Privacy notice

Nothing. There is no account to register, no sign-up, no name, no email address, no phone number and no identity document. We do not verify who you are and cannot.

We run no advertising network and no third-party analytics, and set no cookie for either purpose.

Your secret, the Notes it controls, your payees, your spending rules and your interface settings are held in your browser’s local storage on your own machine. They are never transmitted to us.

Clearing that storage without a backup destroys them, and nobody can restore them. See the storage notice for what is kept and how to remove it.

The chain-data proxy. Your browser reads the chain through this site rather than directly, so the operator’s data-provider key stays off the page. That proxy receives your IP address, the time of each request, and which contract reads you are making. It forwards only read requests; it never sees a private key and cannot sign anything.

A clearing service. When you ask one to submit a Draft it receives your IP address, the time, and the size of the request, before that Draft reaches the public network. This is the sharpest link anyone can draw between a network identity and private activity, and it is the reason to care which service you use. It cannot read the Draft’s payer, payee or amount.

An index, if you use a light wallet. A light wallet sends a detection key so the index can return the ledger entries likely to be yours. That key lets the holder recognise which entries are probably yours, permanently and for every entry past and future. It cannot decrypt any of them, because encryption uses a different key. A full wallet sends nothing and scans for itself.

Ordinary server logs may record IP addresses, timestamps, request paths and user agents, as they would for any website.

If this deployment sits behind a content delivery network or a reverse proxy, that operator terminates the encrypted connection and sees the same traffic as the servers above.

The data provider the proxy reads through sees the requests forwarded to it, attributed to the operator rather than to you.

Nothing here anonymises your connection. If you need that, use your own network protections.

Everything written to the chain is public, copied by anyone who runs a node, and permanent. Deposits with their amount and paying address, cash-outs in fixed denominations, credit draws, and the fact that a Draft cleared are all on it.

Neither we nor you can delete, amend or recall any of it. No right to erasure can be exercised against a public blockchain, by anybody.

The data described in section 3 is processed to deliver the service you asked for, to keep it working, and to protect it from abuse. We do not sell it, and we do not use it to build a profile of you.

Because we hold no account and no identifier you supplied, we generally cannot connect a request to a person, and we cannot answer a request to access, correct or delete personal data by matching it to an account we do not have.

Server logs are kept only as long as they are useful for operating and securing the service. Nothing in them is used for any other purpose.

The Interface is not for anyone below the age at which they can enter a binding contract where they live, and we do not knowingly process their data.

Write to [email protected].

There is no company acting as a controller of your data and no data protection officer, because there is no company. Whoever runs this particular deployment holds the server logs described in section 3, and the address above is how you reach them.