Building for Privacy

When you build a platform centered around anonymous messaging, you face a massive contradiction: How do you guarantee absolute privacy for the sender, while protecting the receiver from harassment?

It is the hardest technical and philosophical challenge we've faced while building Chirkut.

The Data We Don't Keep

The easiest way to protect user data is to simply not collect it.

When a user submits a Chirkut, we do not require an account. We do not place tracking cookies on their browser. We do not ask for their email address or phone number. The message is stored in our database with a simple timestamp and the recipient's ID.

Once a user decides to delete their account, all messages associated with them are permanently wiped from the database. There is no soft-delete. There is no 30-day recovery period. Gone means gone.

Preventing Abuse

However, pure anonymity can unfortunately invite abuse. To protect our users, we implemented strict rate limiting and spam detection.

We use advanced, privacy-preserving heuristics to detect automated bot attacks and malicious spam without reading the semantic content of the messages. We also empower users to block IP addresses without ever actually seeing the IP address themselves—our backend handles the cryptographic hashing to ensure that a bad actor is blocked while their identity remains opaque.

Privacy isn't just about hiding who you are; it's about giving you control over what you receive. We're constantly iterating on this balance.