Security

How your identity works

tbt.cafe has authentication, not accounts. Your mobile number is your identity, verified by a code. Everything else layers on top.

• Biometric — your device’s fingerprint or face. Nothing biometric ever leaves your device; we learn only that your device recognised you.
• Private code — a short code only you know. It matters because it is the one factor a stolen, unlocked phone cannot supply.
• Recovery email — lets you reset your private code, and gives us a second way to reach you.

More proof for more money

We ask for more confirmation as the amount rises — the same idea applied consistently.

• From $500: biometric confirmation.
• From $1,000: biometric, and your bank verifies the payment. That second step also moves fraud liability to your bank, which protects you.
• Collecting a payout, and changing where you get paid: biometric and your private code, at any amount. Redirecting payment is what an attacker would try first, so it is the most heavily guarded action on the platform.

Notifications that cannot be silenced

A change to your payout destination, a failed payout, and anything we flag as suspicious will always reach you. If those could be switched off, someone could redirect your money quietly.

If you are ever told your payout destination changed and it was not you, treat it as urgent and open a help request immediately.

Payments

Card details are entered inside Stripe and never reach tbt.cafe. We hold a reference, never your card number. Payments are screened for fraud, and card verification checks run on every transaction.

Your title

Your title arrives by email, shown in the message and attached as a file you can save or print. A text confirms it was sent. It names you as the holder and points at the public record — it is evidence of ownership, not the ownership itself.

The record itself

Ownership is written to Solana. The record is stored permanently on Arweave. A fingerprint of it is anchored to Bitcoin, which proves the record existed when we say it did and has not been altered since — including by us.

None of that depends on tbt.cafe continuing to exist.