Privacy Policy

This policy explains what personal data Onchain Agent Intel collects, why, who we share it with, how long we keep it, and the choices you have. We try to say what we actually do in plain language — if anything here is unclear, email [email protected].

Effective date: 2026-10-13 · Operator: Jason Sampson, doing business as Onchain Agent Intel, based in Texas, USA.

1. Who this policy covers

Onchain Agent Intel operates two sites and one API host:

• onchainagentintel.io — the public marketing site, leaderboards, blog, datasets, and docs.
• app.onchainagentintel.io — the signed-in customer portal (sign-in, subscription management, entitled data access).
• api.onchainagentintel.io — the machine-payable API for agents and developers.

This policy covers all three.

2. What we collect, why, and where it goes

2.1 When you sign in to the portal

You can sign in to app.onchainagentintel.io with any one of:

• Google. We request the openid email profile scope. From Google we receive and store: your Google account ID (sub) and your verified email address. We do not receive or store your Google password; the sign-in happens on Google's own domain.
• GitHub. We request the read:user user:email scope. From GitHub we receive and store: your GitHub user ID, your GitHub login (username), and your primary verified email address. GitHub sign-in is refused if you do not have a verified primary email.
• Email magic link. You enter your email address. We send a one-time sign-in link to that address through our email provider; the link is valid for 15 minutes and can be used once.
• Wallet sign-in (Sign-In With Ethereum / EIP-4361). You sign a plain-text message with your Ethereum wallet. We record your Ethereum/Base wallet address. No private key, seed, or signature is ever stored beyond what is needed to verify the sign-in.

When you sign in we create or update one account row keyed on your verified email or wallet address. If you sign in later with a different provider but the same verified email, we link the identities to the same account so your subscription and entitlements follow you.

Session cookies are signed with HMAC and marked HTTPOnly; they do not contain personal data beyond an opaque session ID and expiry time.

2.2 When you pay

We accept two payment channels. We do not store card numbers, CVV, or wallet private keys.

• Stripe handles all card and bank payments on app.onchainagentintel.io. Payment data is collected on Stripe's hosted checkout. From Stripe we receive and store a Stripe customer ID, a Stripe subscription ID (for recurring plans), the email address Stripe collected at checkout, the plan, status, and billing-period end date. Stripe is a PCI-DSS compliant processor; its privacy policy is at stripe.com/privacy.
• x402 (on-chain USDC or ETH) works on Base and Ethereum. When an agent calls a paid API endpoint, their wallet address and the payment transaction hash become public on the blockchain and are recorded by us alongside the API call. On-chain data is public by nature — anyone can see wallet addresses, amounts, and transactions on a block explorer.

2.3 When you email us

Mail you send to support@, sales@, or [email protected] is received by Cloudflare Email Routing, forwarded to the operator's inbox, and a parsed digest (sender, subject, body text, truncated HTML) is sent over an HMAC-signed webhook to our server so support agents can see it. Outbound replies are sent through Cloudflare's Email Sending (beta).

2.4 When you visit the marketing site

The public site (onchainagentintel.io) uses a small, cookie-less analytics beacon of our own and Cloudflare Web Analytics:

• Our own anonymous funnel beacon fires one event per page view with the page name, an optional attribution source from the URL (?ref=… or ?utm_source=…), and a coarse user-agent class (human vs crawler). The server stores one aggregate row per (event, day, source, user-agent class) — never per visitor, never with cookies, never with your IP address written to disk.
• A referer beacon runs in Cloudflare's edge middleware. When you land on a page, your HTTP Referer header, the page path, your user-agent, and the Cloudflare-provided country code are forwarded to our server. We use this only to measure which search engines and chat engines send us traffic. No cookies, no fingerprint.
• Cloudflare Web Analytics runs a cookieless beacon from static.cloudflareinsights.com. See Cloudflare's privacy policy: cloudflare.com/privacypolicy.

2.5 When you use the paid API

api.onchainagentintel.io is a machine-payable agent API. API traffic is logged by Cloudflare Tunnel and our server for operational and billing purposes. For paid calls, the on-chain payer address and transaction hash are stored with the call record so we can prove the call was paid and reconcile subscriptions.

2.6 Server logs

Our servers keep standard access logs that typically include the request IP address, the request path, the response status, and the user agent string. These logs are used to debug outages and detect abuse. Access logs are not used to profile individual visitors and are retained only as long as needed for operations and security.

3. Third parties that process your data on our behalf

• Google — sign-in (OAuth 2.0 / OpenID Connect).
• GitHub — sign-in (OAuth 2.0).
• Stripe, Inc. — payments and billing portal.
• Cloudflare, Inc. — DNS, DDoS protection, CDN, Pages hosting, Email Routing (inbound), Email Sending (outbound, beta), Tunnel, Web Analytics, and the edge middleware that runs our referer beacon.

Public-blockchain data (your wallet address, the amount, the transaction hash when you pay via x402) is written to the Base or Ethereum network. Blockchain data is public and permanent and is not controlled by us or by Cloudflare.

We do not sell your personal data. We do not share your email, name, or wallet address with advertisers or data brokers.

4. How long we keep data

• Account records (email, provider ID, wallet address) — for as long as your account exists, plus a reasonable period after closure for billing reconciliation and tax records.
• Session cookies — up to 30 days from the last sign-in, or until you sign out.
• Magic-link tokens — 15 minutes; the raw token is never persisted (only a SHA-256 hash).
• Stripe billing records — kept for as long as our account with Stripe is active, and retained by Stripe under its own policy.
• x402 payment records — kept indefinitely so paid access remains verifiable; the on-chain record is permanent regardless.
• Aggregate funnel events — kept indefinitely as a daily counter; no per-visitor rows exist to delete.
• Server access logs — retained for a short operational window and then rotated out.

5. Your choices

• Access, correction, deletion. Email [email protected] and we will respond within one US business day. We can confirm what account data we hold, update your email, close your account, or delete your account record (subject to any billing records we are required to retain).
• Cancel billing. Signed-in Pro and Dataset subscribers can cancel at any time from the Stripe billing portal, reachable from your account page.
• Opt out of analytics. Most browser-level privacy settings, content blockers, and the standard "Do Not Track" signal will block our aggregate beacon and Cloudflare's analytics beacon. We do not override them.
• On-chain data cannot be deleted. If you pay via x402, the payment is written to the public blockchain and we cannot remove it. This is a property of public blockchains, not a policy choice.

6. Security

• All sign-in flows run over HTTPS. Session cookies are HTTPOnly, Secure, and HMAC-signed.
• Magic-link tokens are stored only as SHA-256 hashes; a raw token is never written to disk after we send the email.
• Card data never touches our servers — Stripe handles it on their domain.
• Wallet private keys never touch our servers — SIWE uses a signature, not a key share.
• Account data is stored on servers we operate; routine backups are encrypted.

7. Children

This service is intended for adults and for software agents. We do not knowingly collect personal data from anyone under 13. If you believe a child's data has reached us, please email [email protected] and we will delete it.

8. International transfers

Our servers are located in the United States. Our third-party processors (Google, GitHub, Stripe, Cloudflare) operate globally and may process your data outside your country of residence. By using the service you agree to this transfer. If you are in the EEA, UK, or Switzerland and want further detail on the legal basis for a specific transfer, email [email protected].

9. Changes to this policy

We will update the effective date at the top of this page when the policy changes. Material changes will be announced on the public site and, for signed-in users, in the portal.

10. Contact

Privacy questions and all data-subject requests: [email protected]. A reply within one US business day (Monday–Friday, 9am–6pm Central Time).

See also: Terms of Service · Contact.