Privacy
0.9.53What this site keeps about you (almost nothing), what it keeps if you give it something, who else can see it, and how to have it deleted.
The short version
There is no advertising and no third-party tracking. Accounts are optional. We keep nothing that identifies you unless you give it to us yourself: the forms below, or an account if you open one. We don't sell or share anything with anyone.
If you give us something
| What | What we keep | What it's for | How long |
|---|---|---|---|
| The feedback form | What you typed, the contact line if you filled it in, the page you were on, and the time | Reading it, fixing what's wrong, and replying if you left a way to | 12 months, then the text and your contact line are deleted. Sooner if you ask. |
| The email sign-up under the blog | Your email address, which of the two you ticked (the weekly digest, articles), when you asked, when you confirmed each one, and when the last digest went to you | Sending only what you ticked and then confirmed: the weekly digest, and an email when a new article is published (its title, summary and a link, never the whole post) | Until you ask us to delete it. Leaving one kind stops that kind straight away; leaving everything stops all of it, and we then keep only your address and a note that you left, so nothing is sent to it again by mistake. |
The email sign-up. Each kind of email is its own choice: ticking the weekly digest doesn't sign you up for articles, or the other way round, and if you were on the digest before articles existed you are not on articles unless you ask. Nothing is sent until you use the link in the one confirmation email, and it confirms exactly what you ticked. Every email has two one-click links at the bottom, needing no sign-in: one stops that kind of email, the other stops everything. Asking again on the site and confirming puts you back on.
Feedback is also posted to a private channel on our Discord server, so the people who build this see it. That copy is deleted after 90 days, automatically: the message our server posted is the message our server deletes. It is a shorter life than the copy here because its only job is to be read by the handful of people who fix things, and that job is done in a season. Until it is deleted it is held by Discord under Discord's privacy policy. Ask us and it goes sooner. A request to add a collection travels the same way, to the same channel, on the same 90 days, and carries only what you chose to show: if you asked to be credited anonymously, the name or handle you gave us stays here. Nothing else we hold goes to Discord.
We never ask for a name, and none of these forms records your IP address or anything that could link it to your visits.
If you give us nothing
Visit counting. We count visits so we know whether anyone is reading, without identifying anyone. We keep per-day totals only, except that how many times each page was opened, and how many dashboard tabs were open (a total taken once a minute), are also broken down by hour of day (UTC) -- nothing finer, and no other count gets this; they're used only to see which hours are quiet enough to make changes without disrupting anyone. What we keep: pages opened (and, as above, by hour), the website you came from (its name only, like "t.me"), the website a link here took you to (its name only, like "x.com"), visitors by country, device type and language, first visits and returns, which parts of the dashboard were used, how quickly each page loaded and responded to a tap or click (three rough bands, by device type), how far people get in buying, listing, offering, minting and signing in with a wallet, which wallet extension was used and, if a wallet step failed, a failure type from a short fixed list (never the wallet's message, an address or a transaction), how often an account's plan limit was reached or a free account's alert was held back (a count, never which account), whether a wallet, rune or collection search came back empty, and, if something on the page breaks, its error message and which page -- never a stack trace or anything you typed. The about page explains exactly how returns are counted without an ID. Totals are deleted after 13 months. You can switch it off for your browser there, and a browser that sends Global Privacy Control or Do Not Track is never counted. These totals are de-identified: we commit to keeping and using them only in that form, and not to try to re-identify anyone from them. In the EU, the rest of the EEA and the UK (or wherever we can't tell the country), we ask before your browser keeps anything for this, and count your visits only if you say yes; a yes lasts 13 months. The country comes from Cloudflare for each request and is not stored.
Wallet lookups. A wallet address you look up is sent to our server to fetch what it holds. The answer is kept for up to a day against the address, which is public anyway, so a second look is quick, then deleted, with nothing about who asked. The list of addresses you looked up stays in your browser tab and is forgotten when you close it.
Server logs. Like any website, our server logs requests that fail, for 14 days, to find problems. On the public site those lines don't include your IP address, and on any site they leave out a wallet address you looked up. To stop anyone hammering the site, the server remembers each connection's address in memory for up to an hour; it's never written down.
Accounts
You never need an account to use this site. An account only keeps your setup (the wallets you look up, your own tabs, how the cards are arranged and your display settings) so it follows you to another browser or device. Accounts open when we switch them on; until then none of this applies.
| What | What we keep | What it's for | How long |
|---|---|---|---|
| How you sign in | The wallet address you signed a message with, or the email address you asked for a sign-in link at | Knowing it's you next time | Until you delete the account |
| Your setup | The wallets you added and their labels, your tabs, your card layout and display settings | Showing you the same dashboard wherever you sign in | Until you change it or delete the account |
| Sign-ins | A cookie called ledger_session, and on our side a scrambled copy of it with when it was made and last used | Keeping you signed in | 30 days after you last used it, or until you sign out |
| API keys | A scrambled copy of a key you create (never the key itself), a label if you give one, and when it was made, last used and revoked | Letting a key you create act as you, once there's something for it to call | Until you revoke it or delete the account |
| Verified wallets | The address, the signature you made to prove it is yours, and the date | Letting that wallet list for sale and receive offer alerts. We may also use verified wallets privately, together with everyone else's, to check how accurately we group addresses by owner; they're never used in anything shown publicly | Until you remove it or delete the account |
| Offer notes, mutes and reports | A note a buyer attaches to an offer (up to 280 characters, links removed); which buyers and collections you muted; reports you sent about an offer, with the note as it read | Showing a note only to someone who can accept the offer, letting you silence a buyer, and keeping abuse out | Notes: until the offer is replaced or your account is deleted. Mutes and reports: until you remove the mute or delete the account |
| Inscription reports and hides (only where switched on) | The inscription you reported, the reason you picked, the note if you wrote one, and your account if you were signed in (no IP address); the inscriptions you hid for yourself, if signed in | Deciding whether an inscription should be hidden on this site, and not showing you what you chose to hide | Reports: kept as the record of what we decided; deleting your account removes your name from them. Hides: until you show the item again or delete the account |
| Offer alerts | Your notification email (only after you confirm it), your Telegram chat if you connect one, which offers matched your verified wallets, and a record of each alert queued or sent | Telling you when someone bids on what a verified wallet holds | Your settings: until you turn them off, disconnect Telegram or delete the account. The record of each alert: 90 days, or until you delete the account if that comes first |
| Wallet alerts | Which of your saved or verified wallets you asked to be told about, the smallest movement you care about, and a record of each alert queued or sent | Telling you when that wallet moves | The alert: until you delete it or the account. The record of each alert: 90 days, or until you delete the account if that comes first |
| What arrived in your wallets (only where switched on) | The inscriptions and runes that reached your verified or linked wallets (public chain data: the transaction, ids, rune names and amounts) with who we think sent them, the addresses you marked as yours or as an exchange, and, for each wallet, how far we got reading what it received in the 90 days before you added it | Labelling what arrives, and showing that history when you add a wallet | Until you delete the account; the history progress for a wallet goes when you remove that wallet |
| Discord alerts | Your Discord user number and the direct-message channel between you and our bot, if you link Discord; and the number of the last message you sent the bot | Sending you alerts by direct message, and noticing when you reply "stop" | Until you unlink Discord or delete the account |
| Browser notifications | For each browser you turn them on in (up to 10): the address its push service gave it and two keys, kept encrypted | Sending that browser a notification | Until you turn them off there, the browser's push service tells us it's gone, or you delete the account |
| iPhone app notifications | Only in our iOS app (not released yet). For each iPhone you turn them on in (up to 10): the code Apple gave it for notifications, kept encrypted, and the phone's name | Sending that phone a notification | Until you turn them off in the app, Apple tells us the phone is gone, or you delete the account |
| Site announcements | Whether you asked for them, and on which channels | Sending at most one a week, only if you asked | Until you turn them off or delete the account |
| Marketplace listings, offers and make-safe | The wallet addresses and coins involved, the price, and the transaction you signed; for Make safe, the transaction that ends an old order | Letting a buyer complete your listing, letting you accept or complete an offer, and telling you whether an old signed order can still be completed | Until you delete the account (a trade that reached the Bitcoin network stays public there) |
| US state or DC (paid plans) | The US state or DC you choose when you buy or renew, and when you chose it; the state is also recorded on each purchase, with any Texas sales tax included in its price. A ZIP code given before 12 October 2026, when we asked for one, stays on the account | Paid plans are for US customers only, and sales tax depends on the state | On the account: until you choose a new one or delete the account. The state on a purchase: as long as we must keep tax records |
Offer alerts. If you turn alerts on, we match offers made on this site against the wallets you verified (never against a wallet you only watch) and email or message you. Free accounts hear an hour after paid ones. If a holder accepts your offer, we also tell you at 12 hours and at 2 hours before your 24 hours to complete the purchase run out; notices about your own offers and listings are always sent, whatever your alert settings. Every email has a one-click unsubscribe. The person who made the offer never learns who you are, and you never learn who they are. Telegram: connecting opens a chat between you and our bot; we store that chat's number and nothing else about your Telegram account, and Telegram itself sees the messages. "Download my data" includes your matches and every alert sent to you in the last 90 days; we delete the record of an alert 90 days after it was queued, and "Delete account" removes them all.
US state or DC. Paid plans are for US customers only. When you buy or renew, we ask you to choose your US state or DC from a menu, and keep the latest choice on your account so the menu is filled in next time; you are asked again at every purchase. Until 12 October 2026 we asked for a ZIP code instead; one you gave then stays on your account until you delete it. We never look up where you are from your IP address. "Download my data" includes it; "Delete account" removes it, though the state recorded on a past purchase stays with that purchase's tax record.
Wallet alerts. You can ask to be told when one of your saved or verified wallets moves. A free account has one such alert, sent an hour late; paid accounts get more, sent at once. The alert names the wallet by the label you gave it, never by its address, and goes only to the channels you turned on for wallet activity. "Download my data" includes your wallet alerts; "Delete account" removes them.
Offer notes, mutes and reports. A buyer's note is shown only to someone who could accept that offer, only after they sign in, and never in an email or message. A mute is stored against the buyer's account on our side; you are never told who that is, and the buyer is never told they were muted. If several different people report the same buyer, that buyer's notes are hidden until we have looked at them. "Download my data" includes your mutes (a muted buyer appears without any identity) and the reports you sent.
Discord. Linking Discord asks Discord who you are, and we keep only your user number. Our bot then messages you directly. To notice when you reply "stop", it reads the replies you send it; the text is never stored or logged, only the number of the last message it read. Discord sees those messages under Discord's privacy policy. "Unlink" or deleting the account removes the link.
Browser notifications. Only a click on "Turn on browser notifications" asks your browser for permission. Your browser's push service (run by the company that makes the browser: Google, Mozilla, Apple or Microsoft) carries each notification, so it sees that one was sent and its text. The lock-screen text about your own activity is generic, such as "New offer on something you hold"; the detail is on the site after you click.
iPhone app notifications. Only in our iOS app (not released yet), and only if you allow them there. Apple's push service carries each one and, unlike browser notifications, can read what it says. So every one says something generic, such as "New offer on something you hold", plus a sealed code that only our server can open; no address, transaction, amount or item is in it. The detail is on the site after you tap.
The marketplace. A listing is a transaction you sign that anyone may complete at your price, so while it is for sale it is public on purpose: the coins it spends, your address and the price. Offers show only the price and expiry publicly, never who made them. Because a signed listing stays valid on the Bitcoin network until the coin moves, we keep watching whether each old signed order could still be completed, and tell you; Make safe ends one for good. Trades on the Bitcoin network are public forever, whatever we delete.
Sanctions screening. Every wallet address used to sign in, verified as yours, used in the marketplace or a mint, or that pays us, is checked against the US Treasury's public sanctions list (OFAC SDN). We keep a record of each check: the address, what it was for, the list's date and the result. A match is refused, and the account is suspended until a person has looked at it. This record is kept even after an account is deleted, because it is our record of having checked.
Copyright complaints. If we receive a credible copyright complaint about something an account submitted through minting or collection curation, a person records it against that account: the item, the date it arrived, a short note, and whether it was later withdrawn. It is how the repeat-infringer rule on the DMCA page is applied, by a person. "Download my data" includes it. It is kept after an account is deleted, because it is our record of having applied that rule.
Rights statements. When you mint your own content or send a collection for review, you tick a statement that it is your own work or that you have the owner's permission. We record that you did: the item, the statement's version and the date. "Download my data" includes it. It is kept after an account is deleted, because it is our record of what you told us.
Signing in with a wallet. Your wallet signs a short message that names this site and a one-time code. That proves you control the address without moving anything or giving us any access to it. We never ask for a private key or seed phrase.
Signing in with email. We send one email with a sign-in link. The sign-in link works once, for 15 minutes. We use the address only to sign you in: no newsletters, no marketing. The email is sent through our mail provider, which handles it only to deliver it.
The ledger_session cookie is the only one this site keeps. It's set only when you sign in, it can't be read by the page's scripts, and it's removed when you sign out. "Sign out everywhere" ends every sign-in on every device at once. Signing in with a wallet also sets a second cookie for five minutes, holding a random number that ties the message you're signing to this browser; it's deleted as soon as you've signed in. Inside our phone or Windows store app only, the page also sets a cookie called atrium_app, saying which store app it is (for example "twa" for Android), so the payment pages leave out the buy buttons. It holds nothing else, lasts only for the browsing session, and any page opened outside the app removes it.
API keys. On your account page: "Create a key" gives you a key, shown once, that you're meant to keep to yourself. There's nothing on this dashboard a key can be used to call yet; making one now only means it's ready when there is. "Revoke" turns a key off for good.
Your copy and deleting it. On your account page: "Download my data" gives you everything the account holds, as a file. "Delete account" removes the account, its sign-ins, its API keys and everything else it holds, straight away; it can't be undone. Whatever is still in your browser's own storage stays there until you clear it.
To stop anyone guessing at sign-ins, the server keeps a short log of account requests (the kind of request, whether it worked, and a shortened account number) for 14 days. It never includes your wallet address, your email address or your labels.
Stored in your browser
These live in your own browser's storage, on your device. None is a cookie, and none is sent to us, except the visit report described above and, if you're signed in, your setup, which is copied to your account.
| Name | What it holds |
|---|---|
| ledger.layout, ledger.theme, ledger.accent.* | Your display settings |
| ledger.currency | Your price setting (USD, BTC or both, in either order) |
| ledger.fiat | Whether prices are in US dollars or Chinese yuan |
| ledger.lang | Whether you chose English or Chinese, so the "Chinese version" hint isn't shown again |
| ledger.i18n.collect | Only set by the people checking the translation: lists text not yet translated |
| ledger.grid, ledger.grid.runesMoved, ledger.views (ledger.myview in older versions) | How you arranged the cards, and your own tabs (runesMoved notes that a one-time card move was applied) |
| ledger.viewedWallets | The wallet addresses you looked up. Kept only until you close the tab, unless you're signed in. |
| ledger.account.reloaded | Only while signed in: stops the page reloading twice after your account's setup is copied in |
| greeksHiddenCols, hmView, hmShape, mhHours, mhMetric, atrium.pulse.range, atrium.floor.range, atrium.pnl.sort, atrium.wallet.view, ledger.heldPct | Which columns, chart options, chart time ranges, table sort orders and wallet-page view (grid or list) you picked, and whether Holdings shows counts or percentages |
| ledger.walletProvider | Which wallet extension you signed in with (for example UniSat or Xverse), so a "fill from my wallet" button asks that one rather than guessing. The name only, never an address. Kept only in this tab |
| ledger.labWallet | Only on the regtest test lab, never on the live site: which test identity this browser tab is using with the lab's own wallet. Kept only in this tab |
| ledger.sinceLastLook | When you last looked at Overview, and the next-block fee, portfolio total and watched prices at that moment, so "Since you last looked" can show what changed. Kept only in this browser |
| ledger.updatesOpen | Whether you left Overview's Updates bar open or closed. Kept only in this browser |
| ledger.introSeen, alertsSeenId, ledger.bannerDismissed | That you've already seen a notice, so it isn't shown again |
| atrium.hintsSeen | Which one-line tips (for example the first time you open a wallet) you have already been shown, so each is shown only once. Kept only in this browser |
| ledger.visits | The date of your last visit and the days you visited in the past month, for visit counting |
| ledger.nocount | Set if you switched visit counting off |
| ledger.consent | Only where we ask before counting (EU, EEA, UK, or country unknown): your answer, yes or no, and the date you gave it |
| atrium.hiddenInscriptions | The inscriptions you chose to hide ("Hide for me"), so they stay hidden in this browser. Inscription IDs only. Kept only in this browser; if you're signed in, also on your account |
| ledger.labs.sound.volume, ledger.labs.sound.muted, ledger.labs.sound.cats | Only on the "Mempool as sound" lab, where it's switched on: your volume, mute and which sounds you picked |
| atrium.cm.reviewedCommits | Only on the minting pages: the ids of the mint payments (commit transactions) this browser checked before you signed, at most 200, so taking your coins back can confirm it is the same one. Transaction ids only. Kept only in this browser |
| atrium.ms.reviewed.* | Only on the Make safe page: which outputs and which funding coin this browser checked and sent for each make-safe, so a speed-up can be checked against them. Outpoints only. Kept only in this browser |
| atrium.appMode | Only inside our phone or Windows store app: which store app this is, so the buy buttons stay hidden on every page. Kept only in this tab |
| atrium-offline-v1 (the offline copy) | Only where the installable app is switched on: a copy of the offline page, our stylesheets, fonts and one icon, so a page can say you're offline. Nothing about you or your account is ever put in it |
Clearing your browser's site data for this site removes all of them.
Who else is involved
- Cloudflare runs the network in front of our server. Like any network provider it sees your IP address and the pages you request as they pass through. Cloudflare's privacy policy covers that. It tells us the country a visit came from, and nothing else about you.
- Discord holds the copy of feedback, and of any collection request, described above, for 90 days.
- Our mail provider delivers sign-in links if you sign in with email, offer alerts if you turn them on, and the weekly digest and article emails if you ask for them. It sees the address and the email, and nothing else.
- Telegram carries offer alerts only if you connect it. It sees the messages the bot sends you.
- Discord carries alerts by direct message only if you link it, as described above.
- Your browser's push service (Google, Mozilla, Apple or Microsoft, depending on the browser) carries browser notifications only if you turn them on.
- Apple's push service carries iPhone app notifications only if you turn them on in our iOS app.
- Nobody else. There are no analytics companies, advertisers, embedded social buttons or third-party scripts. Fonts are served from our own server. Links to other sites (a transaction on a block explorer, a news story) take you there only if you click them.
Backups
We keep an encrypted offsite backup of what can't be rebuilt from the chain -- accounts, signups, feedback and triage content -- in case a drive fails, encrypted before it ever leaves this server. A new one is made daily and the oldest is retired automatically, on a rolling 14 day cycle. A backup already made can't be edited, so anything deleted from the live site -- including an account you delete -- can in principle still exist in one for up to that same 14 days before it's gone from there too.
Your choices
- To download or delete your account, use your account page. To have your email or your feedback deleted, or to ask what we hold, send it through the feedback form, choosing "Other" and starting with the word "Privacy". We'll do it and tell you when it's done.
- To stop visit counting, use the switch on the about page.
This site isn't meant for children under 13, and we don't knowingly collect anything from them.
Changes
If this page changes, the "Last updated" date at the bottom changes with it. It's a plain-language draft and may be revised after legal review. The 2026-10-09 additions (Discord, browser notifications, announcements, the marketplace and sanctions screening) are awaiting that review, and so is the 2026-10-16 addition (iPhone app notifications).
Last updated