Privacy

The desk stores what it needs to be a desk: who you signed in as, the paper book and watchlist you built, the reports you paid for. It sets one cookie, runs no analytics and no third-party trackers, and sells nothing to anyone. Your prompts go to a model provider, because that is what makes them answers.

You are one opaque subject, and everything else is stored against it.

• Wallet sign-in: the subject is your public address. Signing proves you control it. No key, seed or personal detail is asked for or held.
• Email sign-in: the subject is a hash derived from your address, and the address itself is stored so the next code can be sent to it. Codes are stored hashed, expire, and are limited in how many times they can be tried.

Your $0CTO balance decides your rate tier. It is read from the chain when it matters and is never written into the session, so a session cannot be edited into a higher tier.

• Desk state: the paper book, watchlist, automation rules and the standing preferences you asked the desk to remember.
• Equity history: a daily value point for your paper book.
• Cage hunts: the repository scanned, what was paid, and the report. Readable only by the account that paid for it, unless you publish it.
• Published briefs and shared reports: public and unlisted. Anyone with the link can read them, which is what publishing means. A shared hunt card is redacted to the grade and finding titles; evidence, file paths and fixes are not published.
• Alerts you created and whether they have fired.
• Refund ledger: hunt, wallet, amount and settlement, kept as the record of money owed and paid.
• An operational event log: which route was called, whether it succeeded, how long it took, and the subject that called it. Error detail is redacted before it is written. Pruned after seven days.

The chain data the desk indexes — pools, swaps, balances, funding edges — is public blockchain data and is not about you.

One: octo_session. It holds your subject and an expiry, is signed so it cannot be edited, is HttpOnly so scripts cannot read it, and lasts twelve hours. It is marked Secure whenever the connection is HTTPS. There are no analytics, advertising or tracking cookies.

• Your prompts and the tool results behind them go to OpenRouter, to reach the desk model. Do not paste anything into the chat you would not send to a model provider.
• Repository contents you ask the cage to scan go to z.ai, which runs GLM-5.3. Only public GitHub repositories are read, through GitHub’s API.
• Sign-in codes go to Resend, which delivers the email.
• Market marks for ETH, BTC and HOOD are fetched from CoinGecko. That request carries no information about you.
• Token icons are fetched by this server and re-served from this origin, so displaying one does not expose your browser to the image host.

Each of those providers has its own terms and its own retention. The desk does not control them.

Desk state, hunts, briefs, alerts and the refund ledger are kept until you ask for them to be removed. The operational event log is pruned after seven days. Sign-in codes expire in minutes; sessions in twelve hours.

Ask and the operator will tell you what is stored against your subject, or delete it. Deleting removes your desk state, hunts, briefs and alerts; it cannot remove anything you published to a link that others already hold, and it cannot touch the blockchain, which is public and permanent by design.

A contact address has not been published for this deployment. Set NEXT_PUBLIC_CONTACT_EMAIL to the address that should receive questions and data requests.

See also the terms of use.