Last updated: 19 October 2026
AgentReader (agentreader.xyz) is responsible for the data described here. Contact: contact@agentreader.xyz.
We keep as little data as we need to run and bill the Service. We don't sell data, show ads or use tracking cookies.
Request log. For each request we record:
Without the secret salt these hashes can't be matched to a known IP address, but we still treat the log as pseudonymous personal data.
Free-tier counter. To enforce 5 free reads a day, we store a keyed hash of your IP address (never the address itself) together with a daily count. With an API key, we store a hash of the key instead. To apply per-minute rate limits, our server also keeps IP addresses in memory for at most 24 hours; they are never written to disk.
API keys. We store a hash of the key (never the key itself), its first characters, any label you gave it, its creation date and your credit balance.
Payments.
Search. Your queries go to our self-hosted search instance, which forwards them to public search engines, or directly to DuckDuckGo as a fallback. Those engines see our server, not you. We don't write queries to our request log.
Cache. We keep read and search results in memory for 10 minutes so repeat requests are faster. The cache is never written to disk.
Consent cookies. When our reader accepts a site's cookie banner, we keep that site's consent cookies per domain for up to 7 days. They belong to our reader, not to you.
Server logs. Our application's error logs can include technical details of failed requests, such as the hostname involved. Our reverse proxy does not keep access logs. Server logs are removed when the application container is replaced, which happens at every update.
We use this data to provide the Service and process payments (performance of a contract), to keep payment records (legal obligation), and to keep the Service secure, prevent free-tier abuse and improve reliability (legitimate interests).
If data is processed outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
Under the GDPR you can ask for access to your data, correction, deletion, restriction, objection or a portable copy. Email contact@agentreader.xyz. To find your records we may need your IP address, API key prefix or wallet address. We reply within one month. We can't change or delete what's recorded on a public blockchain. You can also complain to your data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.
We hash API keys, store only keyed hashes of IP addresses and caller IDs, record only hostnames for reads and payments, and keep our search service on a private network. No system is perfectly secure, and if a breach affects you we'll tell you as the law requires.
The Service is meant for developers and is not directed at children under 16.
We'll post updates here with a new date, and give advance notice on the site for material changes.