# AgentReader Privacy Statement

*Last updated: 19 October 2026*

AgentReader (agentreader.xyz) is responsible for the data described here. Contact: contact@agentreader.xyz.

We keep as little data as we need to run and bill the Service. We don't sell data, show ads or use tracking cookies.

## 1. What we store

**Request log.** For each request we record:
- a short pseudonymous caller ID: a keyed hash (HMAC-SHA-256 with a secret salt kept on our server) of your IP address, or of your API key if you use one;
- a coarse user-agent family, such as "browser", "python" or "claude" (never the full user-agent string);
- the endpoint, time, status, error type and response time;
- the **hostname** of the page you read, never its path or query string;
- word, character and item counts, the page type and the settings used;
- a short keyed hash of the URL and settings, used only to spot repeated retries.

Without the secret salt these hashes can't be matched to a known IP address, but we still treat the log as pseudonymous personal data.

**Free-tier counter.** To enforce 5 free reads a day, we store a keyed hash of your IP address (never the address itself) together with a daily count. With an API key, we store a hash of the key instead. To apply per-minute rate limits, our server also keeps IP addresses in memory for at most 24 hours; they are never written to disk.

**API keys.** We store a hash of the key (never the key itself), its first characters, any label you gave it, its creation date and your credit balance.

**Payments.**
- *x402 (USDC on Base):* the paying wallet address, transaction ID, network, amount and the **hostname** of what was paid for (for a paid read, the hostname of the page, never its full URL). Blockchain transactions are public by nature.
- *Card packs:* Thirdweb and its card processor handle your card details and identity checks under their own privacy terms, and we never see your card details. We record only the resulting on-chain transfer and link it to your API key and order.

**Search.** Your queries go to our self-hosted search instance, which forwards them to public search engines, or directly to DuckDuckGo as a fallback. Those engines see our server, not you. We don't write queries to our request log.

**Cache.** We keep read and search results in memory for 10 minutes so repeat requests are faster. The cache is never written to disk.

**Consent cookies.** When our reader accepts a site's cookie banner, we keep that site's consent cookies per domain for up to 7 days. They belong to our reader, not to you.

**Server logs.** Our application's error logs can include technical details of failed requests, such as the hostname involved. Our reverse proxy does not keep access logs. Server logs are removed when the application container is replaced, which happens at every update.

## 2. Why (legal basis)

We use this data to provide the Service and process payments (performance of a contract), to keep payment records (legal obligation), and to keep the Service secure, prevent free-tier abuse and improve reliability (legitimate interests).

## 3. Sharing

- **Hosting:** Oracle Cloud, Frankfurt, Germany (EU).
- **Payments:** Thirdweb and its card processor, and the Base blockchain.
- **Websites you read** see our server, not your IP address.
- **Search engines** receive your queries from our server.
- **Authorities**, where the law requires it.

If data is processed outside the EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

## 4. Retention

- Request log: 30 days, then deleted automatically.
- Free-tier counters: 7 days, then deleted automatically.
- API key records: as long as the key exists. We delete a key on request, after any unused credits are settled.
- Payment records: 7 years, as required by Dutch tax law.
- Cache: 10 minutes.
- Consent cookies: up to 7 days.
- In-memory rate-limit data: at most 24 hours.

## 5. Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction, objection or a portable copy. Email contact@agentreader.xyz. To find your records we may need your IP address, API key prefix or wallet address. We reply within one month. We can't change or delete what's recorded on a public blockchain. You can also complain to your data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens.

## 6. Security

We hash API keys, store only keyed hashes of IP addresses and caller IDs, record only hostnames for reads and payments, and keep our search service on a private network. No system is perfectly secure, and if a breach affects you we'll tell you as the law requires.

## 7. Children

The Service is meant for developers and is not directed at children under 16.

## 8. Changes

We'll post updates here with a new date, and give advance notice on the site for material changes.