Documentation
How identity works here
Your identity is controlled by encrypted private material on the browser origins you deliberately set up or pair. Ma’atara services do not keep a server-side signing-key backup.
When you begin, this browser derives a keypair and identifier, encrypts the private material at rest, and registers public genesis evidence. Pairing another browser transfers encrypted recovery material through a relay so that browser can re-derive the same identity locally. The service does not retain a plaintext or server-side signing-key backup.
What that costs, honestly
Nobody can reset it for you. There is no "forgot my key" link, because such a link would mean somebody else could take your identity. Your recovery phrase is the only way back, which is why you are asked to write it down and why it is worth doing properly.
Why signing in sends you elsewhere
The identity portal at id.maatara.io bootstraps and authorizes your identity. Browser storage is scoped to each origin, so this app cannot read private material held by the portal. A portal sign-in returns a short-lived, audience-scoped signature. Protect and Consent also need this origin to be paired because those actions sign locally here.
Which is why sealing work is different
Searching and verifying only need to know who you are, so a session is enough. Sealing your work means signing it, and a signature can only be made where the key is. That is what pairing a device is for.