Privacy
M2 messaging, this public website, downloads, notifications, payments and ordinary email have different data paths. Here is what each one does.
Ordinary Channel participation does not require a phone number, email address or real-name account. Messages and supported files are encrypted on the device. Embedded Tor carries messaging traffic to the v3 Onion Service, so the messaging gateway does not receive a direct originating clearnet connection.
The gateway relays encrypted payloads temporarily. Confirmed durable receipt starts deletion; undelivered ciphertext expires within 48 hours.
Mirage Project is served as a normal public HTTPS website through Cloudflare. Visiting it sends a network request to Cloudflare and may create standard provider-side connection metadata. The site has no analytics, advertising, session replay, remote fonts, marketing cookies or behavioral tracking.
/api/network-identity returns the request IP and bounded Cloudflare-derived city, region and country fields with Cache-Control: no-store. M2 keeps that status result in memory and does not persist it in the application database.
The dedicated Cloudflare release Worker serves the trusted manifest and immutable release files. Download requests reach Cloudflare. Firebase may provide a generic wake signal that prompts the app to check for encrypted work; communication content is not placed in that wake payload.
PayPal processes checkout information in the verified in-app purchase flow. M2 verifies payment state server-side and never treats a browser return as proof of payment.
Email sent to info@mirageproject.org is ordinary email, outside accountless M2 communication. Send only what the inquiry needs, and never include M2 Codes, invitations, passwords or Channel content.
