SARDENE — Privacy & Security, in Plain Language

What it is: SARDENE is a small program that runs on your own computer and donates your spare CPU power to people you choose, by mining Monero (XMR) directly to their wallet addresses. There is no company in the middle, no account, no sign-up, and the software never touches the money — the mining pool pays the recipient's wallet directly. You pick who gets your compute, how much of your CPU to use, and when it runs. Everything is controlled from a local dashboard in your browser.

Version: sardene-protocol v0.1.0 (beta) · License: AGPL-3.0-only (all source public) · Spec: WHITEPAPER.md, Bitcoin-timestamped for prior art.

The privacy features, bullet by bullet

Money privacy (Monero itself) - Donations are Monero: sender, receiver, and amount are hidden on-chain by default. This is not a setting — it is how the currency works. - There is no fee, cut, or rake anywhere in the code. 100% of what your CPU earns goes to the address you chose. The license (AGPL) makes it impossible for anyone to silently add a cut later and keep it closed-source. - The software never holds, routes, or custodies funds. It cannot steal or redirect money because it never has any.

No accounts, no tracking, no phone-home - No accounts, no emails, no registration, no analytics, no telemetry. There is no "SARDENE server" that learns anything about you. - The only network connections the software makes are: (a) to the mining pool you chose, and (b) an optional fetch of a cached mirror of the public creator directory. - Everything it stores lives in plain files in one folder on your machine (~/.sardene). Delete the folder and every trace of the app is gone.

Tor support built in - One setting routes all mining traffic through Tor (SOCKS5, e.g. 127.0.0.1:9050). Onion pool addresses are supported too. - With Tor on, the pool cannot see your IP address and your ISP cannot see that you are mining. This is built in today, not promised.

Your computer, your rules (the local security model) - The dashboard binds to 127.0.0.1 only — it is unreachable from your LAN or the internet. No open ports, nothing for anyone else to connect to. - A per-install secret token (created on first run, stored owner-readable only, chmod 600) gates every API call. Websites in your other browser tabs cannot command the dashboard: cross-site form posts are rejected by their Origin header, API calls require the token plus a JSON content-type, and the server never sends CORS headers — so a malicious page cannot forge the browser extension's calls. - The browser extension is a dumb pipe: it reads a site's self-declared address and offers it to you. It never auto-adds. Saving an address to the phonebook never starts donating; activating a recipient is a separate, deliberate click. Nothing happens without a visible confirmation. - The miner binary (xmrig) is only fetched if you opt in (install.sh --with-xmrig), and the download is verified against the pinned SHA-256 checksums from xmrig's official release before it is installed. No surprise binaries. - Identity keys and credential files are written owner-only (chmod 600) from the moment they are created.

No capture points (the discovery design) - Creators declare their own addresses on their own sites (a meta tag or a /.well-known/sardine.json file). There is no curated registry to bribe or infiltrate — the trust anchor is the creator's own HTTPS site, the same as their donation links today. - The public directory the app ships with is a mirror, not a gate: every entry carries a link to where the creator published the address themselves, so any tampering between the directory and the proof is detectable by comparing the two. - A "donate compute" button can carry the creator's wallet through install via a small starter file — but the app still shows it to you and waits for your confirm click. Referral never means automatic.

Radical transparency (by design, not by slogan) - Every part of the pipeline is visible to the user in the dashboard: which addresses you are donating to, what split, what hashrate, what the pool says you have earned, and honest projections of what your pace is worth. - A botnet hides its wallet. SARDENE prints it on the front page. Anyone can audit where their cycles go, pool-side, at any time. - The whitepaper's threat model is public, including what the design does not protect against (see below).

The honest limits — what is NOT private

We would rather you know these than discover them:

Without Tor, the pool sees your IP address and can correlate it with the wallet address you mine to. Your ISP can also see that some mining traffic exists. Turn on the Tor proxy setting and both go away.
Mining is visible on the machine itself. CPU usage, the xmrig process, heat. SARDENE is not stealth software — it is consent software. Anyone with access to the computer can see it is running, and that is a feature: nobody can hide it on a machine that isn't theirs.
Earnings sit at the pool until payout. Balances below the pool's payout threshold (0.004 XMR) are a ledger entry at the pool, not yet on-chain money. The dashboard says this plainly.
The project website's server logs are ordinary nginx logs — IP, requested path, referer, user-agent, and timestamp. Nothing exotic, but visiting or downloading anything from anywhere leaves that much.
The creator badge image is served from Sardene's servers. Each load tells us the public address and the page URL where the badge appears — used only to show creators an approximate impression count. It does not set cookies or use any other identifier. Creators can download the badge image and host it themselves to avoid this entirely.
The Kenny helpdesk chat stores your conversation and may be reviewed for QA. When you use the floating chat widget, your messages are sent to Sardene's support server so Kenny can answer. Each conversation gets a random ID and the history is kept server-side until an admin deletes it. Conversations may be reviewed to fix bad answers, catch abuse, or train the support system. No account or email is required. Do not paste seed phrases, private keys, passwords, or other secrets into the chat.
The contact form on sardene.com keeps what you send. If you use /contact.html, your name, email, subject, message, IP address, and timestamp are saved server-side so a human can reply. They are not sold or shared with third parties. Include an email only if you want a response.
"Private donations, public spending." If a project or creator wants community trust, Monero lets them publish their view key and key images so anyone can audit every incoming and outgoing payment — privacy for the donor, accountability for the recipient. That is the intended culture of the network.

How it works, end to end, in eight lines

You install it; a dashboard opens on your own machine (127.0.0.1:8377).
A short wizard asks: whose wallet(s) do you want to support, and how much CPU — light, normal, or max. Done. That is the entire simple mode.
The miner runs politely (default 50% CPU, idle priority) and rotates time between your chosen recipients so your donated hours match the percentages you set — one mining session at a time, weighted fairly.
The pool pays each recipient's wallet directly. The app never sees a cent.
Optional knobs for the technical: Tor proxy, turbo mode (smart thread count tuned to your CPU's cache, GPU opt-in), daily mining schedules, pause-on-battery for laptops, per-recipient weights, pool choice.
A systray app and browser extension are available; both are read-only helpers that act only through the token-gated local API.
Everything runs locally; uninstalling is deleting one folder.
You can verify every claim above in the source — it is AGPL, all of it.

Prepared for beta review. Questions to the dashboard's own readout are the fastest verification: it shows the pool, the addresses, and the live split at all times.