In the explainer, we suggest a roughly 24 hour delay period before allowing decryption of tokens. Our thought was this makes it harder to tie revealed IP addresses back to short-lived incognito sessions, and might be reasonable for web developers to run daily processes, particularly for folks that may be doing manual testing in the near term.

However, we are open to feedback and would love to hear about your use case(s) and concerns.