Non-custody usually gets explained as an ethical position. We believe in self-sovereignty, your keys your coins, and so on. All true, and all somewhat beside the point.
The more useful framing is economic. Holding other people's money is a specific business with specific costs, and declining to hold it is not a smaller version of that business. It is a different one.
What custody actually costs
A custodial platform is, structurally, an insurance company that also has an app. It has taken on a liability equal to the sum of its users' balances, and everything it does afterwards is an attempt to manage that liability.
- Licensing in each jurisdiction where it holds funds, with capital requirements attached
- Insurance against theft, priced by insurers who assume theft will happen
- Key management infrastructure, meaning hardware security modules, multi-signature ceremonies and geographically split shards
- Staff with the ability to move funds, and the internal controls that exist because they have that ability
- Audit and attestation cycles proving the funds are still there
- A support organization, because when a platform can move funds, users correctly expect it to fix things
None of that is waste. Every line is a rational response to the liability. But it all scales with the amount held, and it all has to be paid for by the users whose funds created it. Custody is not a feature that comes free with the app.
The part that cannot be engineered away
A custodial platform can reduce the probability of loss. It cannot reduce it to zero, because the capability to move funds has to exist for the platform to function. Some process, somewhere, can sign.
Everything else follows from that. The insurance exists because signing is possible. The internal controls exist because staff exist who could invoke the signing. The regulation exists because history is unambiguous about what happens to entities that can move customer funds and are having a bad quarter.
The failures that made headlines were not, for the most part, failures of cryptography. They were failures of a capability being used. The capability was the precondition.
What changes when the capability is absent
nimimo's server stores three things about you: your email, your handle, and your public addresses. That is the complete inventory of what a total breach would expose.
Your wallet secret is generated in your browser and encrypted there with a key the browser will not let any page read. It is never transmitted. There is no copy on our side to protect, which means there is no copy on our side to lose, subpoena, mismanage, or quietly borrow against.
The entire apparatus above becomes unnecessary, not because we are more careful than a custodian, but because the thing it protects is not in our possession. You cannot lose what you never had.
The right question to ask any platform is not "how well do you protect my funds?" It is "what would have to go wrong for you to be able to move them?" If there is an answer, that is the risk you are accepting.
The cost that moves to you
This is the part that gets left out of most non-custodial marketing, so here it is plainly: the costs do not vanish. One of them moves to you.
There is no password reset for a wallet we cannot decrypt. If you clear your browser data with no recovery card, the funds are unreachable. Not frozen, not pending review. Unreachable. No support ticket changes that, because no one at nimimo has ever held the material that would be needed.
That is a real cost and it lands on the user. What we can do is make the recovery path cheap enough that paying it is easy: a PDF with a PIN-encrypted QR code, restorable offline, on any device, without an account. But the responsibility for having one is yours, and pretending otherwise would be the same dishonesty we are objecting to.
Why the incentives end up straighter
A custodial platform earns more as balances grow, which means its revenue is tied to how much of your money it is holding. That is not automatically sinister, but it does mean the platform's interests and yours diverge at exactly the moment you want to withdraw.
When the platform holds nothing, that divergence has nowhere to form. We are not competing with you for custody of an asset, because we do not have custody of an asset. What is left to compete on is whether the product is good. Whether the name is easy to share, whether the profile loads, whether sending works the first time.
That is a healthier thing to be judged on. It is also, not incidentally, much cheaper to run. Non-custody is not us giving something up. It is us declining to take on a liability that would have made the product worse and the incentives crooked.