Sees
- Pseudonymous ids from the wallet (PIC, pptId).
- Tokens (
addrToken) — to authorize routing, scoped, short-lived. - Opaque shipment + tracking status.
How it works
The flow
-
Checkout on any Aithne merchant
You choose anonymous shipping. Identity is never typed — it comes from your wallet's PIC (public identity credential).
-
Approve in your Aithne wallet
You approve sharing a PIC + a one-time addrToken. The consent screen tells you exactly what is shared (tokens only).
-
The merchant calls Malartu
estimateShipping→createShipment→startReturn, signed with the merchant's key. Tokens travel in request bodies only, masked, never logged. -
The postal bridge fulfils
Malartu's per-country bridge adapter hands the pseudonymous shipment to your national postal service. A routing detail is materialized once, transiently, and never stored by Malartu or the merchant.
-
Tracking flows back, opaque
Status returns to your wallet as non-personal, opaque events — no personal data in either direction.
What Malartu sees / doesn't see
Never sees, never stores, never logs
- Your name, your routing details, your contact, your payment data.
- Raw tokens — only masked renderings, hashes, and transient in-memory values.
- Any personal data in logs, errors, URLs, or analytics.
