Make the Product Prove Itself

The NFC Mint has no user logins. Not on this site, not in our apps, and not behind the scenes. There is no account to create, so there is no password to steal, no email list to breach, and no profile of you accumulating anywhere. Where an app needs a credential, your device generates a random secret and our server keeps only its hash. A key identifies an app install, never a person.

We do not fulfill our own orders, and that is deliberate. Tags ship through our Amazon storefront, so your name and shipping address go to the fulfillment intermediary and never enter our systems. We chose a smaller attack surface over a customer list. A database we never build is a database nobody can breach, subpoena, or sell.

What we mint are bearer instruments. A tag proves that something is valid or that something happened, and whoever holds it holds the proof. Everything beyond that verdict is opt-in. A maker chooses what a public OnceMark record says. A seller chooses when a private TamperKit record is disclosed, and until then a stranger's scan shows only that the tag is genuine and activated.

We state the boundary plainly. Like nearly every web service, our servers log IP addresses and user agents on each scan, and we use them for one purpose, stopping abuse such as replayed scans and rate flooding. Those service logs are deliberately kept outside the evidence records and outside the anchored history, so they never become part of any proof and can be purged without breaking one. The record layer stores no identity at all. We exist to protect consumers from fraud, not to watch them.