privacy

BAG CHECK scores a wallet, not a person.

Public data may be analyzed. Publishing, ranking, indexing or preserving it is a different question — and the answer is: not without the owner. Three separate things: checking a wallet (paste-only, no connection), claiming it (not live; will be an optional signature proving control, never consent to display), and publishing it (not live; a separate, explicit choice).

What we read

Only public Robinhood Chain data for the address you paste: balances, transfers, transaction counts, and public market prices. We never see, request, or store private keys, seed phrases, signatures, or any wallet session. There is nothing to connect.

What we store

• A per-wallet snapshot of the computed result, kept until it is erased. It holds the address, the Bag Aura, the archetype, the verdict, the badges, the composition rows, the confidence and the block height of the FIRST check of that address. It is written on every completed check, with no proof that you own the wallet — pasting an address is enough to create one. There is no “Keep my Block Tag” switch guarding this today: the record is the product, and the control over it is erasure.
• A short-lived copy of the same result, keyed to the UTC day, so a re-check on the same day does not re-read the chain. It expires at the end of that day.
• The share link: a random opaque id and the account it points at, in both directions. That is what lets a card someone already posted keep working. The id is never derived from the address, so nobody can go from a wallet to its link — only from a link that was deliberately shared back to the card.
• Anonymous daily event counts: how many bags were checked, how many cards viewed, and which of six share sources a visit arrived from. No row pairs an event with an address.
• Aggregate page views, measured by Cloudflare Web Analytics. It is cookieless and does not fingerprint: it counts that a page was viewed, not who viewed it, and it is never joined to an address, a result or a share link. It is the only third party that sees anything about a visit, and it sees a page view.
• A rate-limit bucket, so a flood of requests cannot run the whole site's data budget or delete other people's records. What is stored is a salted, day-scoped, truncated digest of your connection's IP — deliberately short enough that unrelated people share a bucket — plus a count, and the row expires within minutes. The digest is never stored beside a wallet address and there is no parameter that could put the two together, so it can never answer "who looked at this wallet". Tomorrow's buckets cannot be lined up against today's.
• What is NOT stored: no private keys, seed phrases, signatures or wallet sessions — there is nothing to connect. No IP addresses: the rate limiter reads the one your connection arrives with and never writes it down. No per-user event log. No referral, cosmetic or Mystery Bag record: those features are switched off and their endpoints refuse.

What shows in public

• A result lives at an opaque link (/b/…) that does not contain the wallet address; the card shows a shortened form only. It is private by default: not indexed, never listed in any directory, board or ranking, no public per-address JSON. Holdings and exact figures show only in the browser that pasted the address.
• The result page and share card show a shortened address, the score, archetype, badges and verdict — never exact balances, quantities or total value. Holdings appear as allocation percentages and coarse size bands.
• Homepage and BAG CHECK FRIDAY numbers are aggregates (counts by archetype and class). No row on any public surface pairs back to a wallet. Community reports are aggregates over a sample and never name a wallet.
• Our own test: could someone use BAG CHECK at scale as an easier deanonymization or ranking database than the blockchain itself? If the answer ever becomes yes, we redesign.

On your device only

The homepage can show the last few addresses this browser checked, so you can re-check with one tap. That list lives in your browser’s local storage and is never sent to us; “forget” clears it.

Cookies

One first-party cookie, `bc_src`, remembers which of six share sources brought you here (a post, a forward, a link in a chat) for 30 days, so we can tell whether sharing actually brings anyone back. It holds one of six short codes and nothing about you. There is no referral cookie: referrals are not live. No third-party analytics, no ad pixels, no fingerprinting.

Retention and removal

The per-wallet snapshot has no expiry: it persists until it is erased. The day copy expires at the end of its UTC day. The share-link mapping persists so an already-posted card keeps working. Erasure is self-serve and needs no proof of ownership, because a record that was created without proof should be removable without it: POST /api/erase with an address and its snapshot is deleted. “What changed since last time” lives in your browser, not on our servers. Shared card images can persist in caches for up to 24 hours after erasure — the picture travels further than the record, and that is the one part of it we cannot reach.