Trust · transparency report

Every request we have received. The number is zero.

Zero is a real number and this is a real report, not a placeholder page waiting for content. Below it is the part most transparency pages leave out: the things we have not yet earned the right to publish.

0
Government or law-enforcement requests received, to 28 July 2026
0
Requests we have complied with
0
User records produced
0
Accounts affected — there are no accounts to affect

01 — The report

The full record, since the project began.

CategoryReceivedCompliedData produced
Subpoenas and equivalent orders for subscriber data00None
Search warrants and production orders00None
Interception or real-time collection orders00None
Preservation requests00None
Emergency disclosure requests00None
National-security process, where reportable00None
Content-removal or blocking demands00None
Requests to modify or target a build00None
Requests reaching the early-access email list00None

Reporting period: from the start of the project to 28 July 2026. Categories are listed exhaustively — including the ones we have never received — so that a future non-zero entry appears in a table whose shape did not change to accommodate it.

What a request would actually get

Worth reading alongside the zeros, because the zeros will not stay zero forever. For the messenger there is no account, no identifier, no address, no sender field, no contact list and nothing written to a disk — so an order reaching us produces essentially nothing. The one genuine record we hold is the early-access email list on this website. The full policy, category by category →

02 — What we do not do

No warrant canary. Deliberately.

A warrant canary is a statement that no secret order has been received, republished periodically, on the theory that removing it discloses something the operator was forbidden to say.

We are not running one, and the reasons are worth giving because canaries are widely treated as a mark of seriousness:

  • The legal theory has never been tested in court. It rests on a distinction between compelled silence and compelled speech that no judgment has yet confirmed.
  • Practitioners do not expect it to work. Lawyers consulted publicly by others in this field have said they expect removing a canary to carry the same consequences as an explicit disclosure — which means it is not a way out, it is the same act with extra steps.
  • An order can simply forbid triggering it. A secret order that compels silence can compel maintaining the canary, and then the signal is worse than absent: it is actively false while looking healthy.

We are not going to build a user's safety on a gesture. If we cannot say something, we will not construct an elaborate way of hinting at it — we will build the system so that there is nothing worth compelling in the first place, which is the whole design. This decision is on the list for counsel to confirm or overturn; it is currently an engineering judgment and we would like it to be a legal one.

03 — What this page will become

The entries that do not exist yet.

A transparency report from a company that has never been asked for anything is a thin document. Rather than pad it, here is exactly what is missing and what has to happen for each item to appear.

Published third-party audit resultsNot yetWe have never had one. When we do, the results are published here whatever they say — including the findings that are embarrassing, because a report that only appears when it is flattering is not a report.
A link to the source repositoryNot yetLicensed AGPL-3.0-or-later, currently private. We will not link a repository before it is genuinely published and reviewable — a dead link or a half-open mirror is worse than an honest “not yet”.
Reproducible-build instructions anyone can followPartial, internalOne component reproduces bit-for-bit, on one machine, verified by us. Nobody outside this project has reproduced anything, and the full application has never been attempted. The precise state of it →
A published build manifest and transparency logNot yetZero releases have ever been logged. This is the largest gap in the product and the one that would matter most, because it is how a targeted build aimed at one person becomes detectable.
A signed relay directoryNot yetA published, signed list of which relays are genuine — so a substituted relay at our address would be detectable rather than invisible.
Independent witnessesNot yetOther parties countersigning what our log says. Without them a log is a database with extra steps, because we could show one version of history to one person.
Infrastructure and cost disclosureNot yetWho funds this, what it costs to run, and where the money comes from. We intend to publish it; we have not, and listing it here is a commitment rather than an achievement.
04 — The stance

Designing so compulsion yields little beats promising to resist it.

The strongest transparency position is not a pledge to fight. A person can be compelled, gagged or replaced, and a pledge is only as durable as the person making it. What survives is a system with nothing worth taking.

Avano has no accounts, no phone numbers and no social graph on the server. The relay holds sealed, identical blocks under random codes, with no sender field, reached over Tor, and writes nothing to a disk. An order to “produce the records for account X” has no X to name.

That is the claim. The page that tells you which parts of it you could verify without trusting us — and the answer is currently not many — is here, and we would rather you read that one first.