Privacy Policy

Public by design

Everything on the ledger is public and permanent: fingerprints, timestamps, any name you enter (shown as self-declared), file names of stored copies, wallet snapshots you save, and text you choose to store. Do not enter anything you want to keep private in those fields.

What we keep privately

An email address you enter for receipts, buyer and gift-recipient emails, stored file copies (up to 25 MB, downloadable only with a one-time retrieval code), credit keys and how each credit was spent, including an approximate location (city and country) worked out from the IP address.

For security we log IP addresses of suspicious requests, such as failed checks or invalid keys, and may block abusive addresses.

Tamper and security evidence

We collect evidence when something doesn't match or looks like an attack: a file, text or wallet whose data doesn't match its SHA-256 code, a ledger entry that was altered, a mismatched fingerprint, an invalid credit key, code or link, or a failed admin sign-in.

Each evidence record holds what was submitted and what was expected, the page or action, the time, the IP address and the browser's user-agent. For tampered wallets we also keep a full copy of the altered record. Repeated attempts from one IP address can block it for an hour.

Why we collect evidence

To keep the ledger trustworthy, protect the service and its users, investigate abuse, and establish, exercise or defend legal claims. We may share evidence with law enforcement or a court when the law requires it, or when it is needed to address fraud or an attack.

When a saved wallet record has been tampered with, we collect and keep the information about it (the altered data, the original record it should match, when it happened, and the IP address and browser behind the request) so that we can identify and go after the attacker. This can include reporting the attacker to law enforcement, exchanges or hosting providers, and taking legal action.

Your device

Fingerprints are calculated in your browser. Your credit key is remembered in your browser's local storage. The admin area uses one sign-in cookie; there are no advertising cookies.

Who we share data with

Stripe processes card payments (we never see card numbers). Our email provider sends receipts and alerts. freetsa.org receives only fingerprints. Public block explorers receive the wallet addresses you look up. ipwho.is receives the IP address of a credit spend to estimate its location. Our hosting provider stores the data and collects basic usage analytics.

How long we keep it

Ledger entries are permanent. Stored copies, emails and credit records are kept while they are needed to provide the service and meet legal obligations. Security and tamper evidence is kept for as long as it is needed to protect the service or for a possible legal claim.

Your rights

Depending on where you live (for example under PIPEDA in Canada, the UK GDPR, or US state laws such as the CCPA), you may ask to access, correct or delete your private data. Email 8samples8@gmail.com. Public ledger entries cannot be removed, because that would break the chain, but we can delete private data linked to them, such as an email address or a stored copy.

Children

The service is not intended for children under 13, and under 16 in the UK.

Changes

We will update this page when our practices change and show the date at the top.