Privacy notice

When an agent buys a file we record:

• the payer wallet address, the transaction hash, the network, the amounts authorized and settled, the payment status and the times;
• which skill and which version were delivered, how many times the file was downloaded and when last;
• a SHA-256 hash of the redownload token. The token itself is not stored, so we cannot read it back.

A wallet address and a transaction are public on the blockchain anyway. We keep a settled payment and an active purchase without an end date: they are a financial record and they are your right to re-download. Payments that failed are deleted after 90 days, and a purchase whose delivery was uncertain after 30 days. Because of the chain, and because of the financial record, a settled payment cannot be erased on request.

For a payment that was refused we keep, for 90 days, a short technical note: the reason code, the facilitator's HTTP status, how long it took, and the first 64 characters of the User-Agent of the client. Not the signature, not the request headers, and not the IP address.

When a catalog search returns no result, we store the normalized text of the query and a counter for that day, so we can see what agents look for and do not find. No IP address and no wallet go with it, and rows are deleted after 90 days. Searches that do find something are not stored. Please do not put personal data into a search.

• Cloudflare Web Analytics is on this site. It counts page views, referrers, countries and browsers in aggregate. It does not use cookies and does not build a profile of you across sites.
• Our code sets no cookies, for tracking or for anything else. (Cloudflare, which delivers the site, may set a technical cookie for its own bot protection.)
• The light/dark choice of the theme toggle is saved in your own browser (local storage) and never sent to us.
• The fonts are served from this site, not from a third party.

The site and the API run on Cloudflare, which processes every request, including the IP address, to deliver the page and to protect against abuse. The API counts requests per IP address with Cloudflare's rate limiter so that one client cannot flood it; the address is not written to our database. Worker logs are kept by Cloudflare under its own retention rules.

• Cloudflare — hosting, the database and file storage.
• Coinbase Developer Platform (CDP) — the payment facilitator that verifies and settles the x402 payment. It receives the signed payment authorization.

We do not sell data and we do not use it for advertising.

Before the store sold files it ran skills for a fee. Records from that time may still exist: a payer wallet, and hashes of the input and output of a run (not the text itself), kept for up to 400 days. No customer text is stored any more.

You can ask what we hold about a wallet address, or ask us to delete what the law allows us to delete (see the note on financial records above).

The contact address for data requests has not been published yet.