# mutis

> mutis is an encrypted file drop built on Tari Ootle's privacy features (Esmeralda testnet). Your browser encrypts every file (AES-256-GCM, WebCrypto) before upload; the server stores only ciphertext and never receives a key. A file's key can travel to any Tari address sealed inside a stealth tTARI payment: the chain shows a hidden amount, a one-time owner and an encrypted memo, and only the recipient's keys open it. Anyone can leave a file for a mutis user through a dead-drop link; deliveries are sealed to the recipient's owner and view keys, so a view key sees arrivals but opens no file. Each file leaves on its rule (once, a number of opens, a set time, or until deleted) and the server deletes the ciphertext when the rule says so. Rented space is paid in tTARI; tTARI has no monetary value. Open source (MIT). Independent project, not affiliated with Tari Labs.

Sends: once a locker's testnet grant arrives (a minute or two after it opens), the browser builds and pays for the stealth payment itself and the server only passes it to the network, so the server never learns the destination; before that, and for dead-drop deliveries, the server's relay posts it and learns the address only while it is sent.
SealLog: every stored file's ciphertext hash and every exit are committed to SealLog, a template on the Ootle with no owner, at each checkpoint; anyone can check an inclusion proof against the component's state on the chain.
Payments: rented space is credited only after the official Tari library (ootle-wasm) proves the payment's exact amount and a Tari-run public indexer shows it committed.

The live limits (file sizes, expiry, opens, prices) are in the public configuration: https://srv2052606.hstgr.cloud/api/v1/config

## Docs

- [How it works](https://srv2052606.hstgr.cloud/how): the mechanism, who sees what, and what mutis can't protect you from
- [Security](https://srv2052606.hstgr.cloud/security): threat model, cryptography, logging, verifying a deployment
- [Privacy](https://srv2052606.hstgr.cloud/privacy): every table the server keeps, column by column
- [Pricing and limits](https://srv2052606.hstgr.cloud/pricing): free space, rented space in tTARI
- [FAQ](https://srv2052606.hstgr.cloud/faq)
- [Council guide](https://srv2052606.hstgr.cloud/judges): a two-track walkthrough with expected results
- [Spanish](https://srv2052606.hstgr.cloud/es/)
- [Full text of How it works and Security](https://srv2052606.hstgr.cloud/llms-full.txt)
- [Notarized releases](https://srv2052606.hstgr.cloud/releases.json): each release's manifest hash, recorded through SealLog

## API

- [API reference](https://github.com/c7b/mutis/blob/main/docs/api.md): the API only ever handles ciphertext

## Source

- [Code (MIT)](https://github.com/c7b/mutis)

## Contact

- [Report a link](https://srv2052606.hstgr.cloud/abuse)
- [Report a vulnerability](https://srv2052606.hstgr.cloud/security#disclosure)