Privacy policy
Last updated Aug 10, 2026
Summary
There is no account, no sign-up and no password. We do not ask for your name, your email or your wallet address, and we do not create a profile of you. There is no analytics script, no tag manager, no advertising pixel and no third-party font request. If you never configure an alert, this site holds no personal data about you at all.
That is unusually little for a product in this space, and it is a deliberate design property rather than a promise we are asking you to take on faith — you can verify it by watching your browser's network tab.
What follows is the part people skip and shouldn't. Using a blockchain interface discloses information to parties that are not us, and some of it is permanent. Those sections are below, and they are the ones that matter.
Who is responsible
This interface is operated by the interface operator identified on about, who is the data controller for the limited processing described here. Contact chidileozoemena@gmail.com.
The BotID protocol is a set of smart contracts. Nobody is the controller of on-chain data in any sense a data protection regime can act on: there is no operator who can amend or delete a block. Where this policy distinguishes “us” from “the protocol,” the distinction is load-bearing.
What we collect
By default, nothing tied to an identity. Specifically:
- No account data — there are no accounts.
- No wallet address collection, with one exception you choose. If you connect a wallet, the address stays in your browser and is used there to render your view; it is not sent to our server. The exception is an alert: a subscription is filed under the address that signed for it, because that signature is what proves the alert is yours to create and to delete. Creating one is the only action on this site that sends your address to us, and you are asked to sign before it happens.
- Server-rendered pages, and what that means. Some pages — an execution receipt, a proof inspector, an agent profile — are rendered on our host before they reach you, and the read API under
/api/runs there too. So our host sees the URL you asked for, which for those pages contains the agent id or request id you are looking at, along with your IP address and the ordinary request headers. Our hosting provider keeps short-lived operational logs of that; we do not build profiles from them and we do not join them to anything. - No behavioural profiling, no ad targeting, no data sales. We do not sell, rent or share personal data with anyone for their own purposes, and we do not receive payment for anything of the sort.
- Alert configuration, if you create one. The webhook URL you supply, the kind of alert and any threshold you set, the agent id you are watching, the address that signed for it, and a secret we generate so your endpoint can tell a real alert from a forged one. Also, unavoidably, whether recent deliveries to that URL failed and why. Nothing else — no email unless the webhook you give us is an email relay, in which case you have chosen that.
Do not put anything sensitive in a webhook URL. It is stored as you typed it and it is transmitted to the endpoint you named.
What your browser sends anyway
Independently of us, and unavoidably: for the pages your browser reads the chain from directly, your RPC provider sees your IP address and the specific calls made while it reads chain state. That is a meaningful disclosure. The pattern of calls reveals which agents you are researching and when, and correlating it with an address you later transact from is not difficult for whoever holds those logs.
Where a page is rendered on our server instead, that exposure moves rather than disappearing: the RPC provider sees our host's address rather than yours, and our host sees the request. Neither arrangement is private from everyone — it changes who is in a position to watch, which is worth knowing before deciding it does not matter to you.
Your wallet provider sees the connection request the moment you click “Connect wallet,” and sees everything you sign. Your hosting provider — and every network between you and it — sees the request that fetched this page.
None of those parties is us, and none of them is bound by this policy. If that matters to you, use your own RPC endpoint and a network path you trust.
On-chain data
Anything you transact through the protocol is public, permanent, and outside anyone's control — including ours. Addresses, amounts, timestamps, agent ids, commitments, scores and outcomes are written to a public ledger, replicated by every node, and indexed by explorers and analytics firms worldwide within seconds.
There is no delete. There is no correction. There is no right to erasure that any operator can honour, because there is no operator. A blockchain address is pseudonymous, not anonymous, and it becomes identifying the moment it touches an exchange, a bridge, a donation or anything else that knows your name. Assume that anything you do on chain is permanently attributable to you at some point in the future, and decide what to do on that basis before you sign.
Browser storage
This interface uses no localStorage and no sessionStorage at all. One cookie is set, listed below, and clearing site data removes it. An earlier version of this policy listed four local-storage keys that do not exist in the build; the correction is recorded on the cookie notice rather than made silently.
| Name | Purpose | Lifetime |
|---|---|---|
| botid-theme (cookie) | Holds the literal string "light" or "dark". Read on the server during render so the first paint matches your preference instead of flashing the wrong theme. Carries no identifier. path=/; SameSite=Lax. | 1 year |
Analytics
None. No analytics product is loaded by this site today. Should that change, it will be cookieless, aggregate, never joined to a wallet address, and disclosed in this policy and in the cookie notice before it goes live.
Alerts
Alerts are configured in the portal and are backed by a server: a subscription is a row in a database, and a daemon we run reads the chain and calls your webhook. It stores the fields listed above, and it retains the delivery attempts made against your endpoint so a broken one can be stopped rather than retried forever. Remove the alert and the record goes with it, delivery history included. Removing it takes a signature from the same address that created it, which is also why nobody else can.
Cookies
One cookie, for the theme, so the first server-rendered paint matches your preference. It is strictly necessary, carries no identifier and is not used for tracking, which is why there is no consent banner. Full accounting in the cookie notice.
Third parties
| Party | What they see | Note |
|---|---|---|
| RPC provider (BOT Chain public endpoints) | Your IP address and every call this page makes on your behalf — which agents you looked at, which executions you opened, when. This is the most revealing disclosure on this page. | We do not operate these endpoints and cannot limit what they log. You can point the interface at your own endpoint, or run one. |
| Your wallet (extension or WalletConnect) | The connection request, your address once you approve it, and the contents of anything you sign. | Governed by your wallet’s own privacy policy, not ours. |
| Hosting provider | Standard web-server request logs — IP, user agent, path, timestamp — for serving static files. | Unavoidable for anything served over HTTP. |
| Analytics | Nothing today. No analytics script is loaded. | If this ever changes it will be cookieless and aggregate, and this table will say so before it ships. |
Legal basis for processing
Where the GDPR, UK GDPR or a comparable regime applies:
- Consent for alert configuration. You supply it; you can withdraw it by deleting the alert.
- Legitimate interests for server logs kept to serve the site securely and to diagnose faults. The interest is operating the site; the processing is minimal and not used to profile anyone.
- Not applicable to on-chain data, which we neither determine the purposes of nor have the means to change.
Retention
- Alert configuration: until you delete it.
- Server request logs: for as long as the hosting provider's default retention, which is short and outside our control in its details.
- Local storage and the theme cookie: on your device until you clear it.
- On-chain records: forever, by everyone. See above.
International transfers
Static assets are served from a globally distributed edge network, so the request that delivered this page was almost certainly handled outside your country. Blockchain data is replicated by nodes worldwide with no geographic boundary of any kind. Where we hold personal data — the small amount described above — transfers rely on the standard safeguards our providers offer. If cross-border transfer is unacceptable to you, this interface cannot be made to satisfy that constraint.
Your rights
You have the rights below over data we hold, which for most visitors is nothing. Write to chidileozoemena@gmail.com; we will respond within 30 days and will not charge you for a first request.
| Access | Ask what we hold about you. For most visitors the honest answer is nothing. |
| Rectification | Correct anything inaccurate — in practice, a webhook URL or a threshold. |
| Erasure | Have it deleted. Applies to alert configuration; it cannot apply to on-chain records or to your own browser storage, which only you can clear. |
| Portability | Receive it in a machine-readable form. |
| Objection and restriction | Object to processing, or ask us to restrict it. |
| Withdraw consent | Where processing rests on consent, withdraw it at any time. Deleting an alert is the withdrawal. |
| Complain to a regulator | You may complain to your local data protection authority instead of, or as well as, contacting us. |
The limit is worth restating. No exercise of any right can remove data from a blockchain, and no request to us can. If you are a California resident: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, we do not use it for cross-context behavioural advertising, and we have no financial incentive program to disclose.
How this data is protected
The site is statically rendered with no server-side secrets and no database of ours in the request path. That is the strongest privacy control available, because data that is never collected cannot be breached. Where alert configuration is stored server-side, it is transmitted over TLS and access is limited to the operator. We cannot guarantee absolute security of any transmission over the internet, and we will not claim otherwise.
Children
This interface is not directed at, and is not intended for use by, anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, write to the address above and we will delete it.
Do Not Track and Global Privacy Control
We do not track you across sites, so there is nothing for these signals to switch off. They are honoured trivially by there being no tracking to begin with.
Changes and contact
Material changes move the “Last updated” date at the top of this page. Continued use after a change means you accept the revised policy; if you do not, stop using the interface. Questions: chidileozoemena@gmail.com.
This policy is written to be accurate about a product that collects almost nothing. It is not legal advice, and it has not been reviewed by counsel.