Ordering anonymously: a practical checklist

What we already do

We ask for an email address and nothing else. No identity document, selfie, phone number, billing address, date of birth or real name, at any spend level. There is no verification step and no reviewer. That removes one link in the chain — the rest are yours.

1. Use an email address not tied to you

An alias, a forwarder, or an address on a domain unconnected to your identity. This is where credentials and invoices go, so it has to keep working: a bounced delivery is unrecoverable because we hold nothing else that proves the account is yours.

Avoid ten-minute disposable inboxes for that reason. A permanent alias from a privacy-respecting provider is the right shape.

2. Pay in Monero

This is the highest-impact step after the email address. Every other asset we accept — BTC, ETH, USDT, LTC and the rest — is pseudonymous on a public ledger, not anonymous. A withdrawal from a KYC'd exchange to our invoice address is a link, and chain-analysis firms sell exactly that link as a product.

Monero does not have that property. Select XMR at checkout; the network fee is around $0.01 and it needs 10 confirmations, so allow about twenty minutes.

3. Choose an offshore region

Reykjavík, Zürich, Panama City, Bucharest, Sofia or Amsterdam. No blanket data-retention mandate for hosts, no direct force for a US DMCA notice, and disclosure requiring local court process. Pricing is identical to every other region, so this costs you nothing.

4. Connect through something

Our client-area sign-in log records the connecting IP for 90 days — you can see it yourself under Security → Account activity. A VPN, Tor, or another server you control removes that association. Your connection to the server itself is outside our visibility, but it is not outside everyone's.

5. Do not undo it inside the server

The most common failure by a wide margin, and the one we cannot help with. Check all of these before the machine touches anything public:

# Does your git config carry your name into every commit?
git config --global user.name
git config --global user.email

# Any SSH key you also use elsewhere?
ssh-keygen -lf ~/.ssh/id_ed25519.pub

# What does your mail actually send as?
hostname -f

• Registering a domain with real WHOIS details and pointing it here
• Reusing an SSH key that is already on a personal GitHub account
• An analytics or ad property shared with your other sites
• A TLS certificate ordered with a real organisation name
• Logging into personal accounts from the server's browser

Account recovery, and why it is different here

Because we hold no identity documents, we cannot verify you the way a bank would. What we can verify is control of a payment: open a ticket with an order ID and the transaction hash it was paid with, ideally signed from the sending wallet.

Far easier: enable two-factor from Security and store the eight recovery codes somewhere that is not the phone running your authenticator.

What this does not cover

Not asking who you are is unrelated to not caring what you do. The acceptable use policy applies identically in every region, offshore included — spam, phishing, malware, credential stuffing, DDoS origination and CSAM are terminated without refund. Enforcement acts on the server, which does not require knowing your name.