Not Promises. Mechanism.
Every claim on this page corresponds to a line of code you can audit on GitHub. Every protection has a defined failure mode. Every limit is written down. This is the threat model, published.
Your private data is encrypted before it reaches us. We cannot read your email address, your phone number, your real name, or your physical address. If our database is ever compromised, what leaks is ciphertext — useless without keys that live in a separate, isolated location.
This is not a marketing bullet. It is the architecture. We built MyCitadel so that we cannot betray you even if we wanted to — because we do not have the ability to read the data in the first place.
Every item below is implemented. Every item is auditable. Nothing here is aspirational.
Passwords are hashed with 256 MiB memory cost, 4 iterations, 2 threads. Even with our entire users table in hand, recovering a single password requires infeasible compute. Silent rehash upgrades old hashes on next login — no user ever sees a "please reset" prompt.
Every personal field — email, phone, real name, address, date of birth — is encrypted with a per-user key derived from a master key. The master key lives outside the database, in a directory the web server cannot serve. A stolen DB dump yields ciphertext only.
We check "is this email already registered?" without ever storing the email in plaintext. Keyed HMAC indexes give us uniqueness enforcement and lookup — with zero recoverable plaintext on disk.
Every session is bound to your browser's User-Agent + Accept-Language + client hints. A cookie stolen from Chrome will not validate in Firefox. Session IDs rotate on every login, logout, and password change — fixation attacks do not survive.
TOTP-based, compatible with Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and any RFC 6238 app. Secrets are encrypted at rest. Recovery codes are single-use and stored only as hashes.
No Google Analytics. No Facebook Pixel. No Cloudflare Insights. No session-replay tools. The only third-party script on any page is Stripe.js, loaded exclusively during the checkout flow.
Double-submit CSRF tokens on every unsafe request. Strict Content-Security-Policy without inline scripts. SSRF host allowlist on push subscriptions. Every mutating endpoint scoped to the session user — no client-supplied user IDs are trusted for authorization.
Authentication events are logged with hashed IPs and per-request correlation IDs. Every log line is JSON-formatted, greppable, and retained per published schedule. No plaintext PII appears in any log entry.
The most dangerous feature of any social platform is the ease with which a stranger can find, watch, and follow someone. We designed against that from day one.
Nothing about you is public by default. Your profile, your posts, your connections — all gated behind accepted connection requests. You decide who sees what, per person, at any time.
Blocking is mutual, immediate, and silent. The blocked party gets no notification — they simply vanish from your world, and you from theirs. No "user X blocked you" message that could escalate tensions.
Set your account to "hidden" and you become invisible to everyone except yourself. Even a direct ID guess returns 404 — no existence leak. This is a permanent option, not a temporary state.
When you cannot view something, you get a 404 Not Found — never a "You are not allowed" message. Attackers cannot use our error messages to enumerate who exists on the platform.
End a connection and every message between the two of you is destroyed. Not hidden, not archived, not soft-deleted. Gone from the servers. Reputation scores are adjusted on both sides.
You cannot see another user's profile, posts, or comments unless you are connected. Messaging requires connection. Connection requests require mutual acceptance. No cold DMs. Ever.
Most platforms quietly build an "admin panel" that lets staff read user messages, view private posts, and inspect profiles. They call it "trust and safety," "content moderation," or "compliance tooling." Regardless of the label, the outcome is the same: your private data has more readers than you think.
MyCitadel has no such panel. There is no administrative interface to read user data — because there is no way for us to read it in the first place. The encryption is not a feature that admins can bypass. It is the substrate the platform is built on.
Emails are encrypted with a key we cannot derive without the user's ID and the master key. There is no button that decrypts it.
Messages are end-to-end encrypted in the current architecture. Staff cannot see them.
Real names are encrypted. We cannot build a search index on data we cannot read.
We do not accept third-party data feeds, purchase marketing lists, or infer user traits from browsing patterns. We only know what you tell us — and even that is encrypted.
We do not want to see your private data. We cannot see your private data. Those two facts are the same design decision, made twice.
Other platforms promise they will not sell your data. We do not have to promise — because we do not have anything to sell.
Your email address is ciphertext. Your real name is ciphertext. Your phone number is ciphertext. Your address is ciphertext. There is no advertiser willing to pay for a base64 string that even we cannot read. When we say "your data is not for sale," we mean it literally — there is no product to offer.
And nobody wants to buy our equations. They want your behavior, your attention, your identity — none of which we have access to. This is what "privacy by architecture" actually means.
MyCitadel is funded entirely by $10/month premium subscriptions and donations. We do not run ads. We do not accept sponsored content. We do not have investors demanding growth-at-any-cost. Premium features are the entire business model — and that is intentional.
A platform funded by users cannot betray users without losing its users. A platform funded by advertisers cannot serve users without betraying them. That is the entire difference between the two models.
We believe security researchers should be allies, not adversaries. If you find a vulnerability in MyCitadel, tell us first. We will treat you with respect, credit you publicly, and reward you.
All valid vulnerabilities earn:
For truly exceptional findings, a financial reward may be offered — up to $1,000, at the owner's discretion. This applies when:
Honest disclosure: MyCitadel is built by one person with a full-time job. Financial rewards are possible but not guaranteed. Do not spend a week on an audit expecting a payout — spend it because you care about the mission, and we will reward what we can.
api.mycitadel.lol — the entire API surfacemycitadel.lol — the web frontendHonesty matters more than marketing. These are the boundaries of what MyCitadel can and cannot protect you from.
Email is decrypted server-side to send verification links and password resets. The server holds the master key. True zero-knowledge requires client-held keys — which breaks account recovery. That is a v2 feature for the native mobile apps.
Email is the recovery channel. Anyone with access to your inbox can trigger a password reset. Use a strong, unique password on your email provider, and enable 2FA there too.
If malware runs on your phone or laptop, no server-side defense can help. Keep your OS and browser updated. Use a password manager. Do not install random software.
If we receive a lawful order, we cooperate within the bounds of the law. What we can hand over is limited by design: ciphertext, hashes, and timestamps — never plaintext. We will publish a transparency report if the volume of requests ever justifies one.
MyCitadel is built and operated by a single developer with a full-time job. That is a strength for privacy (no investors to satisfy, no ad network demanding data) and a limit for scale. We grow carefully, not recklessly.
Shared hosting, one operator, no SRE team. We aim for reliability but cannot match the SLAs of a hyperscale provider. If uptime is critical to you, this may not be the right platform.
Two ways to reach us. Both are monitored. Both are welcome.
Send your report directly to our security inbox. Include the affected endpoint, the impact, and reproduction steps. Attach screenshots or PoC code if relevant.
security@mycitadel.lol
Acknowledgment target: 72 hours
Remediation target for critical: 7 days
We are in the process of onboarding to HackerOne. Once live, this page will link directly to our program profile with full scope and reward documentation.
hackerone.com/mycitadelUntil then: email works fine. We will not lose your report.
Please do not test vulnerabilities against production users. Create a test account. If you need a specific scenario set up, email us first and we will help.
Our code is public. Our threat model is published. Audit us.