Canary

The statement

As of the date above, and to the knowledge of the operator of this service, every statement below is true.

1. No National Security Letter, or any other secret or gagged demand, has been received.
2. No subpoena, warrant, court order or equivalent legal demand has been received.
3. No request has been made by any government or law enforcement body for data about a listing owner, a bidder or a reader of this board.
4. No gag order or non-disclosure directive is in force that would prevent this page from being accurate.
5. No search or seizure of this board's servers or infrastructure has taken place.
6. No backdoor, wiretap or interception capability has been installed, requested or agreed to.
7. No request has been made to hand over, copy or weaken any key used by this service, including the Monero view key.
8. No agreement exists with any party to monitor, profile or identify the people who read this board or bid on it.
9. No demand has been made to place a listing, remove a listing, or alter a rank.
10. No party has compelled the collection or retention of any data beyond what the privacy page describes.

Freshness

So that this cannot be last month's file republished, the statement was signed together with a recent Monero block, which did not exist when the previous canary was signed.

3749133 / 53634d7fe3492f5c0d6a4ea74a1f0a3baaa6407a78a7cc3c61d41495c6b53f75

Verify it yourself

A signature covers bytes, not a rendered page, so the exact text is published separately at /legal/canary.txt, and the signature beside it at /legal/canary.txt.asc. That text file is what was signed, unchanged, and this page is a reading of it. The signature is detached rather than wrapped around the text, so the bytes you verify are exactly the bytes you read.

site=https://xmrbid.lol
curl -sO $site/legal/canary.txt
curl -sO $site/legal/canary.txt.asc
gpg --verify canary.txt.asc canary.txt

It should report a good signature from the operator's key, published at https://xmrbid.lol/pgp/canary.asc. A key you fetched from this same server proves less than one you already had, so compare the fingerprint against a copy from somewhere else if this matters to you.

How to read it

• It is renewed monthly. A canary works by being republished, not by existing.
• 45 days without renewal means broken. Not probably, not maybe: that is the threshold, published in advance so it cannot be argued about afterwards.
• If it disappears, or a numbered statement quietly stops appearing, draw your own conclusion. Nobody will be able to explain it, which is the whole design.
• A missed renewal is not proof by itself. People get ill and servers fall over. What it is, is a reason to stop assuming and start asking.
• This is a transparency signal, not legal advice, and its weight in court is untested in most places.

Why this is more than words

A canary is a signal, not a defence. The actual protection is that there is almost nothing here to demand: no accounts, no email addresses, no card or payment identity, no address column in any table, and no per-visit log. An account that was never created cannot be handed over, and that is a stronger guarantee than any promise on this page. The full list of what exists is on the privacy page.

Ownership of a listing is a token we hold only as a SHA-256 hash, so a seized database cannot be used to take one over. Payments arrive at one-time Monero subaddresses with no sender attached. The wallet on this server is view-only: it can prove income and cannot move it.

What this does not cover

The clearnet site sits behind Cloudflare, which terminates TLS, keeps its own logs and answers its own orders. Nothing on this page reaches into them, and no canary of ours can speak for them. The onion service reaches the same board without passing through Cloudflare at all, which is why it exists.