Privacy policy

Chainhook runs the chainhook.io website and the Chainhook service. We're responsible for the personal information described in this policy, except where we say that a payment provider or you are responsible for it.

If you have questions about this policy or your information, email us at [email protected].

We collect only what we need to run the Service:

• Account details: your name, email address, password (stored only as a one-way hash), and whether you've verified your email.
• Sign-in security: your two-factor authentication secret and recovery codes (stored encrypted), and the public keys of any passkeys you add.
• API keys: each key's name, a one-way hash of the key, and when it was last used.
• Webhooks: the networks and addresses you watch, your filters, your endpoint URLs, and each webhook's signing secret (stored encrypted).
• Delivery logs: details of each matched transfer, such as the transaction hash, addresses, and amount, plus the payload we sent, its status and attempts, and your endpoint's HTTP status code. For failed attempts, we keep up to 2 KB of the error or response. We don't keep response bodies from successful deliveries.
• Subscription and usage records: your plan, overage and automatic addition settings, usage balance, and detection totals, your customer and subscription IDs at the payment provider, and the transaction ID, invoice number, amount, tax, currency, and status of each payment. We never receive your card details.
• Technical information: your IP address and browser user agent, which we use for sign-in sessions, security, and rate limiting, and which appear in our server logs.
• Messages you send us, such as support emails.

• To provide the Service: create and secure your account, watch your addresses, send deliveries, and show your delivery log.
• To bill you: track your plan and usage, apply your plan limits, and charge overage through the payment provider.
• To keep the Service secure: prevent fraud, abuse, and account takeover, and enforce rate limits. When you set a password, we check it against known data breaches using Have I Been Pwned. Only the first 5 characters of the password's hash are sent, never the password itself.
• To contact you about your account: email verification, password resets, usage alerts, notices when your webhooks are suspended or resume, and important changes to the Service or our policies.
• To answer your questions and meet our legal obligations.

We don't sell your personal information, use it for advertising, or send you marketing emails.

If you're in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide the Service you signed up for, bill you, and send service emails.
• Legitimate interests: to keep the Service secure, prevent fraud and abuse, and keep it reliable.
• Legal obligation: to keep records and respond to lawful requests where the law requires it.

Blockchain transactions are public. An address doesn't name anyone on its own, but it can become personal information when it's linked to a person.

You decide which addresses to watch and where deliveries go. For that data, we act on your instructions, and you're responsible for having a lawful basis to monitor addresses that relate to people.

We don't send the addresses you watch to blockchain node providers. We read public network data, such as blocks and token transfer logs, and match transfers to your webhooks on our own servers.

Payments are handled by the third-party payment provider shown at checkout. The provider runs the checkout, collects your card and billing details directly, and handles payment, tax, and refunds as an independent controller under its own privacy policy.

To start a checkout, we send the payment provider your name, your account email, and the plan you chose. To bill overage, we send it the number of extra detections and the amount. The provider tells us the status of your subscription and each payment, along with the amount, tax, and invoice number.

A payment provider's checkout script loads only on the checkout page.

We share personal information only as described here:

• With service providers that host and run Chainhook for us, such as cloud hosting, database, and email delivery providers. They may use it only to provide their services to us.
• With payment providers, as described above.
• With Have I Been Pwned, which receives only a partial password hash.
• With your endpoints, which receive the deliveries you configure.
• With authorities or others when the law requires it, or when it's needed to protect the rights, property, or safety of Chainhook, our users, or the public.
• With a buyer or successor if Chainhook is involved in a merger, acquisition, or sale of assets. We'll tell you before your information becomes subject to a different policy.

We never sell or rent personal information.

We use only the cookies we need to run the site and remember your preferences:

• chainhook-session keeps you signed in and expires after 2 hours of inactivity.
• XSRF-TOKEN protects your forms against cross-site request forgery.
• remember_web_… keeps you signed in when you choose "Remember me".
• appearance remembers your light or dark theme for up to a year.
• sidebar_state remembers whether the dashboard sidebar is open, for 7 days.

We also save your theme and table column choices in your browser's local storage. We don't use analytics, advertising, or tracking cookies. A payment provider's checkout may set its own cookies, which its own policies cover.

• Delivery logs, including payloads and endpoint responses, are deleted automatically when your account's retention period ends. That's a few days at most by default, or longer if we've agreed it with you.
• Sign-in sessions expire after 2 hours of inactivity, and password reset links after 60 minutes.
• Everything else, including your account details, webhooks, and billing records, is kept while your account is open.

When you delete your account, we immediately delete your account details, API keys, passkeys, webhooks, sessions, and plan. We delete your delivery logs, usage, and payment records shortly after. Copies can remain in server logs and backups for a limited time until they're overwritten. Payment providers keep their own records of your payments.

We protect your information with HTTPS, one-way hashing for passwords and API keys, encryption for webhook and two-factor secrets, and restricted access to our systems. You can add two-factor authentication and passkeys to your account.

No system is perfectly secure. If you find a vulnerability, please report it to [email protected].

You can update your name and email, or delete your account, in Settings → Profile.

Depending on where you live, you may also have the right to access, export, correct, or delete your information, and to object to or restrict how we use it. Email us to make a request. We'll reply within 30 days and may need to confirm your identity first.

You can also complain to your local data protection authority.

Our service providers may process your information in countries other than your own. Where the law requires safeguards for these transfers, such as standard contractual clauses, we put them in place.

The Service isn't for children. You must be at least 18 to use it, and we don't knowingly collect information from anyone younger. If you think a child has given us information, contact us and we'll delete it.

We'll post any changes here and update the date at the top. If a change is material, we'll email you before it takes effect.

Questions or requests about your privacy? Email us at [email protected].