Apify channel (2026-10-26): official limited-permission Actor runs can call the same screening, Listing Guard and Stablecoin Books engines through a live run/build and one-use request-digest check. SpendPreflight stores no run IDs, input addresses, request bodies or results for this channel. No owner Apify or Infura credential is embedded in Actor source. Existing Guard host-pacing and CDP observation records retain their already disclosed bounds; raw request bodies and flagged metadata text are not retained. Books uses the existing Infura transport/signing inside the Worker, with no credential copied to Apify. Actor INPUT is removed from its default run store after reading. Apify independently retains user-owned datasets/results, run metadata and any saved tasks under its own retention policy; do not submit private data or assume platform-wide zero retention.
Listing Guard disclosure (2026-10-22): caller-submitted public URL and method are sent to Coinbase CDP validate for an unpaid live technical check; our own public GET obeys DNS/robots/pacing. No payment, credentials or request body is sent to the target. Returned metadata is screened in memory and discarded, not logged or stored. Paid results include untrusted flagged spans and rewrite guidance. Free Lint stores only the derived risk score with its existing seven-day report. Subscriber daily guard state stores last attempt, last successful check, index-active status and risk score; alert metadata contains only those derived values, never endpoint bodies or flagged spans. Guard state is removed 30 days after monitoring expires. CDP is an external processor; do not submit private URLs.
SpendPreflight: Privacy (v22, 2026-10-26) Stablecoin Books: transaction hashes, address/date/amount filters and native Base USDC logs are processed transiently through the operator-configured Infura RPC (whose own privacy/retention policy applies). Request bodies, receipts, statements, signatures, queried addresses and transaction hashes are not retained by this service. Only the existing public chain ID (60s) and latest block metadata (5s) are cached; per-request chain reads are discarded at completion. Books paid usage stores only daily tool/count/revenue totals (400 days), not paying-wallet identifiers, settlement transaction hashes or first-payer records, and grants no IP-based trials. Fixed aggregate acquisition categories use existing retention. The printable HTML/JSON/CSV lives only in the response and your browser when you choose to save it; no public receipt URL, browser storage or analytics is added. Public verification processes the supplied envelope in memory and does not query the chain.
Outreach funnel: daily aggregate counters retain only the UTC day, a fixed batch bucket (o1 through o52, gha, operator, or unattributed), a fixed stage and count for up to 90 days. Stages cover seller-page load signals, first form input per page render, HTTP Lint starts/completed reports, valid registration submissions, saved registrations, SMTP-accepted confirmation requests, successful email confirmations, confirmed active founding periods and granted free periods. Confirmation links carry only an allowlisted ref bucket alongside the private one-use confirmation token; the token is never stored in this measurement dataset. Confirmation and active counters begin October26 with a partial rollout day; no older values are backfilled. Active here means a confirmation event during an unexpired free period, not a paid subscriber or a live account inventory. Arbitrary ref values are discarded. No funnel IPs, emails, seller IDs, URLs, cookies, session identifiers, request bodies or linked individual journeys are stored. Ref labels and page-load signals are spoofable; reloads and bots can inflate counts. The GitHub Action uses the fixed gha bucket with the same day/stage/count fields and retention. Public SVG badges read existing seven-day reports without new endpoint probes or stored view events. Action summaries and optional repository PR comments contain derived scores, finding codes and public report links, not submitted URL values or raw response bodies. No retrospective attribution is inferred. No funnel cookie or browser storage is used; a batch ref travels in links and request query parameters only.
Public Action adoption: a bounded daily GitHub API observation checks public workflow references and non-skipped default-named Action steps. Only dated aggregate public-repository/run counts, freshness and sampling limits are retained in the public cache, which expires after 48 hours. Repository names, owners, workflow source, run IDs and job metadata are processed transiently and not retained or published by this metric. Private repositories, own/operator repositories and forks are excluded. Custom names and incomplete searches can undercount. This lower bound is not an installation count; ref=gha remains a separate spoofable activity label with the existing 90-day aggregate retention.
The public Bazaar tracker retains derived, hashed public-catalog status observations and aggregate listing/host wording counts and listing prevalence for up to 90 days. It samples at most 1,000 cached public descriptions (first 2,000 characters); it does not publish seller names, URLs, descriptions or private Lint submissions. Wording counts below five distinct hosts are withheld. Unknown status is not removal, and no cause is inferred.
FillPoint station proximity and solar sizing: query coordinates and load/battery assumptions are used only in memory against a bundled historical public snapshot or mathematical calculator. They are not stored or sent to mapping/weather services. Fixed find_rv_stations/size_solar analytics labels contain no coordinates or loads. The public ODbL station projection contains no caller data.
Base contract signals: the submitted public address and fixed read-only methods are sent to https://mainnet.base.org or the operator-configured Infura or Alchemy Base RPC. We do not send caller identity, payment credentials or arbitrary calldata to that RPC. Only public chain ID (60 seconds) and the latest block hash/height/time (5 seconds) are cached in Worker memory. Submitted addresses, contract bytecode, calldata and other RPC responses are not cached or stored. Rate-limit backoff lasts at most five minutes per Worker instance and returns unavailable without delivering a paid result. Results include block provenance and OFAC freshness. Deep checks also send the public contract address to https://sourcify.dev for public verification facts and observed runtime bytecode, without caller identity, cookies, headers or payment credentials. We compare bytecode in memory and retain no address, source files or provider response bodies. Fixed check_token analytics labels contain no address.
What we receive: the inputs you send (domains, wallet addresses, names, 402 challenges, rules). What we store: we do not retain raw caller request bodies. The domain-signal cache stores public registration dates and registrar names for up to 24 hours, under a hash of the registrable domain, to avoid repeating RDAP lookups. The domain may originate from a request; names, wallets, challenges and rules are not stored in this cache. Failed RDAP requests are not cached. To enforce the free trial we store a counter keyed by the caller's IP address and the UTC date, deleted automatically after 48 hours. Traffic measurement: where enabled, HTTP 402 responses and granted trials produce a coarse event containing the fixed route category, event type, HTTP status, and fixed client/referrer categories. Parsed MCP initialize, tools/list and tools/call requests also produce fixed-category events, at most one per stage per HTTP request. These count attempts, not successful tools or unique users. We also store fixed allowlisted tool categories, coarse execution outcomes (result returned, tool error, payment required, execution error or not observed), and a fixed guidance revision for aggregate comparison. Client-family hints distinguish claimed directory/monitor/crawler UAs from claimed Claude, Cursor, Cline and OpenAI clients; generic runtimes remain unclassified. Raw or arbitrary tool names are never retained. We do not store arguments, request IDs, session IDs or repeat-caller identifiers in this dataset. A returned result does not establish payment, approval or a successful customer conversion. We never retain raw user-agent or referrer strings, URL paths/queries, IPs, or request bodies in this dataset. Cloudflare Analytics Engine retains these events for three months; reports aggregate counts. Client/referrer labels are self-reported hints, not verified agent identities or unique customer counts. x402 Lint (free, where enabled): at your request we make a bounded unpaid GET to a public HTTPS endpoint, respecting robots and host pacing. No credentials, payments or POST bodies are sent. We retain a public derived report: URL origin/path (query values omitted), observation time, status, latency, parsed public payment fields and fixed diagnostics. Anyone with its random link can view it for seven days. Expired reports are inaccessible and deleted on the next lint run. Raw request and response bodies/headers are discarded. Submit only public URLs without sensitive path data. Shared host DNS/robots/pacing state enforces safe requests. Daily admitted/completed counts are retained for aggregate reporting; no caller identifiers are included. A fixed-key approximate 10/minute location limiter and atomic 200/day service limit are separate from trials and Scout. Free cached lookup preview (where enabled): the supplied public resource URL is used only to read existing public index observations. It is not added to the crawler or stored as a caller lookup record. HTTP and MCP previews share a fixed-key, approximate 30-per-minute Cloudflare-location rate limit; the limiter receives no caller IP, identity or URL. It is separate from the three-call paid-tool trial. Events may be sampled or missing during outages; HTTP-200 MCP payment-required results are not HTTP-402 events. Logs: our host (Cloudflare) keeps standard operational logs (IP, path, status, timing) under its own policies; we use them only for reliability and abuse prevention. Payments: x402 payments settle on a public blockchain (Base). Payer wallet addresses and amounts are public by nature of the chain. We keep daily payment/trial totals, per-tool counts, public payer addresses and the last transaction hash for up to 400 days; public first-seen payer markers are retained for customer-count notifications. Our own test-wallet payments are counted separately and excluded from outside-customer revenue. These records do not include screened names, merchant wallets or challenges. Endpoint Health Index: we observe only publicly listed x402 resource URLs from Coinbase Bazaar and x402scan, using unpaid GET requests. We store public listing URL/method/category, HTTP status, TLS verification, latency, parsed payment-challenge fields (network, asset, price, payTo), public domain registration dates and OFAC payee matches. Raw response bodies, cookies, signatures, request bodies and caller-supplied URLs are not retained by the index. Observations cover seven days (up to 28 per resource) in the current rolling history; public RDAP registration metadata is reused for up to seven days. Refreshed snapshots discard expired observations and discovery metadata. Saved cloud snapshots expire after 48 hours without a refresh, so a stopped job may retain older public observations for up to nine days. Local development snapshots may be retained for troubleshooting. Crawler pacing state is pruned one day after the last request or server-requested backoff on the next refresh. Only these public resource observations and their aggregates may appear in the index. A robots exclusion remains unknown, not a negative trust signal. Contact us to correct or remove a listing. Crawler information: https://spendpreflight.com/bot Scout: our D1 search index retains only public Bazaar resource URLs, service names, descriptions, tags, advertised method and payment terms, public 30-day aggregate call/payer counts, last-called and listing timestamps, the latest unsigned 402 probe fields/latency/time, OFAC/domain risk flags and score. Scout uses the listed GET or POST method; POST sends only an empty JSON object. No payment, credentials, wallet signatures, caller bodies, caller search text or raw endpoint response bodies are stored by Scout. Listings disappear after 30 days without rediscovery; bounded daily cleanup removes expired records. Public DNS resolutions are cached for ten minutes. Host pacing and robots directives are stored to enforce exclusions and ten-second minimum spacing. On-demand verification is restricted to already-publicly-listed resources. A live 402 is not proof of paid delivery, identity or safety. Unknown assets have no inferred USD price. Observations older than 24 hours are excluded from default verified search. Contact us for corrections or removal. Weekly Ecosystem Health snapshots publish aggregate public-catalog observation counts and at most ten public endpoint/hostname latency examples with timestamps. Query values and private seller/Lint submissions are excluded. Dated aggregate snapshots may be retained in version history for reproducibility; they are not continuous uptime or paid-delivery records. Contact us for corrections or removal of an example. Verified Seller monitoring (opt-in): we store optional contact email, public resource URL and observed payTo, optional HTTPS webhook URL, a one-way management-token hash, x402 settlement transaction identifiers, subscription expiry and monitoring state. Raw registration bodies and payment credentials are not retained. Public records and badges expose only endpoint/payee, monitoring status, probe summary and timestamp; never email, webhook, management credentials. The first ten eligible Basic founding registrations can receive 14 days free, with no wallet or payment. We retain an opaque grant ID, timestamps and one-way hashes of the endpoint and public payment recipient to enforce the lifetime offer cap and prevent duplicate claims. These minimal grant records persist after the free period; they contain no email, endpoint text or request body. Free grants are counted separately from revenue. The free seller status endpoint additionally exposes plan and subscription expiry. We retain probe status, latency, 402 validity and a value-free JSON shape hash and parsed public price/payee fields for 30 days, removing older rows on the next scheduled run. Raw response bodies are discarded. Webhook deliveries are retried up to five times; alert metadata expires after 30 days. Email submission intent, SMTP acceptance or unknown outcome is retained with alert metadata; ambiguous submissions are not automatically retried. Registration abuse counters use a daily hash of the IP address and expire after 48 hours. Registration/account and idempotent payment records remain until deletion is requested at contact@spendpreflight.com, subject to legally required billing retention. These explicitly submitted monitoring URLs do not enter Scout unless independently publicly listed. The registration response returns a management token once; only its hash is stored. Email alerts require a separate confirmation: a hashed one-use token is valid for 24 hours and removed on confirmation or the next cleanup after expiry; we retain confirmation time and send through our existing brand mailbox. Email can be disabled through its signed disable link. Daily hashed recipient and global mail-abuse counters expire after 48 hours. Account tier, parent/child endpoint membership, public settlement payer and own-test exclusion are retained for billing and aggregate subscriber reporting. HMAC records use a dedicated Worker secret and are not publicly verifiable certificates. Active fresh Pro monitoring receives a disclosed 15-point Scout ranking bonus (total capped at 100); payment never overrides failed probes or high seller risk. Signed receipts: preflight response bodies include a signed copy of the decision and screening result, including the existing input hash. We do not retain these receipts or request bodies. Anyone you share a receipt with can read its contents; a JWS signature does not encrypt them. Paid HTTP preflight also uses x402 signed offers and delivery receipts, which contain the public payer address; transaction hashes are omitted from that extension by default. Signing keys are separate from payment wallets. We don't sell data or use your inputs to train models. Aggregate, anonymized statistics (e.g. how often a payee is flagged) may be published only after an updated notice here. Contact: contact@spendpreflight.com