Identity-minimized, not invisible

• ×Email address
• ×Phone number
• ×Legal name
• ×Apple or Google login as the identity anchor
• ×Public user directory
• ×Address-book sync
• ×Ad-tracking SDKs in the security baseline

User {
  user_id      // usr_ + opaque hex (not a secret)
  status
  created_at
  handle?      // optional, globally unique
  login_name?  // compatibility
}

Sign-in uses user_id or an optional handle plus a password (Argon2id). No organization is required.

ADR-0015 — Zero-PII accounts and invite-only pseudonymous communication

Honesty before marketing: in this milestone FC21 does not claim network anonymity or cryptographic unlinkability.

• IP addresses and timing
• Device access and session binding
• Internal account linkage (user_id)
• Abuse-handling metadata on reports

In a pseudonymous direct conversation the peer sees a conversation-scoped presentation (for example a random 4-character label) — not the global handle or the user_id. That is presentation privacy at the application layer, not a cryptographic split.

People can block a participant and report a conversation. The reporter does not receive the reported account's internal ID. Internally the service keeps linkages for abuse handling — FC21 Control does not see plaintext of personal messages.

DELETE /v1/me after re-authentication: status → Deleted (tombstone), sessions and devices revoked, memberships removed, invites invalidated. Deleted accounts can no longer authenticate.