Verilot is a read-only diagnostic at /check: a free capped scan, and a one-time tax-year pack. There are no accounts and no passwords. Card payments go through Stripe's checkout; we never see the card. This page describes what we actually collect today — checked line by line against the code that runs this site — rather than a template we intend to grow into later.
What we collect
Waitlist signup: the email address you type into the waitlist form (it appears on the landing page and on the scan result screen). Stored with it: the campaign tags that were in the URL you arrived with, if there were any (utm_source, utm_medium, utm_campaign, utm_content), so we know which channel is working, and which of two copy variants the page showed you — one letter, "a" or "b". We do not store your referring page, your IP address, or any browser fingerprint with the signup. The form also carries a hidden anti-spam field that must stay empty; whatever a bot types there is discarded and never stored.
Free scan (/check): the wallet addresses you paste in, plus the optional "analyze up to" date. Addresses are public on-chain data — the same information anyone can look up on a block explorer — and we read them to run the diagnostic. Running a scan necessarily means sending those addresses to the public chain-data services listed further down; that is how any tool reads a public blockchain. We never ask for private keys, seed phrases, or wallet-connect signatures, and the scan cannot move funds. Your addresses are not written into any database of ours — see retention below for exactly where they do and do not live. You can optionally ask this browser to remember the addresses you typed so you do not have to re-paste them next time; that copy stays on your device and is described under What stays in your browser.
Your IP address, for abuse control only: the scan and the save-a-result endpoint are rate limited, so the server holds your IP address in its own working memory to count recent requests within a one-hour window. It is not written to a database, not attached to your email or your scan results, not sent to our analytics provider, and it is gone when that server instance is recycled. (Until 2026-07-29 one request — the preview image generated when a saved link is unfurled by a chat app — did forward the requester's IP to our analytics provider, which contradicted this paragraph. That was found in a security audit and removed the same day; it is written here rather than quietly corrected.)
Saved results (only if you ask for one): a scan normally lives in your browser and nowhere else — reload the page and the result is gone. (The one exception is the addresses you typed, and only if you asked for it: ticking "Remember these addresses in this browser" on /check keeps them on your device so the form refills itself. The result is still not kept, by us or by your browser. See What stays in your browser.) If you press "Save & get a shareable link" on the result screen, we store that one result so the link keeps working: the dollar figures and counts, the transaction hashes behind each flag, and shortened wallet addresses (0x1234…abcd). We do not store your full wallet addresses, and a saved result carries no email, no account, and no IP address. The link is unguessable, is marked noindex so search engines never list it, and anyone who has it can read the result — including the transaction hashes, which are public on-chain records that can be looked up on a block explorer. Share it accordingly. Sending addresses suggested after a live scan stay in that tab and are not stored with a saved result. Saved results delete themselves 400 days after they are created, and the person who created one can delete it immediately from the confirmation panel.
Analytics: we use a cookie-less, privacy-respecting analytics provider (Plausible) to measure page views and conversion events. Analytics itself does not use cookies or collect personal identifiers, and does not track you across other sites. One specific thing we do on top of that: the address of a saved-result page is itself the secret that protects it, so every /r/… link is rewritten to a single placeholder before any analytics event leaves your browser, and the preview image our server reports is counted under the same placeholder. We can see how many saved results were opened; we cannot see which ones from analytics. Separately from analytics, this site keeps a small number of things on your own device — the next section lists every one of them.
What stays in your browser
Three things can sit on your device. None of them is an advertising or tracking identifier, and clearing this site's data in your browser removes all three.
One first-party cookie (basis_v): our landing page includes a mechanism for running single-variable copy experiments: each visitor is assigned one of two copy variants, and to keep that assignment consistent between visits we set a single first-party cookie named basis_v. It stores one letter ("a" or "b"), expires after 30 days, contains no personal information, and is not used to track you — on this site or anywhere else. At the moment the two variants contain identical copy, so the assignment has no visible effect; the cookie is what we use when an experiment is actually running. We set no third-party or advertising cookies.
Remembered addresses (only if you tick the box): /check has a checkbox reading "Remember these addresses in this browser". It is off unless you tick it, and nothing is written until you do. Ticking it writes the wallet addresses currently in the form — up to five, and only well-formed ones — to this browser's localStorage under the key verilot_wallets_v1, and each scan you run while it stays ticked replaces them with the addresses you just scanned. Stored with them is the time they were saved, so the page can tell you which scan the refilled fields came from, and the "analyze up to" date so the next tax year can reuse the same cutoff shape. That copy is never sent to us, never attached to a saved result link, and never used to identify you; it stays on your device and we hold no copy of it. Unticking the box or pressing "Forget saved addresses" deletes it immediately. If your browser blocks storage — private mode, storage disabled, no room — nothing is stored and the scan works exactly as before.
A scan session id (verilot_sid): when you run a scan, the page generates a random id and keeps it in sessionStorage, which your browser discards when you close the tab. It is sent with the scan request and used for one thing: stopping the same browser from starting a second scan while the first is still running. It contains nothing about you, is never written to our database, is never sent to our analytics provider, and exists on our side only in the working memory of the server instance handling the request.
The complete evidence package: if this browser holds a tax-year pack and you download the un-watermarked package, the report already shown on the result page is sent to our server so we can apply the entitlement gate. We do not store that report. The free, watermarked sample is assembled in the browser and is not sent.
What we do not collect
No names, postal addresses, or phone numbers. Payment card data, if you buy the tax-year pack, is taken by Stripe on their checkout page — it never touches our servers. We store only a signed entitlement token in this browser underverilot_pack_v1 so the next scan can raise the event cap; we do not keep a copy of the token on our side beyond verifying it. No private keys, seed phrases, or wallet-connect signatures. No accounts or passwords, because the product has none. No advertising or retargeting pixels, and no third-party trackers. We have never sold or shared personal information with a data broker or an advertiser, and we do not intend to.
Who else touches your data
Verilot is one person plus a small set of outside services. These are all of them:
Vercel — hosting. Every request to this site passes through it, including your IP address and the page or endpoint you asked for.
Supabase — the database that holds waitlist emails and saved results. Row-level security is on with no public policies, so only this site's server can read or write those tables; there is no anonymous access path.
Plausible Analytics — page views and conversion events. Per its published documentation it sets no cookies and stores no IP addresses.
Stripe — checkout for the tax-year pack. The charge happens on their page; card numbers never reach our servers. We receive only a session id so we can mint the entitlement token this browser stores.
Blockscout (eth.blockscout.com; for Base and Arbitrum scans, base.blockscout.com and arbitrum.blockscout.com) — the public block explorer API we read transaction history from. It receives the wallet addresses you submit, because that is the request being made on your behalf.
Public RPC endpoints (eth-mainnet.public.blastapi.io, eth.drpc.org, 1rpc.io; for Base and Arbitrum scans, base-mainnet.public.blastapi.io, arbitrum-one.public.blastapi.io, base.drpc.org, arbitrum.drpc.org) — used to read transaction receipts (for exact gas), historical balances for the tie-out check, and to resolve ENS names you type into the scan form. They receive a wallet address, an ENS name being resolved, or a transaction hash, and a block number. The first endpoint in each chain’s ladder is tried first, so it is the one that sees most of this traffic.
DefiLlama (coins.llama.fi) — daily USD price series. It receives token contract addresses and date ranges only, never your wallet addresses.
Coinbase's public market-data API (api.exchange.coinbase.com) — a second, independent price source we check the first one against, so a bad price feed cannot quietly become a wrong dollar figure in your result. It receives a trading pair (ETH-USD) and a date. It is sent nothing about you: no wallet address, no IP of yours, no identifier — the request is made by our server for a public market price.
There is no email marketing platform, no CRM, and no ad network in this list because we use none. These providers operate internationally and may process data in the United States and elsewhere; we use them on their standard published terms and have not negotiated bespoke data-transfer agreements. If your firm needs specifics for a vendor review, email us and we will answer them directly.
How long we keep things
Waitlist email (with its campaign tags and copy variant): kept until you ask us to delete it. The product is live; this list is for product updates, not a launch wait.
Wallet addresses from a scan: never written to our database. They live in the server's memory while the scan runs, and in a temporary snapshot file on that server instance's scratch disk so a repeat scan of the same address is fast. That scratch disk belongs to the instance, not to us: it is destroyed when the instance is recycled — typically minutes to hours later, and always when a new version of the site is deployed. It is never backed up and never exported. We are telling you the mechanism rather than quoting a number we cannot enforce.
A result you explicitly saved: 400 days from creation, then deleted automatically. Two things enforce that, because one of them is not enough: a scheduled job in the database deletes every expired result once a day whether or not anyone ever looks at it, and an expired link is deleted on the spot if someone does try to open it. You can also delete it yourself at any time using the delete link shown when it was created. (Until 2026-07-29 only the second mechanism existed, so a saved result nobody reopened was kept past its date. Found in an audit, fixed the same day, and written down here rather than quietly corrected.)
Addresses this browser remembered for you: until you delete them. They sit in your browser, not in our systems, so this is not a period we set or could enforce: unticking the box, pressing "Forget saved addresses", or clearing this site's data removes them on the spot.
Logs: Verilot's own code writes no log line containing your email, your wallet addresses, or your results; the only thing it logs on a hard failure is a truncated internal error message. Separately, our hosting provider automatically records short-lived request logs that can include your IP address and the path you requested. Those sit under the provider's own default retention for our plan (on the order of hours), we have not extended it, and we keep no copy of them anywhere.
To have your data deleted, email the address at the bottom of this page from the address you signed up with. We action deletion requests within a few business days and confirm when it is done. There is no account to log into and no fee.
Your rights — including US state privacy laws and the GDPR
The only personal information we hold is an email address you typed in yourself, with the campaign tags and copy variant recorded next to it. Everything else here is either public chain data or is not stored at all. That keeps this section short and honest. The addresses your browser can remember for you are a case of the second kind: they never reach us, so an access or deletion request sent to us has nothing to return — the controls on /check are what delete them, instantly.
Anyone, anywhere: ask us what we hold about you, ask us to correct it, or ask us to delete it. Email us and we will do it within a few business days.
California and other US state privacy laws: we do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are used in the CCPA/CPRA and comparable state laws. We do no profiling and no automated decision-making about you, and we collect no sensitive personal information. California residents can exercise access, correction, and deletion rights by emailing us, and we will not treat you differently for asking. We do not offer financial incentives for data.
EEA and UK (GDPR): the data controller is the operator described in the Legal Notice, reachable at the email below. Our legal bases are your consent for the waitlist email — withdraw it at any time by asking us to delete it, which does not affect processing already carried out — and legitimate interest for keeping the free scan available and free of abuse and for cookie-less aggregate analytics. Storing addresses on your device happens only on your explicit opt-in — the box is off by default and asks first — and withdrawing that consent is unticking it, which erases what was stored without anything having to reach us. You have the rights of access, rectification, erasure, restriction, objection, and portability, and you may lodge a complaint with your national supervisory authority.
Children: Verilot is not directed to children, and we do not knowingly collect information from anyone under 16. If a child's email reached our waitlist, tell us and we will delete it.
Security, and how to report a problem
What we do: we never ask for a key, a seed phrase, or a signature, so there is nothing in our database that can move your funds. The tables holding waitlist emails and saved results are locked to server-side access only. Scan results are signed server-side, so figures published on a shared result page cannot be forged. Scan and save endpoints are rate limited.
If you find a vulnerability, please email support@verilot.app with "SECURITY" in the subject line. The full reporting policy — what we ask of you, and what we commit to in return — is on the Legal Notice.
Who operates Verilot
Verilot is built and operated by one person: an individual proprietor (sole trader) established in Japan, trading as KIZUNA Creation, working in the open. There is no company, no team, and no investor behind it — where this site says "we," it is one person writing. See the Legal Notice for how operator disclosure is handled at this stage, and the Terms of Service for governing law and the limits of our liability.
Changes to this policy
When what we collect changes, this page changes with it and the date at the top moves. Material changes are posted here before they take effect. We do not have an email newsletter, so this page is the place to check.
Contact
Questions about this policy, or a data deletion request? Email support@verilot.app.