietorship / Einzelunternehmen), Schraudolphstraße 2A, 80799 München, Germany, hermes-stakepool@proton.me. Version 21 September 2026.
tokumai is built so that we learn as little as possible. There is no account in the usual sense: no e-mail, no sign-up, no name — only a key derived from a recovery phrase that is generated on your device and never leaves it. Your questions travel through the Nym mixnet, so our server never sees your IP address. Your conversation history stays on your device, encrypted. Every answer is paid with blind-signed coins that cannot be linked to the account or the payment they came from.
One thing a mixnet cannot hide: the entry gateway — the first node your app connects to — sees your real IP address, the way any server you connect to does. It sees neither what you send nor where it is going: the traffic is encrypted in layers and mixed with other people's on its way. You choose the entry gateway in the app and can change it at any time.
The site is served by us. No access logs are kept (request logging is switched off on both the reverse proxy and the application), no cookies are set, and no third-party scripts or analytics are loaded. Three honest limits: we count page views, downloads and the number of visitors per day — a visitor is recognised by a fingerprint of IP address and browser name, hashed with a random key that exists only in memory and changes every day, so the stored value identifies nobody and cannot be compared across days; the proxy's error log can briefly record the IP address of a connection that failed (for example a broken TLS handshake), and the faucet counts claim attempts per IP address for one hour to stop brute force — hashed with a random key that changes at every restart, held in memory only, never written to disk. The testnet faucet form sends the invite code and the invoice memo you type to our server, where they are stored together with the transaction id of the test payment (purpose: pay one test invoice per code; legal basis Art. 6 (1) (b) GDPR; kept for the duration of the test programme).
Cards and PayPal: processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. The checkout runs on Stripe's own page, never in our app or on this site. For a plan, Stripe keeps a customer record and the payment method so that it can charge the next period.
Cancelling on this site: the e-mail address you type at /cancel is used once — our server asks Stripe for tokumai plans paid with it, sets them to end with the paid period, and deletes the address in the same step (at the latest after one day if Stripe could not be reached). The page answers the same way whether or not a plan exists, so it cannot be used to find out who subscribes; the confirmation is the page itself, which you can save — we send no e-mail. Legal basis: Art. 6 (1) (b), (c) GDPR.
Stripe collects what the payment and our bookkeeping need — your name and billing address, your e-mail address, the card or account details, your IP address and browser data — as an independent controller under its own privacy policy: stripe.com/privacy. Name and address are required because we are obliged to record where a sale was made; they are not something the service itself needs, and they never touch your tokumai account or anything you do with it.
From Stripe we receive the payment status, the amount, our own random order id and the country of the billing address. The country is the only one of those we keep, in our sales records. We never receive card data, and we do not copy your name, address or e-mail into our systems — they stay with Stripe, where the tax records are kept. Legal basis: Art. 6 (1) (b) GDPR for the payment, Art. 6 (1) (c) GDPR for the records we must keep; Stripe's retention follows its own legal obligations (payment records, typically 7 years).
Model providers (Google LLC and OpenAI, L.L.C. — USA, under the EU–US Data Privacy Framework and/or standard contractual clauses) receive request content only; Stripe Payments Europe, Limited (Ireland) receives the payment data, and may pass it to Stripe, Inc. (USA) under the same safeguards; our hosting provider OVHcloud (EU data centre) operates the server. No data is sold or used for advertising.
You have the rights of access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR) and the right to complain to a supervisory authority (for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Ansbach). Note that most data we hold is anonymous by design and cannot be attributed to you; for card payments, please quote the order id from the Stripe receipt.
hermes-stakepool@proton.me · Hermes Blockchain Ventures, 80799 München.