When we say "end to end" for GCCR, we mean the conversation path: your key-up leaves your device, crosses our coordination layer, and lands in listeners' ears without us building a dossier along the way. That is not the same as encrypted messenger E2E — the server must move live audio and whispers to make CB radio work. What we can control is policy: a blind relay that doesn't ask who you really are, doesn't hoard what you said, and doesn't run a parallel analytics business on your behavior.
Identity on the channel is a nickname and a device fingerprint — enough to keep blocks, bans, and prefs consistent when you reconnect, not enough to be a government ID or a marketing profile. We don't collect your real name, home address, email, phone, contacts, or GPS for account identity. There is no signup form because there is nothing we want to know about you before you key up.
The application server is designed as a don't-ask-don't-tell relay. Voice channels are not maintained as a standing archive — audio is forwarded for live delivery, not cataloged as a podcast library. Whispers and private media exist only long enough to reach an offline recipient or expire; TTL buffers, then deletion. Leaderboards, chips, and prefs are game state — not a transcript of your life. We don't run our own product-analytics stack (no Google Analytics layer profiling how you tap buttons).
On routing metadata: the GCCR application server does not store or use client IP addresses for routing, bans, analytics, or logs. Hosts, CDNs, tunnels, and mobile networks upstream may still see connection metadata to deliver packets — that's physics, not our product choice — but we don't fold IP into identity graphs or "helpful" cluster tracking inside the app layer. Legacy IP-cluster experiments were ripped out and quarantined from backups on purpose.
Moderation follows the same philosophy: surgical capability restrictions on a fingerprint (mute TX, mute RX, hide visuals) rather than "we read everything and score your soul." Serious safety bans exist for underage use and CSAM — we're not pretending the service is lawless — but we are not building a content-surveillance machine for everything else. Where we can push work to the edge, we do: on-device NSFW and OCR gates on Feed uploads mean questionable images are screened in the browser before they hit shared infrastructure.
The result is a weird hybrid that fits CB culture: live, anonymous, keyed speech through professional-grade audio processing on the client, coordinated by a server that would rather be dumb pipe than data broker. Operators get reliability. Hobbyists get chaos. Neither group has to trust us with their real identity to get on air. That's the infrastructure bet — not "we see all," but "we move traffic and forget."