Paying us for Pro does not tell us which vault is yours

Here is a real tension worth stating plainly instead of glossing over: Prevon Pro is a paid subscription, and processing a payment necessarily means a payment processor sees who is paying. That is unavoidable, and no amount of privacy architecture changes it. The actual question is whether that payment identity ever gets connected to which vault you use, what you store, or how much of it there is. If it does, all the flat-storage and no-folder design in the world would not matter — the receipt would be the folder.

The usual way subscriptions leak this

Most subscription services solve billing enforcement the direct way: an account has a plan, the plan has a quota, and the server checks "does this account's usage exceed its plan" on every request. That check requires the server to know, at the exact moment you upload something, which paying account is uploading it. It is a small, practical detail that quietly recreates the very link a zero-knowledge system is supposed to eliminate — usage and billing identity sitting right next to each other in the same request.

Proving you paid, without proving who you are

The alternative is anonymous credential technology — cryptographic proof that says "this request is authorized" without that proof being traceable back to the specific transaction that generated it. This is not a hypothetical or Prevon-only concept: it is the same category of technology that internet infrastructure providers already run in production today to let large numbers of users prove "I am allowed to do this" without ever revealing which user is asking. We are building Prevon's entitlement checks on that same foundation, rather than inventing custom cryptography from scratch — a decision made specifically because homegrown crypto is exactly where good intentions tend to go wrong.

You pay. We verify you paid. The system checking your storage entitlement is mathematically incapable of being connected back to the transaction that paid for it — even if we wanted to connect them.

Why this only works if it is designed in from the start

This has to be a foundational decision, not a feature added later, because the leak happens at the exact moment of the storage check — bolting anonymity on after the fact would mean redesigning the one place where billing and usage were always going to meet. It is also why our own FAQ is direct about the one place identity genuinely is exposed: Stripe sees your card and billing details, the same as any company you pay online. That is real, and we are not going to pretend otherwise. What it tells us is that someone with your card pays $4 a month. It does not tell us which vault is yours, what is in it, or how much you store — only your Recovery Seed can compute that, and we never have it.