Security & trust
What actually happens to your file, and what we can and cannot do with it.
Where your file actually lives
After upload, the file sits on our IPFS node for fast access and is written to Arweave for permanent storage. Arweave is a public network whose storage endowment is designed to pay for data for more than 200 years. Once Arweave confirms, we release the IPFS copy. Your file is reachable through public Arweave gateways, not only through us.
What we cannot do
We cannot delete a file from Arweave. We cannot edit it. If bitty.cat went away, the file and its Arweave address would still be there.
Encryption, if you want it
With a Bitty Kitty NFT (also called a Guardian Kitty in our API docs), files are encrypted in your browser before upload, using two layers — AES-256-GCM and XChaCha20-Poly1305. The key is derived from your wallet signature and the NFT's sealed secret, so we never hold it. You receive a recovery key. Lose both the wallet and the recovery key and the file cannot be decrypted by anyone.
Signing in
Wallet sign-in uses an Ed25519 challenge: you sign a message, we verify the signature. There are no passwords to leak. Anonymous uploads use a secret phrase instead; we do not store it and cannot recover it.
What is public by design
Unencrypted files on Arweave are public. Anyone with the link — or the Arweave address — can read them. Share-link expiry and view limits control our link, not the underlying Arweave copy. Encrypt anything private.
Reporting a problem
Found a vulnerability? Message @the_bitty_kitty on X or Telegram. Please do not post details publicly before we have replied. Contact us →