Privacy Policy
2026-10-30
What we collect
- No analytics or tracking scripts and no tracking cookies.
- Two strictly necessary cookies: a form-protection (CSRF) token, and a session cookie only after you sign in. Both are HttpOnly, Secure and first-party.
- Optional accounts store a keyed hash of your email (not the address), a PBKDF2 password hash, your role, creation and last sign-in time, and hashes of session tokens. If you link a RugWard Pay merchant, we also store that API key encrypted (AES-256-GCM) plus a short hint of it; invoices are read live from RugWard Pay and not copied here. Deleting your account or unlinking removes the key. Rate-limit counters use keyed hashes of IP ranges and expire within a day.
- Cloudflare processes requests (IP address, user agent) to serve the site and enforce rate limits; we do not build profiles.
- The Payment Proof Checker sends only the txid to our server. The tx key, view key and address never leave your browser. Txids are cached in memory for about 20 seconds and are not stored.
Third parties
- Our servers (not your browser) call public Monero nodes, Kraken, then Bitfinex / CoinPaprika / CoinGecko as fallbacks (price), Exolix/ChangeNOW (rates), RugWard (live swap quote, with your IP forwarded so RugWard's per-user limits work) and NonceWard (public rig count).
Retention
- Node health checks and network snapshots (no personal data) are kept 30 days.