We Don't Ask for Your Email. Here's Why That's Harder Than It Sounds.

Every signup form we’ve ever filled out asks for an email address first. It’s so standard that most people don’t question it — of course a service needs your email, how else would you log in, get your password reset, receive receipts?

We don’t ask for one. Not “we ask but don’t require it” — we don’t have a field for it. And getting there was more work than just deleting a form input.

The easy 90% and the hard 10%

Removing the email field from a signup page takes five minutes. The actual problem is everything email quietly does behind the scenes that nobody thinks about until it’s gone:

Password reset, for one. The standard flow is “click forgot password, we email you a reset link.” No email means no reset link. We had to design around that from day one, which is why every account gets ten recovery codes at signup — generated once, shown once, yours to store somewhere safe. Lose your password and your codes, and we genuinely cannot get you back into your account. That’s not a limitation we’re working around. It’s the actual tradeoff of not collecting the one piece of data that would let us “help.”

Account recovery support tickets, for two. A support team’s first move when someone’s locked out is usually “what email is this account under?” We can’t do that lookup, because there’s no account-to-identity mapping to look up. Our support flow had to be rebuilt around recovery codes as the only recovery path, full stop.

Fraud and abuse signals, for three. A lot of anti-abuse tooling assumes an email address as an anchor point — rate limiting by domain, flagging disposable-email signups, that kind of thing. We had to find other signals that don’t require knowing who someone is.

Why we didn’t just make it optional

The tempting middle ground is “ask for email, but don’t require it” — get the convenience for people who want it, skip it for people who don’t. We considered this and rejected it, because an optional field that most people fill in anyway doesn’t actually change your risk profile. If 80% of accounts have an email on file, then the database breach that matters is still a database full of emails. The only way to make “we don’t have your email” actually true is to never collect it from anyone.

What you get instead

At signup, your browser generates a cryptographic commitment from your username and password using PBKDF2 with 100,000+ iterations. That commitment — not your password, not your email, nothing that identifies you — is what we store. Logging in proves you know the original password without ever transmitting it. It’s the same trust model as a zero-knowledge proof: we can verify you’re you without ever learning who you are.

It’s a harder system to build support tooling around. We think it’s the right tradeoff anyway.