Privacy — what we store

What we store

• Payments. For each payment attempt: the signed authorization’s nonce, the paying wallet address, the product, the amount, the state, the settlement transaction reference, and timestamps. This is our ledger and it is kept. Attempts that failed and took no money are deleted after 30 days.
• Checks. The address of the site that was checked, the verdict and score, and the full report with the evidence it quotes from that public site. A paid report is deleted after 400 days. Free scheduled and re-check reports are deleted after 180 days once a newer check of the same host exists.
• Catalog entries. One row per host: its status, score, category, the wallet that paid for the check, and dates. Rows are kept so that a host removed or refused does not return by accident. A site owner can ask to be removed (see the last section); opt-outs are kept so the request keeps working.
• Free submissions. The host you submit and the outcome, deleted 30 days after processing. We ask for no name and no email address.
• Network addresses, briefly. When a payment is attempted, or a site is submitted, we count the attempt per hour against your network address (an IPv4 address in full, an IPv6 address by its /64 prefix) and, for payments we can verify, the paying wallet next to it. These hourly counters are deleted after 7 days. Other requests are not recorded by us in our database.
• Daily usage counters. Which endpoint or tool was used, whether the asked-about site is in the catalog, the client software name it sent (its MCP client name, or the first word of its User-Agent), and a few outcome counts. No IP address, wallet address or checked-site address is in them. Deleted after 90 days. Details are on the trust page under “What we count”.

Who else sees data

• Cloudflare hosts the service (Workers and the D1 database) and delivers every request, so it handles the traffic and keeps its own logs. Request logging is switched on for our Worker. Cloudflare’s terms govern what it does with them.
• The x402 payment facilitator (Coinbase CDP) receives the signed payment authorization you send, to verify and settle it.
• The Base blockchain is public. A settled payment, with the paying and receiving wallet addresses and the amount, is visible to anyone and cannot be removed by us. Before settling, a signed authorization may also be simulated against public Base RPC nodes (base-rpc.publicnode.com, base.drpc.org); the authorization is already public data on settlement.
• Language-model providers (Google Gemini API, Groq). A check sends the address of the public page being checked, its title, description and visible text to one of them for a content judgment. We do not send the buyer’s wallet or network address with it.
• The site being checked receives ordinary HTTP requests from our crawler, as described on our crawler page. The domain’s public registration record (RDAP) may also be queried.
• Email. The service sends operational alerts to its operator only. We do not send email to buyers or to checked sites.

We do not sell personal data and we do not run advertising or tracking scripts.

Cookies

The service sets no cookies. There are no accounts and no logins.

What this page does not cover

A report quotes content that is publicly served by the site that was checked. If that content contains personal data, it reached us because the site published it. If you own a site and want a report, a catalog entry or a profile removed, write to us (below). We do not publish anything about a check that failed.

Your requests

To ask what we hold about a wallet or a host, to have a catalog entry removed, or to opt a site out of the catalog, write to abuse@402registry.com. We can delete rows from our own database; we cannot alter the blockchain or other companies’ records.

Changes

Changes are published on this page with a new effective date.

Who runs it, and contact

Georgi Kalchev — see who runs it. Contact: abuse@402registry.com.