One profile form, hashed identity, PIN-sealed API key. Invites are personal — never a purchased list.
