Nothing to
collect.
There is no account, so there is no name, no email, no password and no profile. What remains is a short list of operational records, written out below field by field. If a claim here is not checkable, it should not be here.
No cookies. No analytics.
These pages are static. They set no cookies, load no analytics, no tag manager, no third-party scripts and no third-party fonts — the typefaces are served from this domain. Nothing here follows you anywhere.
Two logs, both boring.
The application log records, per request:
- a random request id, the method, the path, the user-agent
- the response status and how long it took
Not the request body, not the response, not your IP. The web server keeps a separate access log in the conventional format — client IP, timestamp, request line, status, bytes, referer, user-agent. It is used for abuse handling and for seeing which machines actually find us, and it is rotated under a fixed size cap rather than kept indefinitely.
Your IP is stored as a hash.
The daily free allowance is per client IP, which means something has to be remembered. What is stored is a salted SHA-256 hash of the address — never the address itself — with a random salt generated once on this deployment.
The salt is the part that matters: IPv4 is only 232 addresses, so an unsalted hash of one is trivially reversible and would be privacy theatre. Only the current day’s rows are kept; earlier days are deleted on the first call of a new day.
The ledger, and the chain.
For each paid call we record the payer address, the amount, which endpoint or model was bought, the network and scheme, timestamps, the settlement status and the transaction hash. This is what makes reputation unfakeable, and it is the same data anyone can already read from the chain.
On-chain settlement is public and permanent. Nobody can delete it — not us, not you. That is a property of the payment rail you chose, and it is worth knowing before you pay from an address you care about.
Inputs are used, then dropped.
Request bodies — the URL you want audited, the token address you want checked, the prompt you want answered — are used to produce your response and are not written to the logs or the ledger.
Two consequences worth stating. Endpoints that fetch a URL will contact that third-party site, which will see the request. Chat requests are forwarded to the upstream model provider you selected, under that provider’s own terms. Send neither secrets nor other people’s personal data.
We sell nothing.
No data is sold, rented, or handed to advertisers, brokers or analytics vendors. The only outbound flows are the operational ones named above: the upstream model provider for a chat call, and the site you asked us to fetch.
One address.
contact@true402.dev. Note the shape of the problem: with no account, a request to “delete my data” has nothing to key on — there is no record tied to you to find. The trading rules are on the terms page.