What is never asked for
- A seed phrase or a private key.
- A transaction signature or a token approval. Sign-in uses a message signature only.
- An email address, a name or any contact detail. There is no account other than a wallet address.
Without signing in
You can inspect any token or wallet without connecting anything. The server does not store the addresses you look up. They are held in short-lived memory caches (seconds to minutes) and are sent to the data providers listed below, because that is how they are read.
Your browser keeps a short list of recently opened addresses in local storage. It is never sent to the server, and Settings has a button to clear it.
When you sign in
The database stores, for your wallet address:
- The address itself, when the account was created and when it last signed in.
- Sign-in challenges (nonce, address, domain, expiry) for a short time, and sessions as a hash of the session cookie with the browser's user-agent string.
- Your watchlist: addresses, the address type read from the chain, and the label and note you typed.
- Your rules: target, condition, threshold, interval, baseline and checkpoint.
- Each rule's evaluation history (the most recent ones), and the alerts it produced with their evidence.
- Observations you chose to save: a fixed selection of what a scan read, with its slot and time.
The session cookie is HttpOnly, SameSite=Lax, and Secure in production, and lasts 7 days. Signing out revokes the session on the server. Every query for this data is filtered by your account, so one account cannot read another's.
Wallet addresses and their on-chain activity are public. What is private here is the fact that you are watching them, and that is the part stored under your account.
What providers receive
- The Solana RPC endpoint (the public endpoint, or the provider the operator configured) receives every address and transaction signature that is inspected or monitored.
- DexScreener and Jupiter receive token mint addresses for market data and the token index.
- The model provider (Anthropic), only when Ask Perro is configured and you use it, receives your question and the lookup results used to answer it.
These requests are made by the server. Providers see the server's network address, not your browser's. Each provider has its own terms and retention.
What is not done
- No analytics, advertising or tracking scripts are included in this software.
- No remote images or metadata files are fetched, so a token's metadata host never sees your request.
- No notification leaves the site: alerts exist only in the in-app inbox.
Logs
The application logs unexpected errors by name and a short message. It does not log provider URLs, keys, cookies or signatures. The hosting platform keeps its own request logs, which include network addresses and paths; lookups put the inspected address in the path.
Removing your data
You can delete watchlist entries and rules in the app; deleting a rule deletes its evaluation history. This version has no self-service account deletion. The operator of a deployment can remove an account and everything under it from the database.