Privacy

Last updated October 2026

What we read

Public blockchain data, for the address you paste. That is the same information anyone can see on a block explorer — we just read a lot of chains at once and put it in one place. To do that, our server asks infrastructure providers (RPC nodes, block explorers, price and bridge APIs) about the address. They see the wallet address we look up, not who asked.

What we store, and for how long

• Wallet addresses and scan results. The address you paste and what we found for it. A finished scan is reused for about six hours. An anonymous report is deleted one hour after its scan finishes, unless you keep it by attaching an email or unlocking it. If you opened the payment screen, a small stub (report id, wallet address, payment amount) stays for 30 days so a late payment can still be matched. A paid report keeps its full data for the 14 days you can open it; a report attached to an email but not paid keeps its full data for one hour. After that only a summary row remains (wallet, headline numbers, unlock history), and that row is kept until you delete the wallet from your account or ask us to erase your record.
• Your email, only if you give it. Used to send your login link, to group your wallets into an account and to tie a purchase to you. It is stored on the reports you attach it to and, once you have signed in, in our contact list, until you ask us to remove it. Unsubscribing stops mail but keeps the address on file so the opt-out holds. Today the only email we send is your login link; if we ever send reminders about wallets you scanned, each one carries an unsubscribe link.
• Payments. No card details exist. An open invoice is your report id plus an exact amount; unpaid invoices are deleted after 30 days. Once you pay, we keep the record — chain, token, amount and transaction id — for as long as we run the service, as our proof of the sale. If you prove a payment by signing with your wallet, our operating log notes the first characters of that wallet. Credit packs also record the email they belong to.
• Referrals. If your browser kept a code from our earlier referral program, it is stamped on the reports you create, so the person who referred you is credited when you unlock one. Referrers’ records (email, payout wallet, earnings) are kept as part of our payout ledger. Links people share today are affiliate links, below.
• Feedback and sweeps. Feedback you submit after an unlock (the amount recovered, your note, the report’s wallet, your email if you were signed in) is kept as part of our records. When you complete a sweep or bridge through us, our server records the wallet, the amounts, the first transaction id and any referral code, for fee accounting. When you get Solana rent back through us, it records the wallet, how much came back, our fee, the transaction ids and the report you came from, if any.
• Affiliate links. One link covers every tool on fffonchain.com and claim_your_stocks. If you make a link, we keep the wallet that signed (it is where we pay you), your code, any project name we set up with you, your rate (the standard one, or a rate we agreed with you) and the rates it had before, the link you signed up through, when you made it, a count of visits through your link with nothing about who visited, and a hash of the key your browser keeps for it. If you pick a name for your link, we keep that name and when you picked it. If you choose to show your link on our top affiliates board, we keep that choice and the name you show there, and whether we took it off the board. The board shows only that name, your rank (or that you are a partner) and the sales and reclaims by people you brought, in whole dollars, never your wallet, your code or what you earned. Each sale, or Solana rent reclaim through Get Your Rent, that earns from a link is a line in our payout ledger: its transaction id, the seller’s public wallet, the chain, when the sale was made, the sale and fee amounts, whether it was a sale or a reclaim, what each link earned, and when it was paid or voided. Your link’s rank is worked out from these lines each time; it is not kept on its own. A seller’s wallet is also tied to the first link it sold or reclaimed through, and we keep the transaction id of every sale and reclaim we checked so none is counted twice. These are kept for as long as we run the service, as our payout records. A note of which link a Solana sale order came through (the transaction id, the seller’s signature on the order and the seller’s wallet), or a rent reclaim came through (its transaction id and the wallet), is deleted after 7 days. Someone who owns a link sees only totals and their own amounts by level, chain and date (to the cent and the day), never a seller’s wallet or transaction.
• Technical data. Your IP address is used in memory to rate-limit abuse; a repeated abuse hit is noted in our operating log with the IP. That log (unlocks, referral credits, sweeps, errors) keeps a bounded number of recent entries, currently the newest 20,000.

What your browser keeps

Except the affiliate invite code that is written into a stock sale you sign on an EVM chain (see cys-ref below), nothing your browser stores for us is shared with anyone else. This is every item, and when it reaches our server:

• Login session cookie (ff_sess) — set only after you sign in through a login link. It is a signed token that carries your email address and an expiry date, and page scripts cannot read it. Your browser sends it with every request to fffonchain.com for 30 days, so we know which account is asking. “Log out everywhere” in your account cancels every copy of it.
• Anonymous browser id (ff-cid) — a random string created the first time you click Scan in this browser. It is sent with each scan request, and once more if you leave the page while a scan is still waiting in line. We use it to tell your clicks apart from other people’s on the same wallet: a double click, a dropped connection or a reload brings you back to the same scan instead of starting a second one, and leaving frees your place in the queue. It is held in server memory for fifteen minutes and kept only as a hash on the scan record. It is not tied to your email and is not used to track you.
• Earlier referral code (ff-ref): from our earlier referral program. If your browser kept one, it is sent with your scan, when your report is saved, and when you complete a sweep through us, so the person who referred you can be credited. The first code wins and is never overwritten. Links opened today don’t set it: they are affiliate links (cys-ref, below).
• Affiliate invite (cys-ref): if you arrive through someone’s affiliate link, on any page of fffonchain.com or through claimyourstocks.com, its code and the date are kept for 90 days so that link can be credited for your sales and rent reclaims, and a newer link does not replace it before then. The code is taken out of the address bar right away. It is sent to us once per browser session to count the visit, when you make your own link (as who invited you), with each stock sale, and with each Solana rent transaction you send through Get Your Rent. On Solana it goes with the sale order or the transaction; on other chains it is written into the swap you sign, so LI.FI sees it and, like the sale itself, it is public on-chain. A note for this browser tab (cys-ref-seen, in session storage, a short list of link codes) remembers which links’ visits were already counted, so a reload doesn’t count one twice. It never leaves your browser and is gone when the tab closes.
• Your affiliate link (cys-aff): after you sign for your own link, your code, the wallet that signed and a random key are kept so the Earn page can show your numbers without asking you to sign again, and your link’s name once you pick one. Only the code and key are sent, to load those numbers or save your choices, and we keep just a hash of the key. Signing again in another browser gives a new key and the old one stops working. Your code, or your link’s name, is also put in the Share on X text after a sale.
• Remembered email (ff-email) — if you typed an email to keep a report, it stays in your browser so you do not have to retype it. It is offered as a masked “use b•••@x.com” chip; nothing is sent until you choose it and press the button. It is never attached to a report automatically.
• Per-report preferences — whether you finished keeping a report (ff-saved-<report>, which also records the address you chose), whether you left feedback on it (ff-fb-<report>), your light/dark theme (ff-theme), a note that you have seen the homepage intro (ff-entered), and a per-tab marker that stops a reopened report from re-running its deep trace. These never leave your browser.

Clearing site data for fffonchain.com removes all of it.

Server logs and backups

• Web server log. Each request line as your browser sent it, which can include the wallet address, report code or browser id that was in the address bar, plus the result, timing, your IP address and browser type. Kept for 14 days. We also read it to count visits, in aggregate, for our own admin dashboard; those counts are never shared, and no third-party analytics are involved.
• Application log. Report ids and the first characters of wallet addresses, never emails or IP addresses. It is trimmed by size rather than by date, so entries can remain for several months.
• Backups. Hourly copies of our database are kept for up to 15 days. A copy taken just before each software release is kept for 14 days, except the two most recent ones (the current release’s undo copy and the one before it), which stay until later releases replace them. Data you delete, or that expires, can therefore persist in a backup for that long.

Other services your browser contacts

We run no third-party analytics, advertising or tracking scripts. Your browser does talk directly to a few outside services. Token logos on a report load from Trust Wallet’s asset library, from DexScreener and, for Solana tokens, from whatever image host the token’s own metadata names; they see your IP address and browser type, not who you are. If you use the Sweep, Bridge or SolSweep tools, your browser talks to your wallet extension (MetaMask, WalletConnect, Phantom or Solflare) and to the routing services LI.FI and Jupiter, which necessarily receive the wallet you connect and the trade you ask for. claim_your_stocks connects wallets through Reown (WalletConnect), which sees your wallet address when you connect. The Solana rent page does too, and your browser only reaches Reown there once you press Connect wallet. The Earn page, where you sign for your affiliate link, connects through Reown like claim_your_stocks. Each of these has its own privacy policy.

What we never do

Ask for or store private keys or seed phrases. Sell your data. Move your funds. Follow you around other websites.

Your choices

Scan without ever giving an email. Delete any wallet from your account. Unsubscribe from emails in one click. Clear your browser’s site data to remove everything stored on your device. Or email hi@fffonchain.com and we will delete your wallets and their reports, and stop contacting you. Ask us to erase your record entirely and we will do that too — a person handles it, so allow a few days.

Questions

Email hi@fffonchain.com. The rules for using the service are in the terms.

← Back to the scanner