Privacy notice

Who we are

This notice covers the D20DAO agent API at https://api.d20dao.org and the website at https://d20dao.org. Both are operated by D20DAO, an unincorporated project run by its contributors. "D20DAO" and "we" mean the D20DAO contributors who operate them. We are responsible for the data described here.

What we process and why

• Payment data: your wallet address, the payment authorization you sign (amount, network, nonce, validity and signature) and the paymentId derived from it. We use it to settle your payment, serve your call, stop a payment being used twice and make refunds.
• Request data: the operation and parameters you send, including any seed and item labels. We use it to open the request and build your result. Item labels do not go on chain; only their count does.
• IP address: we use it for rate limiting and to prevent abuse.
• Operational logs: times, routes, response codes, errors and, for some events, the paymentId and wallet address. Cloudflare's request logs can also include your IP address. We use logs to run, secure and fix the Service and to account for payments.
• Email: if you write to us, your address and message. We use them to answer you and to handle refunds.

We process this data to perform our contract with you (payments, results and refunds) and for our legitimate interest in keeping the Service secure and working (rate limits, abuse prevention and logs).

The website

Cloudflare, which hosts the website, processes IP addresses and request data to deliver and protect it. Optional Google Analytics is off until you choose Accept analytics. Rejecting does not affect access to the website.

With your consent, Google Analytics uses first-party cookies (_ga and _ga_FJ39Q6K20R) to distinguish browsers and sessions. It processes page visits, session and engagement information, and basic browser and device information to help us understand how the website is used. Google also receives network information, including your IP address, when your browser connects to it. We do not use Google Signals, advertising personalization or advertising storage.

Our analytics page addresses contain only known public routes. We remove URL query parameters and fragments, group explorer detail pages under /explorer, use a fixed page title, and omit the referring page address. We do not send wallet addresses, seeds, transaction hashes, form entries or a user ID as analytics data.

We remember your analytics choice in your browser's localStorage under d20dao-analytics-consent-v1. This preference remains until you change it or clear your browser storage. Analytics cookies normally expire after two years and can be renewed by visits while analytics is accepted.

Our Google Analytics property is configured to retain user-level and event-level data for two months, without resetting retention on new activity. Google applies retention setting changes after 24 hours. Aggregated reports are not governed by that retention setting.

You can change or withdraw consent at any time using Analytics preferences at the bottom of every page. Reject analytics stops collection, removes the site's analytics cookies where your browser permits it, and reloads the page to unload Google's tag if it was loaded. If your browser cannot save the choice, collection stops for the current visit and we show a notice; a previous saved choice may still apply on a later visit. Withdrawal does not undo data already collected with your consent.

Google may process analytics data outside your country. Read how Google uses information from sites that use its services.

Public blockchain data

Payments and the requests we open are recorded on public blockchains. What is recorded there, such as wallet addresses, amounts, values derived from your payment and seed, and results, is public and permanent. No one, including us, can change or delete it.

How long we keep it

We keep operational logs for up to 90 days. We keep payment and request records only as long as we need them to serve your call and settle any refund. We keep data longer only when we need it to handle a dispute or abuse, or to meet a legal obligation. Rate-limit counters are held in memory only. We keep emails as long as we need them to handle what you wrote about.

Data on public blockchains is public and permanent. We cannot delete it.

Who we share it with

We do not sell your data or use it for advertising. We share it as needed to run the Service, and for website analytics only with your consent:

• Circle, which settles payments through Circle Gateway under its own terms and privacy policy;
• Cloudflare, which hosts the API and the website and stores their logs;
• Google, which provides the optional website analytics described above;
• the blockchain node providers we use to send and read transactions.

We also disclose data when the law requires it. These providers may process data outside your country.

Your rights

Depending on where you live, you may have the right to access, correct or delete your data, to object to or restrict its use, and to complain to a data protection authority. Email contact@d20dao.org to use these rights. We cannot change or delete data on public blockchains.

Changes

We will post changes on this page and update the date at the top.

Contact

Email contact@d20dao.org.