Privacy Policy

Effective 29 July 2026

Data controller: Hongkong Hongzhao Technology Limited (香港弘昭科技有限公司), Rm 03, 24/F, Ho King Commercial Centre, 2–16 Fa Yuen Street, Mong Kok, Hong Kong. Business Registration No. 77605835-000. Contact: privacy@onchainwho.com.

1. If you are searching

onchainwho has no accounts and no login. We do not ask you for anything to run a search. We log the address you searched and a timestamp, in order to run the service, prevent abuse and understand which addresses are in demand. We do not log who searched.

If you buy a report, our payment processor (Stripe) collects your email and payment details in order to take payment. We receive your email and the address you want researched. We never see your card details.

2. If you were searched for

We show information that is already published on public registries. We process it on the basis of legitimate interest in operating a transparency and due-diligence tool over public blockchain data.

Specifically, we read:

• ENS text records — set by the address owner themselves
• Farcaster — the account verified against the address, and the profile fields its owner typed
• Snapshot governance votes — signed by the address owner
• Public transaction history on Ethereum mainnet, via block explorers — when an address first transacted, which address first sent it funds, and which addresses it transacts with most
• A hand-curated list of well-known contracts and exchange wallets

We do not collect or process: biometric or facial data, private messages, phone numbers, home addresses, government identifiers, data from brokers, or leaked datasets.

We do read transaction patterns.An earlier version of this policy said we did not, and that stopped being true when we began showing an address’s first funder and its most frequent counterparties. Those are read from the public chain and shown as what they are — transactions — and we do not present them as an identity. Our paid research reports go further and follow a funding chain by hand. If you would rather not have this read about an address you control, see section 3.

3. If you buy something

Paying for a report is the only point at which we hold anything personal about you, and it is the minimum that makes delivery possible: the email address you give us, the address or list you want checked, and whatever context you choose to add. That is the whole record. There is no account, no password, and nothing to log into.

The context field is optional and it is genuinely free text — whatever you write there we read, so do not put anything in it you would not want a person to see. It exists because a conclusion about an address is far more useful when we know what the deal is.

Card details never reach us.Checkout runs entirely on Stripe and is sold through Link, so Stripe holds the payment record and we hold an order. We keep orders for two years, because a buyer asking “what did you tell me about this address last year” is a reasonable question and we would like to be able to answer it. Ask and we will delete yours sooner.

The address you ask us to research is treated exactly like a search: it is public blockchain data. Your email is not shared with anyone, is not used for marketing, and is not added to any list.

4. Your rights

Wherever you live, you can ask us to: tell you what we hold about an address, correct it, delete it, or stop processing it. Email privacy@onchainwho.com and we will respond within 30 days, free of charge.

You do not need to prove ownership of an address to request its removal from our index. If you are in the EEA or UK you also have the right to complain to your data protection authority.

5. Retention

• Search logs (the address and a timestamp, never who searched): 90 days, then deleted automatically
• Cached chain facts: kept indefinitely. When an address first transacted and who first funded it are historical facts that cannot change, so we store them once instead of asking a block explorer again for every visitor. Deleted on request.
• Paid report records: kept as long as required for tax and accounting

6. Sharing

We do not sell or share search data. We use Stripe for payments and Cloudflare for hosting, storage and delivery; they process data on our instructions in order to run the service. Public chain data is read from block explorers (Routescan and Blockscout) and from Farcaster infrastructure (Neynar and a public Farcaster hub); we send them an address, never anything about you.

7. Changes

We will update the effective date above when this policy changes, and we will not start processing a materially different kind of data without saying so here first.