Privacy policy

Effective 2026-05-22. Service operated under the brand name Seneschal.

Short version. We don’t want your data. We store the minimum needed to deliver the service you paid for, encrypt the sensitive bits at rest, share with no one except Coinbase’s x402 payment facilitator and the webhook endpoint you chose, and delete it all when you cancel. No cookies, no analytics, no accounts, no email, no name.

1. Who we are

Seneschal is an anonymous, open-source operator of an Ethereum block builder plus a small bundle of paid data services (Private Watch, premium liquidation feeds, agent-payable single-fact endpoints). The natural person behind it operates pseudonymously as Rotwang9000. There is no registered company.

The lawful basis for processing your data is performance of a contract under Article 6(1)(b) UK GDPR / EU GDPR: when you pay for a Private Watch, top up credit, or run a historical scan we hold what we need to deliver that. A secondary basis of legitimate interest covers transient processing such as IP-based rate limiting on the free derive-viewkey endpoint.

Contact for privacy requests

@OrknetP on Telegram is the operator’s private channel for messages about the service, including privacy queries.

2. Data we process

Data	Why	Where	Retention
Monero / Zcash address you ask us to watch	So the poller can match incoming transactions on the chain.	Encrypted SQLite at rest (server-side), TLS in transit.	Deleted when the watch is cancelled, runs out of credit, or hits the 90-day maximum lifetime. Hard-deleted within 30 days of any of those events.
View key (XMR secret view key / ZEC Unified Full Viewing Key)	Required to detect inbound transactions; read-only, cannot spend.	Encrypted at rest with AES-256-GCM using an operator-held master key; never written to logs.	Same as the watch row. On cancellation the ciphertext is overwritten and the row deleted.
Webhook URL	Where to POST signed events when funds land.	Plain text in SQLite (it’s an HTTP(S) endpoint, not a secret).	Same as the watch row.
Watch token / webhook secret (random)	Authenticate management calls and let you verify webhook bodies via HMAC-SHA256.	SHA-256 hash only in SQLite; the cleartext is shown once at creation and never persisted server-side.	Same as the watch row.
Payer wallet address (your USDC sender)	Visible on the Base blockchain as part of the on-chain payment; we don’t store an off-chain copy.	Public chain (not us).	Forever on-chain. Not joined to a personal identity by us.
BIP-39 seed phrase	Only on `/v1/private/derive-viewkey`, which transforms it into a viewing key and discards.	Memory only. Never written to disk, never logged. The free derive endpoint is a transient calculator.	Zero — discarded the moment the response is returned.
IP address	Rate-limit the free derive endpoint (6/min/IP). Block obvious abuse on paid endpoints.	Process memory of the Fastify rate-limit plugin.	Sliding 1-minute window for derive; 30-day journald log retention for the access log.
Webhook delivery logs	Diagnostics so a failed delivery can be reported back to the watch owner.	journald + structured Pino logs on the same host.	30 days, then rotated out.
Aggregated counters (number of watches, total credit, …)	Powers stats.seneschal.space. Aggregates only — no per-watch detail.	SQLite snapshots refreshed periodically.	Indefinitely as aggregate numbers — never re-derivable into personal data.

What we do not collect. No name, no email, no phone number, no payment card, no government ID, no browser fingerprint, no cookies, no analytics, no third-party trackers. panel.seneschal.space loads JavaScript modules from esm.sh (a JS CDN); that CDN sees your IP for the duration of the script fetch but receives no other data from us about you. We do not embed Google, Cloudflare Analytics, Plausible, Matomo, or any other analytics product.

3. Cookies and local storage

We do not set any cookies on any subdomain. panel.seneschal.space writes your watch identifiers (watchId, watchToken, webhookSecret) to your browser’s localStorage so you can come back later, top up, or cancel. This is treated as strictly necessary storage under PECR / ePrivacy because without it the panel cannot function for you across reloads — but it is your browser’s storage, not ours, and nothing in it is ever sent to us automatically. You can clear it from the browser’s site-data tool at any time; the panel also offers an Export button so you can keep a JSON backup before clearing.

4. Who we share data with

Coinbase Developer Platform (CDP) x402 facilitator (api.cdp.coinbase.com, operated by Coinbase). Verifies and settles your USDC payments on Base. Sees the payer address (you), the recipient address (us), the amount, and your signature, and screens the payer address against sanctions / high-risk lists (Know-Your-Transaction). Does not see your view key, address, or webhook URL.
Your webhook endpoint. When funds land we POST a signed JSON body to the URL you gave us. You control that endpoint; we’re a sender, not a controller.
The local NFPT scanner (a Monero / Zcash full-node front-end we operate on the same machine). Receives your view key and address in memory in order to scan. Same retention as the watch row.
Court orders or other lawfully binding requests. We will comply if and only if we receive a valid order in our operating jurisdiction (England & Wales, see Terms §15). Because we deliberately don’t collect identity data, there is usually nothing on you to hand over.

We do not sell, rent, lease, or barter your data. We have no advertising partners. We have no “data analytics” partners. We do not enrich your data against third-party data brokers.

5. International transfers

Our server lives in the EU (Netherlands). Coinbase’s CDP facilitator is operated from the United States; transferring payment metadata to it falls under Article 49(1)(b) UK GDPR (transfer necessary for performance of a contract) and is limited to the payer/recipient/amount/signature tuple needed to verify the payment.

6. Security

All public endpoints served over TLS 1.3 (HSTS pinned).
View keys encrypted at rest with AES-256-GCM; encryption key held in environment of the API process, never in the database.
Webhook bodies signed with HMAC-SHA256 using a per-watch secret so you can detect tampering.
Webhook URL validated for SSRF (private / cloud-metadata / link-local addresses rejected; DNS resolution re-checked).
Free endpoints rate-limited to deter scraping (6/min/IP on derive-viewkey).
Database file permissions restricted to the API service user.
Code is open-source on GitHub (Rotwang9000/seneschal-data-api) so the security claims can be audited.

7. Your rights

Because you do not give us identifying information, the practical mechanism for most rights is your watchId + watchToken. With those you can:

Access (Art. 15). Call GET /v1/private/watch/<watchId> with x-watch-token to see every field we hold for that watch.
Rectification (Art. 16). Webhook URLs and birthday heights can be updated via the same endpoint family.
Erasure (Art. 17). Call DELETE /v1/private/watch/<watchId> with x-watch-token. The row is hard-deleted within 30 days; the credit balance is forfeited per Terms §6.
Portability (Art. 20). The access response is machine-readable JSON. The control panel also has an Export JSON button.
Restriction / objection (Arts. 18, 21). Same as erasure in practice; we have no marketing or profiling to restrict.
Lodge a complaint. UK residents can complain to the ICO; EU residents to their national DPA.

If you have lost your watchToken we genuinely cannot identify you to satisfy a request — the token is hashed before storage. Reach out via Telegram and we will explain what evidence (e.g. a signature from the payer wallet) might let us help anyway.

8. Automated decision-making

None. There is no profiling. The poller is a deterministic balance-diff job; nothing it does qualifies as automated decision-making under Article 22 UK GDPR.

9. Children

The service is not directed at children under 16 and is not appropriate for them. We do not knowingly process data about children.

10. Changes to this policy

Any change is published on this page with a new effective date at the top. Material changes will also be noted in SYSTEM_BIBLE.md on GitHub (the public canonical changelog).