01 · What we measure
Privacy is not a feeling; it is the amount of information a service can hand to a third party about you. So we measure exactly that: the data a service collects, the data it could be compelled to produce, and the data it never holds in the first place. A service earns its rank by minimising all three.
We assume a realistic adversary: a subpoena, a breach, a hostile acquirer, or an operator that changes its mind. Anything you have to trust someone not to misuse is a weakness. Anything that is structurally impossible to collect is a strength. That bias toward the impossible-to-collect runs through every number on this site.
02 · The L0–L5 identity scale
Each listing is placed on a six-step tier from L0 to L5. The tier answers a blunt question: at the moment you use the service normally, how much identity does it demand? Lower is more private, and the tier is a hard ceiling on the 0–10 score below it.
Trustless
No account required at all.
e.g. A non-custodial atomic swap you use with no account.
Anonymous
Pseudonymous access, no personal data.
e.g. A wallet or P2P market that needs only a nickname.
Discreet
Minimal data, usually just an email.
e.g. A swap that asks for a throwaway email and nothing else.
Tiered
KYC only above certain thresholds.
e.g. An exchange that stays anonymous until a daily limit.
Soft KYC
Light identity checks on signup.
e.g. A service that wants a name and phone at signup.
Mandatory
Full identity verification required.
e.g. A regulated exchange requiring a passport and selfie.
03 · The 0–10 rubric
Inside the tier ceiling, the decimal score is a weighted sum of seven factors. The weights are fixed and public so two services with the same tier can still be told apart, and so you can see exactly why one scores 8.4 and another 6.1.
Identity surface
30%How much real-world identity a service can tie to you: ID documents, selfies, phone, name, address. The single heaviest factor.
Custody model
20%Whether you hold the keys or the service holds your funds. Self-custody removes the operator as a point of seizure or failure.
Data & logging
15%IP retention, device fingerprinting, analytics, and how long metadata is kept. What is never collected cannot leak or be subpoenaed.
Payment privacy
15%Which rails are accepted. Monero and cash by mail score highest; Lightning over Tor next; transparent on-chain Bitcoin and bank fiat lowest.
Network reach
8%A working Tor or I2P endpoint, no hard dependence on JavaScript or a phone, and no blocking of VPN exits.
Source transparency
7%Open-source clients, reproducible builds, and published audits. Privacy claims you can verify beat privacy claims you must trust.
Track record
5%Operating history, incident handling, and whether past promises held. Longevity is signal; a clean decade is hard to fake.
Bars are scaled to the heaviest factor. A perfect score is reserved for services that are structurally unable to identify you, not merely unwilling to.
04 · How we test
Scores come from use, not from a spreadsheet of features. Every listing goes through the same five steps, and every re-check repeats them.
-
1
We open an account the way you would
Every listing starts with a real walkthrough from a clean browser and a Tor circuit. We record the exact point at which a service asks for something it does not need, because that point is the score.
-
2
We read the policy, not the marketing
Landing pages say "private". The privacy policy, terms, and data-retention clauses say what is actually collected and for how long. When the two disagree, the legal text wins the score.
-
3
We verify the technical claims
Non-custodial is tested, not taken on faith: we check whether keys ever leave the device, whether the .onion resolves, whether builds match published source, and whether withdrawals work without escalation.
-
4
We cross-reference the signal
User reports, audit history, court records, and on-chain behaviour are weighed against each other. One angry review is noise; a pattern of frozen withdrawals is a downgrade.
-
5
We re-check on a schedule
Listings are re-audited every 6 hours for uptime and policy drift. KYC requirements are added quietly and often; a service that was L1 last quarter can become L4 overnight.
05 · Red flags and automatic downgrades
Some findings override the rubric outright. When any of these appear, the score is cut immediately and the listing is flagged or pulled, regardless of how it scored before.
Custody masquerading as "non-custodial"
An interface that holds your keys, routes funds through an internal wallet, or can freeze a withdrawal is custodial, whatever the homepage says.
Silent KYC creep
Identity checks introduced "for amounts over X", then quietly lowered. A threshold that only ever moves down is a mandatory-KYC service on a delay.
Unverifiable privacy claims
Closed-source software making strong anonymity promises, with no audit and no reproducible build, is rated on what can be proven, not what is asserted.
Exit-scam patterns
Sudden withdrawal "maintenance", support going dark, address reuse, or liquidity draining on-chain trigger an immediate review and, usually, removal.
06 · Independence and funding
No listing is for sale. There is no paid placement, no sponsored row, and no way to buy a higher score. A service cannot pay to appear, to rank, or to be removed from a downgrade it earned.
Where a referral link exists, it never changes a score and is disclosed on the listing. If a fee would ever influence a rating, we drop the fee, not the rating. Rankings are computed from the rubric alone, the same way for every entry.
07 · Methodology changelog
The rubric evolves as services find new ways to collect data. Every change to how scores are computed is dated and kept here, so a score always traces back to a known version.
-
v2.4 May 18, 2026
Raised the weight of identity surface to 30% and split payment privacy from network reach into separate factors.
-
v2.3 Nov 2, 2025
Added reproducible-build verification to the source-transparency factor; began archiving each audited page.
-
v2.2 Apr 9, 2025
Introduced automatic downgrades for silent KYC-threshold changes detected between re-checks.
-
v2.0 Aug 21, 2024
Moved from a flat checklist to the weighted 0–10 rubric, with the L0–L5 tier as a hard ceiling.
-
v1.0 Feb 5, 2024
First public methodology: the six-tier identity scale and the no-paid-listings policy.
// found something out of date?
KYC rules change fast. If a listing is wrong, a threshold moved, or a service changed hands, tell us and we will re-audit it. Corrections from operators are welcome and held to the same evidence as everything else.
This directory is informational. Privacy is not the same as legality: know the rules in your jurisdiction before using any service listed here. We rate how little a service knows about you, not whether your use of it is lawful where you live.