You open store.example for the first time. It shows a code — a request reference, not your credentials. You point U-net at it.

U-net checks the registered service and its domain, then asks you. You approve sign-in and order messages, and refuse marketing.

Four things cross to the service — and they are all it will ever have: a scoped ID, the permissions you approved, a short-lived login assertion, and a public key.

The service fades out of the picture, because it is no longer holding anything of yours. Nothing in the record identifies you anywhere else.

You are signed in. Another service asking tomorrow gets a different ID, and neither can tell they are the same person.

A month later you come back to store.example. There is no password field, because there was never a password.

U-net recognises the service and asks you once. The permissions you set in March are still the ones in force.

Three things cross again — and the first of them is the same string it saw the first time. That is what "recognised" means here.

The record does not grow. Signing in for the fortieth time leaves the same rows it had on day one.

The proof you send is single-use. Captured and replayed six minutes later, it opens nothing.

You need proof that you hold an account at your bank. You ask for it from inside U-net — the bank is the one that knows, so the bank is the one that says so.

The bank checks only what it already has on file. No new data collection, no forms, no upload.

It encrypts the credential to your public key and hands it over. What travels is a sealed envelope.

It lands in your wallet next to others. What the bank kept is a scoped ID, a type, and a commitment.

The ledger proves something was issued and is still valid — while saying nothing about who holds it or what it claims.

A shop needs to know you are old enough. It does not need to know when you were born — but that is usually what it ends up storing.

U-net turns the requirement into a question, and answers it from a credential your government already issued.

The proof is computed on the phone. What crosses is the question, the proof, and one word.

That is the whole footprint of the age check: pass, with no value attached. Everything the proof was built from stayed behind.

Ask again from another service tomorrow and the proof is different. Two shops comparing notes learn nothing.

You want to message Dara. Neither of you hands over a phone number, an email, or an account name to make that happen.

The two devices agree on a chat identity used only for this conversation, with a fresh key pair on each side.

You send a message. It is sealed before it leaves your phone; the relay is handed a blob and a destination.

The entire server-side record is an ID, two public keys, and ciphertext. Nothing in it says who is talking or what about.

Disconnect and the relationship is destroyed on both sides — your other chats carry on, unaffected and unlinked.

You decided months ago what this service may contact you about. Those rules live on your device, not in its marketing tool.

It writes an official message and seals it to your delivery key, signed so the badge cannot be faked.

It travels as an opaque blob. The push infrastructure sees a route and ciphertext — never a sender, subject, or line of text.

It opens on your phone, verified as genuinely from the service — a real notification that can't also be a tracking beacon.

Marketing sends get refused on the device. Not unsubscribed from — refused, with nothing to ignore your preference.

The same shop, built two ways: a classic account system, and the same shop on U-net. Both work fine — until one day they don't.

Somebody gets in. Not a clever attack — a leaked backup, a bad contractor, the usual.

The classic database gives up everything at once, and every field of it is reusable somewhere else.

The U-net database gives up just as much — it just isn't worth anything. A per-service string, a dead token, a public key.

One company loses its customers' lives. The other loses a list of random strings. You cannot leak what you were never given.