Privacy Policy

The short version

• Your agent wallet's private key is created and kept on your own machine, encrypted, with its key in your operating system's keychain. We never receive it, and we never ask for your main wallet's key.
• Card payments are handled by Stripe. We never see your full card number.
• USDC payments happen on the public Base blockchain. They are visible to anyone and can't be changed or deleted.
• Website analytics run only after you accept cookies, and never if your browser sends Global Privacy Control.
• We don't sell personal information.

What we collect

Account information

When you sign up we collect your email address and a password. Our identity service stores the password only as a hash, and keeps whether your email is confirmed (we email you a link to confirm it). Your CryptoCadet account has an API key that the CLI and the dashboard use to act for you. The CryptoCadet server stores it only as a hash; our identity service keeps a copy so the website and the CLI can sign you in with your email and password. We also keep your account name, which is your email address for accounts created on cryptocadet.app and is never shown to other users, and your public handle if you choose one.

The CLI and your wallets

The CLI creates your agent wallet on your computer. Its private key is encrypted on your disk, with the decryption key in your operating system's keychain, and it is never sent to us. Your spending policy also stays on your machine. If you run cryptocadet dashboard:sync, the CLI sends us a read-only copy of your policy and your agent wallet's balances so the dashboard can show them. The CLI sends no analytics or telemetry.

We store the public payout wallet address you set, and for each agent token you create, its name, its caps, the sellers it may buy from, when it was last used, and a hash of the token (never the token itself). The CLI keeps the token in your keychain.

What sellers publish

If you sell, we store your catalog: item names, descriptions, prices, URLs, visibility, the content of hosted items, the origin URL of proxy items, and the email addresses you share private items with. We also store the secret we sign forwarded requests with.

Payments, credits and payouts

Card top-ups are processed by Stripe. We send Stripe your account email and an internal account reference to set up the checkout, and we receive and keep the checkout session ID, the amount and whether it was paid. We never see or store your card number.

We keep a ledger of each account's credits and earnings: top-ups, spends, refunds, seller earnings, fees and payouts. For USDC payments we keep the quote (seller address, token, amount) and the transaction hash. For payouts we keep the destination address, the amount, the status and the transaction hash.

Gateway usage

For each paid access to an item we record the seller, the buyer account and agent token (for card-credit payments), the item, how it was paid, the amount and fee, a buyer label, and the time. Free reads are not stored.

For proxy items, the gateway forwards your request, including its body and headers (without cookies or payment headers), to the seller's own server, and passes back the answer. It does not store the request or the response. What the seller's server does with it is up to the seller.

Like most web services, our servers keep standard request logs, including IP address, time and the requested URL, for security and troubleshooting.

Forms and sign-ups

When you use the "Get product updates" or "Talk to us" forms on cryptocadet.io, we collect your email address and anything else you enter (name, company, message), the page you were on, any referral code and campaign (UTM) parameters, the anonymous analytics ID if you accepted cookies, your country as reported by our hosting provider, and your IP address, which is kept as a record of your consent. When you sign up on cryptocadet.app, we record your email, your user ID, your IP address, the page, any referral code and campaign parameters, and the anonymous analytics ID if you have one.

Emails you send us

If you contact us, we keep the message and your email address so we can reply.

Blockchain transactions

USDC payments and seller payouts are made on the Base network. Blockchain transactions are public and permanent. Anyone can see the wallet addresses, amounts and times involved, and neither we nor anyone else can change or delete them. If you don't want this activity linked to an address you use elsewhere, use a separate wallet.

The CLI reads balances and sends transactions through a Base network RPC provider (by default, mainnet.base.org). That provider receives your agent wallet address and your IP address under its own terms.

How we use information

• To run the Services: serve and forward paid requests, charge credits, verify payments and pay sellers.
• To manage your account and sign-in, and to provide support.
• To keep the Services secure, prevent abuse and fix errors.
• To send service emails: email confirmation, top-up receipts and low-balance warnings to buyers, and sale and payout notices to sellers.
• To understand which pages of our website are useful, if you accept analytics cookies.
• To credit the partner who referred you, if you arrived through a referral link.
• To send product updates, only if you ticked the box asking for them.
• To meet legal, tax and accounting obligations.

Who we share it with

We don't sell or rent personal information. We share it only with:

• Infrastructure providers: DigitalOcean (servers and databases), Vercel (website hosting) and MXroute (sending email).
• Stripe, to process card payments.
• Koryo, Ascendant Finance's own CRM and analytics tool. It receives the analytics described below, and the form submissions and sign-ups described above, which become leads in it. We use it to manage customer relationships.
• HyypeFi, our referral partner platform. If you arrived through a referral link, we report a referred sign-up to HyypeFi with the referral code, your account ID and the time, so the referrer is credited. If you accept analytics cookies, our analytics script may also send HyypeFi the same website events it sends Koryo.
• SubZero, our incident tracker. When something fails on our servers, it receives an error report, which can include the request route and error details.
• Sellers you buy from. When you pay with card credits, the seller sees a buyer label made of your agent token's name, plus your public handle if you have set one, in their dashboard and sale emails, and it is sent to their server with your request. We do not show them your email address. A seller you buy a private item from already knows your email, because they shared it with you. USDC payments are labelled with the transaction hash instead.
• Anyone who requests a seller's item. The 402 response for an item shows the item's name, description and price, and the seller's public handle and payout address. It never includes the seller's email address.
• Authorities, when the law requires it, or to protect the rights and safety of our users and the public.
• A buyer or successor, if our business is reorganized or sold. This policy would continue to apply to your information.

Cookies and analytics

Our websites use Koryo, our own first-party analytics, through its script (t.js). It records nothing and sets no analytics cookies until you click Accept in the cookie banner. With your consent it records pages viewed (with the page title, the referring site and any campaign parameters), scroll depth, time on page, which sections of a page you saw, clicks on key buttons, and the domains of links you follow off the site. Koryo stores your device type and country with these events, not your IP address. If you later submit a form or sign up, your earlier visits are linked to your email.

If your browser sends a Global Privacy Control signal, we don't track you and we don't ask. You can withdraw consent at any time from Cookie settings at the bottom of any page; withdrawing deletes the analytics cookies.

The analytics script keeps the same values in your browser's local storage. These cookies are shared between cryptocadet.io and its subdomains, and separately between cryptocadet.app and its subdomains. Signing in to the dashboard on cryptocadet.app also sets a session cookie, which is needed for the dashboard to work.

Email

We send service emails about your account and your money, such as receipts, low-balance warnings, sales and payouts. We send product updates only if you ticked the box asking for them, and every one has a way to unsubscribe.

How long we keep it

We keep account information, catalog items and agent tokens while your account is active. Payment, credits, charge and payout records are kept for as long as tax and accounting law requires. Analytics cookies expire as listed above. Blockchain records can't be deleted by anyone.

Your choices and rights

• Pay from your own wallet instead of card credits, or the reverse.
• Revoke agent tokens, and change or remove items, at any time.
• Keep your agent wallet and policy entirely on your machine; syncing them to the dashboard is optional.
• Unsubscribe from product updates using the link in any of them.
• Accept or refuse analytics cookies, and change your choice at any time.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent. We don't sell or "share" personal information for cross-context behavioral advertising, as California law defines it. To delete your account or to use any of these rights, email hello@cryptocadet.app. We'll verify the request comes from you and reply within 30 days. You can also complain to your local data protection authority.

Security

Your agent wallet key never leaves your device. Passwords are stored only as hashes, the CryptoCadet server stores API keys and agent tokens only as hashes, and connections to our Services use TLS. No system is perfectly secure, so keep your password, agent tokens and wallets safe. Only keep a small working balance in your agent wallet. If you lose access to your agent wallet's key, we can't recover it or the funds in it.

International transfers

We and our providers may process information in the United States and other countries. Wherever it is processed, we protect it as this policy describes.

Children

The Services are not meant for anyone under 16, and we don't knowingly collect their personal information. If you think a child has given us information, contact us and we'll delete it.

Changes

If we change this policy we'll update the effective date above. If a change is significant, we'll also tell account holders by email before it takes effect.

Contact

Questions or requests: hello@cryptocadet.app