Short version: we collect as little as we can. We never see private keys. If you only use the open-source SDKs, we see nothing at all.
01Open-source use
Paywall and Guard send nothing to Coinslot unless you give them a Coinslot API key. Without one, everything stays between you, your facilitator and the chain.
02What the dashboard stores
Your wallet address, used to sign in. API keys, stored as hashes.
Events your SDKs send: URLs and routes, amounts, networks, payTo addresses, policy decisions and reasons, trace ids, transaction hashes, timestamps.
Alert settings, such as an email address or a Telegram chat id, if you turn alerts on.
03What we never collect
Private keys, seed phrases or signing material.
The bodies of your API's requests and responses. Events describe payments, not payloads.
04The homepage demo
To keep the demo from being drained by bots, we rate-limit it by IP address. IPs used for this are kept only as long as the limit needs them.
05Public blockchains
Payments settle on public blockchains. Addresses, amounts and transactions there are public and permanent, and outside our control.
06Where data lives and for how long
The dashboard runs on Cloudflare. Event history is kept for your plan's retention period (7 days on Hosted Free, 90 days on Holder) and then deleted.
We don't sell data and we don't run ad trackers.
07Your choices
You can revoke API keys and delete your account from the dashboard. Deleting the account deletes its events.
Questions: open an issue at github.com/coinslot-ai/coinslot or message @coinslot_ai on X.