ZeroSignal charges for AI by the message from an Algorand account, not an API key

ZeroSignal sells access to large AI models one message at a time, paid in dollars from a balance the user holds and nobody else can touch. Its tagline used to read 'A private place to think.¹' It now reads 'Private AI for you and your tools.²' The front page opens with an install command for a small program that runs on your own machine.

That program, not the browser chat, is what separates the service from an ordinary assistant. ZeroSignal is live on Algorand mainnet, and its public history is short enough to examine in one sitting.

The tool you already use, made private and metered

zs-proxy runs on your computer and answers on localhost:9376³. To anything that speaks OpenAI's API it looks exactly like OpenAI, so an editor's assistant, a coding agent or your own script keeps working after one environment change. It installs by Homebrew on macOS, Scoop on Windows, or a one-line script, and the macOS build is code-signed and notarized.

The API key field is a formality. The proxy ignores the Authorization header, because admission comes from your funded Algorand account rather than a static secret. Any non-empty string satisfies your client, and there is nothing to rotate, leak in a repository or attach to a billing profile. One command, zs-proxy connect, finds the tools you already have installed and rewrites their configuration to point at the proxy.

It is a single-user daemon, and the documentation⁴ is blunt about the consequence: anyone who can reach it spends your balance. Its logs carry metadata only, never prompts or replies.

A message, paid for and provable

Nothing you ask ever reaches Algorand; only the payment does. Before a request leaves, the client asks the answering operator for a signed ticket naming a maximum price. That maximum is locked in an escrow contract⁵ on the chain, the prompt travels sealed, and the operator returns a signed receipt for the tokens it used and the amount charged.

Settlement then pays the operator, sends a protocol fee to a treasury and returns whatever the reply did not use. Your client checks the receipt against the ticket first, and refuses one above the ceiling.

That arrangement is what lets a paid API run on a credential instead of a key. What you hand to the network is a funded account, not a secret a vendor stores. A tool can then use a paid service with no signup and nothing to rotate. The settlement record is public, but it carries amounts and addresses rather than a word of what was asked.

Chat, connectors, and the account

In the browser the same network backs a chat app. Replies stream, each shows what it cost, and files up to 20⁶ MB can be attached; documents are read in your browser and only their text is sent. Connectors, still in Beta, let a model read from:

• your Linear issues
• Notion pages
• files you choose in Google Drive
• a folder on this computer

They only read.

An account is a passkey. Your device creates one, unlocked by your face, fingerprint or device PIN, and the browser derives your wallet keys from it locally, so no seed sits on a server. Not every passkey manager can do the deriving part. It needs support for the WebAuthn PRF extension, which the documentation lists as 1Password, iCloud Keychain on iOS 18⁷ or macOS 15 and later, Google Password Manager, and Windows Hello.

Recovery is a 24⁸-word phrase and nothing else. There is no password reset, because nothing exists off your device to reset. Lose both the passkey and the phrase and the balance is gone, which is why the documentation suggests keeping only what you will spend on hand. That phrase also imports into an ARC-52-aware Algorand wallet such as Lute⁹, so the money is not trapped inside ZeroSignal.

What it costs to start

Funding goes in by debit card, Apple Pay, Google Pay or Cash App. Crypto from another chain or an exchange goes through the same provider. That provider takes over the screen for the purchase, and ZeroSignal says it never sees those details.

Sending ALGO or USDC from any Algorand wallet to a deposit address works too, and either lands as dollars in your balance. A new account is offered one free trial, behind a bot check, while the day's supply lasts.

Rates¹⁰ are quoted in dollars per million tokens with the protocol fee already included, and several models are listed as free. A million tokens is roughly 750,000¹¹ words.

A live network of three operators

The escrow contract's own call history runs to 47,172¹² calls from 188 distinct accounts since July, 9,471¹³ of them in the last 30 days. The operator directory¹⁴ rolls its totals up from the chain and counts tickets instead. It shows three operators running eight nodes. Of 15,630 tickets opened, 15,563 settled. The network has served about 490 million tokens and charged $467.95 over its life. A ticket is one request, and one request touches the contract more than once as its payment is opened and closed, so 47,172¹⁵ calls against 15,630 opened tickets is about three calls each. Revenue in the current UTC day stood at about 21 cents.

The pricing page calls a typical exchange 'about a third of a cent,¹⁶' and its worked example charges $0.0032 for one short glm-4.7 exchange. Across the network's lifetime, that $467.95 spread over 15,563 settled tickets averages about three cents each. Image generation and long prompts pull the average up, so the headline rate describes the cheapest case rather than the typical bill. Budget from the rate table instead.

Elsewhere the audience is thin: 60¹⁷ members in the project's Discord, and 194¹⁸ stars across the TxnLab GitHub organization¹⁹'s 34 public repositories, four of them on the proxy.

What backs the payments, and who can step in

ZeroSignal does not run the models. Independent operators run inference hardware and register on chain with a payout address, a signing key, an endpoint and optionally a name. To join, an operator locks $250²⁰ in USDC for its identity and $25²¹ more for each node after the first, held in the same escrow contract. Nearly all the USDC in that contract is this collateral: about $882 sits there, $875 of it stake across three operators and eight nodes, leaving roughly $7.49 in payments in flight.

An operator keeps its full advertised rate, and the payer covers a protocol fee on top, which the project's earnings calculator shows at 10%. A stake is not a fee, since deregistering in good standing returns it, but an operator found acting in bad faith can be evicted and part of its stake slashed. The documentation calls that an admin action rather than a permissionless sweep. The contract also carries a pause flag and stake and fee parameters that the docs say are read live from the chain and may change. Who holds that administrative authority is not stated on the project's public pages, and the administration screen opens only to a connected wallet.

Some limits remain before you fund anything. If the payer's and the operator's claims disagree, the ticket freezes into a dispute instead of paying out, and the two signatures on chain are the evidence for sorting it out. If you never acknowledge a settlement, the operator's claim can be finalized after a grace period. Either the node or anyone acting for it can post that finalization. An operator therefore gets paid for work you accepted but never confirmed.

The privacy claim, and where it stops

The privacy page²² says no single party, the company included, can both identify you and read what you asked. The split behind that claim is real. By default each request travels through a relay run by a different operator. The relay sees your IP address, but only ciphertext. The answering node reads the prompt, and sees only the relay's address. Your history stays encrypted on your device.

The limits are published alongside the claim. In standard mode the answering node decrypts your prompt to run the model, so that operator can read it, and a node forwarding to a hosted provider passes it along. A confidential mode runs the node inside hardware-attested memory, where the operator cannot read the prompt, and a client that asks for it checks that attestation before sending. Metadata is never sealed, because billing needs it: ticket ids, model names, token counts and timing stay visible.

One link sits outside that split. The documentation says the app's chain lookups go by default to a shared public Algorand node. That node sees your IP address beside the pseudonymous address you check and pay from. Each payment names that address. Pointing the app at a node you trust, including one you run, is what removes the link.

Who is behind it

ZeroSignal is built by TxnLab Inc.²³, a three-person Algorand studio we profiled in August, which says it has shipped since 2021. The same team runs NFDomains²⁴, the .algo naming registry, the Réti staking protocol, and the Haystack wallet app. Company records list TxnLab Inc. as a Delaware corporation in good standing, registered to do business in New Hampshire at the Portsmouth address its own terms give.

The service's terms date from August 13, 2026, and its privacy policy took effect on October 1. The contract is a little older than the announcement. It was created on July 6, 2026 and took its first calls the same day.

A launch post²⁵ followed on July 13 and ended 'Coming soon.' The Algorand Foundation's July report²⁶ lists ZeroSignal among the things that launched that month. Its August report²⁷ calls the service a beta.

One name collision is worth knowing about. An Algorand asset called ZeroSignal, with the unit ZERO and a one-billion-token supply held entirely by its creator, was created on July 21, 2026. Nothing on the service's pages or in its on-chain identity connects that token to the product, which sells access by the message in dollars.

What is not open to inspection

The FAQ answers the question about the client with 'Not yet,' saying the code is still changing fast and that publishing a security-critical codebase mid-churn would not help. Its open-source record link leads to the studio's GitHub organization¹⁹, where the proxy repository²⁸ holds a license, a README and a logo; the program itself ships as prebuilt binaries. The browser client and the protocol implementation are not published, so the privacy and escrow claims rest on documentation, on the network traffic a user can watch, and on what the chain shows.

Neither the project's documentation nor the studio's material points to a security audit of the escrow contract or the browser client.