Privacy policy

FixMyBags is built to know as little as possible about the people who use it. This policy says what is processed when you use the site, the app, the API or the MCP endpoint, why, where, and for how long.

The short version

• No account, no login, no email address, no name.
• No analytics, no advertising, no tracking cookies, no fingerprinting.
• Sealed case files are encrypted in your browser; we hold the ciphertext and never the key.
• We do not record which wallet paid for which case.

What we process

When you open a case

The address you investigate and your payment (a signed USDG authorization, or a burn transaction with a signature from the burning wallet). The server uses the payment to check and settle it, then discards the request. The case file is returned to you once; the server keeps the case id and the file's SHA-256 hash, which are needed to anchor the file and to verify it if you later open it. It does not keep the plaintext of a sealed file, the target of a sealed case, or a link between the paying wallet and the case.

A USDG payment or a burn is a public transaction on Robinhood Chain, visible to anyone, as every on-chain transfer is. That record exists on the chain independently of us and cannot be erased by anyone.

Sealed files

Your browser encrypts the file with AES-256-GCM using a key it generates, and uploads the ciphertext and its IV. We store the ciphertext so that your private link works. The key lives in the link after the #, which browsers do not send to servers, and in your browser's local storage. We cannot read a sealed file.

Opened files and Night Watch files

A file you choose to open, and every file the Night Watch writes about a new launch, is public: it is stored in plaintext and shown on the board. Opened files contain readings of public chain data about the target and nothing about you.

Technical logs

Our host keeps standard request logs (time, path, status, IP address, user agent) for a short period for security and operations. Request bodies, where targets and payments travel, are not logged by us.

Portfolio scans and vaults

A portfolio scan reads the address you give from the chain and returns the result to you; the address is not stored. Grades are cached per token, not per wallet. If you open a vault, its address, its owner and every trade the agents make are public on Robinhood Chain by nature; the reasons the agents give for each trade are kept with the vault's address in our storage and shown in the app and in the agents' public record.

Where it runs

• Hosting and serverless functions: Vercel.
• Storage of ciphertexts, public files and the anchor queue: Vercel Blob.
• Chain reads: Robinhood Chain's public RPC, made from our servers, not from your browser, for case work.
• Verified source lookups: Sourcify.
• Written summaries: only when enabled, the findings of a paid case are sent to Anthropic's API to write its summary. They contain the target's address and public chain readings, nothing about you.

Some of these providers process data outside the European Economic Area, under their own standard contractual safeguards.

Your browser's storage

The site stores two entries in your browser's local storage: pe:consent (your cookie choice) and pe:files (the list of your case files with their keys). Both stay on your device. Clearing your browser data deletes them, and with them the keys to your sealed files. The cookies policy has the details.

Legal bases

Running a case you ask for is the performance of that request. Security logs rest on our legitimate interest in keeping the service available and safe. Nothing is processed on the basis of profiling or for marketing.

Retention

• Ciphertexts: kept so your link keeps working; deleted on request.
• Case id and file hash: kept with the anchor, as they are what proves a file.
• Public files: kept on the board.
• Payment locks (a record that an authorization nonce or a burn has been used, without the case it paid for): kept to stop double spending.

Your rights (GDPR)

If the General Data Protection Regulation or a similar law applies to you, you have the right to ask what personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. Because we hold no account and no link between wallets and cases, there is usually nothing we can attach to you; we will still answer every request. You can ask for a sealed ciphertext to be deleted by giving its case id. You also have the right to lodge a complaint with your data protection authority.

Contact: by direct message to @fixmybags on X.

Changes

When this policy changes, the date at the top changes with it.