Privacy Policy

Applies to: https://payweeb.com, every creator page hosted on it, the alert overlay, and the PayWeeb API.

This policy is written to be accurate to what the software actually does, not to cover the operator with vague language. Where it says "we store X", there is a column in the database that holds X. Where a limit exists, it is stated.

PayWeeb is a service for receiving crypto donations. That means there are two kinds of people in here, and the second kind never signed up for anything:

• Creators have accounts, public pages and balances.
• Donors have none of those. They arrived at a creator's page and sent crypto. We still end up holding data about them, so section 3 is written for them.

1. Who is responsible for your data

PayWeeb is operated by [full legal entity name], [entity type and registration number], of [registered address].

Privacy contact: [privacy contact email address].

If you are not satisfied with how we handle a privacy request, you can complain to [name of the relevant privacy regulator and its contact details].

2. What we collect from creators

2.1 What we do not collect

We want to be clear about this first, because it is unusual:

• We do not collect your name, date of birth, postal address or phone number.
• We do not collect government identity documents. There is no identity verification (KYC) step in the product today, for creators or for donors. If that changes, this policy will be updated before the collection starts.
• We do not collect payment card or bank account details. There is no card processor and no fiat rail.
• We do not run analytics, advertising or session-replay scripts. There are no third-party trackers on the site and no advertising cookies.

2.2 Your account

We never store your password. We store a bcrypt hash of it. A hash cannot be turned back into the password. We cannot tell you what your password is, and neither can anyone who steals the database — though a weak password can still be guessed offline, which is why the minimum length is 12 characters.

2.3 Your public creator profile

This is the data you are choosing to publish. Anyone can read it without an account, and search engines can index it.

Your email address, your balance, your transaction history and your withdrawal addresses are not shown on your page.

Handles are drawn from a shared namespace and some are reserved. A handle you release when you close your account can be claimed by someone else.

2.4 Your alert overlay token

Treat this token like a password. Anyone who has your overlay URL can watch your donations arrive in real time and can fire test alerts on your stream. It is not a password we can recover for you — if it leaks, rotate it.

2.5 Security and abuse-prevention data

Two honest notes about this:

1. Your IP address is stored in clear in the rate-limit table. It has to be, because the limiter has to recognise the same IP on the next request. Those rows are short-lived (see retention, section 8).
2. The audit log is append-only by design. A database trigger blocks UPDATE and DELETE on it. This is deliberate — an audit log you can quietly edit is not an audit log. It means that when you ask us to delete data, audit rows are one of the things we cannot simply remove. See section 10.

We read your IP from Cloudflare's cf-connecting-ip header, because that is the one header a client cannot forge once traffic passes through Cloudflare.

3. What we collect from donors

You do not have an account, you did not register, and you almost certainly did not read anything before you sent money. This section is what we hold about you anyway. It is short, because there is not much of it — but the part that is published is published very publicly.

3.1 What you typed

Both are optional. A donation can be sent without either.

We do not read them before they are shown. There is no moderation step and no human in the loop. They go from your keyboard to a live stream.

3.2 What the transaction itself tells us

To attribute your donation we create an address just for it, and we record:

• that address, and any destination tag or memo;
• the asset and network you used;
• the amount, our fee and the net amount;
• the provider's transaction identifier and the on-chain transaction hash;
• when the donation was created, when it was paid, and when the alert fired.

We do not ask you for your name, your email address, or any account details, and we do not collect them.

3.3 Your IP address

Your IP address is used for rate limiting when you start a donation, in the same clear-text form described in section 2.5, and is pruned on the same schedule. It is also seen by Cloudflare (section 6).

3.4 The part that cannot be undone

Read this before you type anything into a donation form.

Your name and message are broadcast to an audience. In normal use that is a live stream watched by strangers. That stream is very often recorded, clipped, re-uploaded and archived by people who have nothing to do with us.

• We cannot un-broadcast a message. Once it has been on screen, it has been seen.
• We cannot delete someone else's recording, VOD, clip or screenshot. Those are not ours, they are not on our systems, and no privacy right anyone grants you reaches them.
• If you asked us to, we could remove the text from our own copy — see section 10 — and it would change nothing about the copies that already exist elsewhere.

So: do not put your real name in there unless you mean to. Do not put your email address, your phone number, your address, a link you would not post publicly, or anything about another person. This is the single most common way a donor exposes themselves on a platform like this, and it is entirely preventable at the moment of typing.

4. Custody, ledger and transaction data

This is the record of the money. It is the most sensitive data we hold and the data we are least able to delete.

• Donation intents — one row per donation attempt: the creator it is for, the asset, the address we minted for it, any destination tag, the provider's wallet and address identifiers, the donor name and message, the status, and when it was created and expires.
• Donations — the donation intent it belongs to, the creator, the asset, the gross amount, our fee and the net amount, the provider's transaction id, the ledger transaction it posted, the donor name and message, and when the alert fired.
• Deposit addresses — for a creator's own deposits, one blockchain address per (creator, asset), plus any destination tag or memo, the provider's wallet and address identifiers, the provisioning status, and any error text returned while creating it.
• Deposits — the provider's transaction id, the on-chain transaction hash, the receiving address, gross amount, fee, net amount, confirmation count, status, and the complete raw JSON the provider sent us about that deposit.
• Withdrawals — the destination address the creator typed, any destination tag, the amount, the quoted and actual network fees, the provider's spend-request id, the on-chain transaction hash, the status, and any failure reason.
• Conversions between assets — the assets, the exact integer amounts, the fee, the rate recorded for audit, and when the quote was created, expired or consumed.
• The ledger itself — every movement of value, as double-entry postings, with the balance after each entry. Our 1% fee on a donation is posted in the same atomic transaction as the credit to the creator, so the two can never disagree. ledger_entries and ledger_transactions are append-only; a trigger blocks UPDATE and DELETE. A mistake is corrected by posting a compensating adjustment, never by erasing history. This is what makes the balances trustworthy, and it is also why financial history cannot be rewritten on request.

5. Webhook payloads, cookies and logs

5.1 Webhook payloads from our custodian

When CoinPayments notifies us about a deposit, a donation or a withdrawal, we store the notification in webhook_events: the exact raw bytes of the request body, the request headers, whether the signature check passed, when it arrived, when we processed it, and any processing error.

We keep the raw bytes verbatim for two reasons: the message signature is computed over those exact bytes, so altering them would destroy our ability to prove the message was genuine; and if a donation is ever disputed, the original notification is the evidence. Those bodies contain the address, the amount and the on-chain transaction hash.

5.2 Application logs

The server writes structured JSON logs. They contain a request id, the event, and context such as an asset id, a user id, a transaction hash or an IP address.

The logger runs a hard redaction pass over everything before it is written:

• Any field whose name looks like a credential (secret, password, token, key, authorization, cookie, signature) is replaced with [REDACTED] without the value ever being examined.
• Any field naming a whole request or response body is replaced with [OMITTED].
• Every surviving string is scanned for known secret values and for credential-shaped text — JWTs, bearer headers, ?token= parameters, private keys, and any URL on a verification or password-reset path.

The practical effect: a session cookie, a verification link, a reset link and an alert-overlay token cannot end up in a log line, even by accident.

5.3 Cookies

PayWeeb sets one cookie.

This cookie is strictly necessary. Without it there is no way to stay logged in, so there is no consent banner and no opt-out — refusing it is the same as not logging in. HttpOnly means page scripts cannot read it. SameSite=Strict means no other website can cause your browser to send it.

Donors are not given a cookie. Visiting a creator page and sending a donation sets nothing on your device.

Logging out increments a counter on the account that invalidates every session token issued before that moment, so logging out really does end the session rather than just clearing the cookie on your own machine.

There are no analytics cookies, no advertising cookies and no third-party cookies.

5.4 Legacy data

An earlier version of PayWeeb generated wallet keys itself. The wallets, balances and transactions tables from that design still exist and may still contain encrypted private key material. They are frozen: a database trigger blocks all inserts, updates and deletes. Nothing writes to them and nothing reads them on the live money path. [state the date by which this legacy key material will be exported and destroyed, and confirm when it has been.]

6. Why we use it, and our legal basis

[confirm the privacy law that actually governs this service — for an Australian operator that is likely the Privacy Act 1988 (Cth) and the Australian Privacy Principles; the GDPR bases above apply if you serve users in the EU/UK. Delete whichever column does not apply.]

We do not sell your data. We do not share it for advertising. There is no advertising on PayWeeb.

7. Who else receives your data

Three companies, each for a specific and necessary job.

CoinPayments — custody and on-chain transfers

CoinPayments holds the actual cryptocurrency and broadcasts the actual transactions. We send them the requests needed to mint each donation address and each creator deposit address, and the destination address and amount for every withdrawal. They send us back address details, transaction identifiers and status notifications.

CoinPayments does not receive email addresses, password hashes, donor names or donor messages. It does receive an internal account label derived from the creator's PayWeeb account, which links that creator's addresses to one another.

[link to the CoinPayments privacy policy and name the jurisdiction its processing takes place in.]

Resend — email delivery

Verification and account emails are delivered through Resend. Resend receives the creator's email address and the contents of the message we send. Donors receive no email from us, because we do not have their address. [if the Gmail API fallback transport is ever enabled in production, add Google here and say so — the code supports it, and this section must match the deployment.]

[link to the Resend privacy policy.]

Cloudflare — proxy and tunnel

All traffic to payweeb.com passes through Cloudflare, which terminates TLS and forwards the request to our server through a Cloudflare Tunnel. Cloudflare therefore sees your IP address, the pages you request — including which creator page you visited — and standard request metadata, and applies its own bot and abuse protections. This applies to donors and to viewers, not only to creators.

[link to the Cloudflare privacy policy.]

The creator's audience

This is not a company, but it is the most consequential recipient of all. A donor name and message go to the creator, to their overlay, and from there to everyone watching. See section 3.4.

Where the data lives

The PayWeeb database and application run on hardware operated by [describe the hosting — e.g. "a machine we control in Sydney, Australia", if that is accurate]. Our three service providers process data in their own regions, which may be outside your country. [name the transfer safeguard you rely on, if any.]

Everyone else

We will also disclose data where we are legally required to — a court order, a valid law-enforcement request, or a regulator exercising a power to compel. We will tell you when that happens unless we are prohibited from doing so.

8. How long we keep things

9. Blockchain data is public and permanent — we cannot delete it

This is the most important paragraph in this policy.

When crypto moves on a blockchain, the record of that movement is published to a public network and copied to thousands of independent computers around the world. Anyone can read it. It is designed to be impossible to alter or remove.

That means:

• Every donation address, the amounts sent to and from it, the transaction hashes, and the timestamps are public forever.
• Anyone who knows one of your addresses can see its entire history, including transactions that had nothing to do with PayWeeb.
• This cuts both ways on a donation platform. A donation address is created for one donation to one creator. Anyone who can see that address — and it was displayed on a page — can see the wallet that paid it. Donating from a wallet that is linked to your identity publicly links you to that creator, forever. If that matters to you, do not donate from your main wallet.
• Because transfers into a custodial platform are consolidated, addresses can be linked to each other by analysis. Blockchain analytics firms do this commercially and we have no control over them.
• We cannot delete any of it. Not on request, not by court order, not at all. No one can. Deleting our copy changes nothing, because the chain is not our copy.

Before you send anything to PayWeeb, understand that the on-chain part of the transaction is permanent and public, and that no privacy right anyone grants you can reach it.

10. Your rights

Subject to the law that applies to you, you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete your data — see the limits below.
• Export your account and transaction data in a machine-readable form.
• Object to or restrict some processing.
• Complain to a regulator without going through us first.

Creators: email [privacy contact email address] from the address on your account. If we need to verify it is really you, we will ask you to prove control of the account email — we will never ask for your password.

Donors: you can make a request too, and you do not need an account. Email the same address. The practical difficulty is that we hold almost nothing that identifies you, so to find your records you will need to give us something that links you to them — usually the on-chain transaction hash, or the donation address, or the exact name and message and roughly when you sent it. Please do not send us identity documents; we do not want them and we would only be creating a new copy of your personal data to protect.

We will respond within [statutory response period, e.g. 30 days].

The limits on deletion

We will honour a deletion request as far as we lawfully can. Here is exactly what we can and cannot remove.

We can delete or de-identify: a creator's email address, password hash, verification and reset tokens and login counters; a creator's handle, display name and tagline; an alert token; and the donor name and message stored against a donation, which we can blank on request without breaking the financial record, because they are descriptive text rather than accounting data.

We cannot delete:

• Ledger entries, donations, deposits, withdrawals and conversions. These are financial records. We are required to keep them for anti-money-laundering and accounting purposes, and they are structurally append-only — the database refuses to delete them. Deleting one side of a double-entry posting would also corrupt the balances of accounts that are not yours.
• Audit log entries, for the same reason.
• Anything already broadcast. A message that has appeared on a stream is out of our reach, and so is any recording of it. See section 3.4.
• Anything on a blockchain. See section 9. This is not a policy choice.

Where we cannot delete a record, we will de-link it from you as far as the integrity of the financial record allows, so that what remains is a transaction history rather than a person.

A creator cannot delete an account that still holds a balance. Withdraw the funds first. A closure request on a funded account will be treated as a request to withdraw, and we will contact you about where to send the money.

11. How we protect your data

What we actually do, stated plainly and without promising more than is true:

• Passwords are hashed with bcrypt. Plain-text passwords are never stored, logged, or emailed.
• The minimum password length is 12 characters.
• Session cookies are HttpOnly, Secure and SameSite=Strict.
• Logging out revokes every outstanding session token for your account immediately.
• Alert tokens are at least 32 random characters, are unique, can be rotated by you at any time, and are redacted out of every log line.
• Donor names and messages are length-capped and are rendered as text, never as markup or script. A donor cannot inject anything executable into a creator's overlay, however hard they try.
• Login, registration and donation creation are rate limited on both IP address and target, with exponential backoff, so an attacker cannot spread an attack across many IPs to get around the limit.
• An account locks for 15 minutes after 10 consecutive failed logins.
• Login takes the same amount of time whether or not an account exists, and registration returns the same response either way, so neither can be used to discover which email addresses are registered.
• Email verification is mandatory. An unverified account cannot log in.
• The logger redacts credentials at three independent layers before writing.
• All traffic is encrypted in transit via Cloudflare.
• The money-movement path goes through a single database function that enforces double-entry balance and idempotency, so a replayed webhook cannot credit a donation twice.

And what we will not claim: PayWeeb is run by a small team on modest infrastructure. No system is unbreakable, and we are not going to pretend ours is. Use a unique password. Do not reuse the one from your email account.

12. Children

PayWeeb is not for children. You must be at least [minimum age — 18 in most jurisdictions] to open a creator account or to send a donation.

We do not knowingly collect data from anyone under that age. If we learn that an account belongs to someone under it, we will close the account, remove the public page, delete the personal data we can delete, and return any remaining balance to [state where funds go — normally the source address or a verified parent/guardian]. If you believe a child has an account, or that a child sent a donation, contact [privacy contact email address].

Creators should be aware that an alert overlay showing unmoderated text from strangers is not appropriate on a stream aimed at children.

13. Reporting content about you

If a creator page, a display name, a tagline, or a donor message published through PayWeeb contains your personal information, defames you, or is otherwise unlawful, you can tell us — you do not need an account. Email [abuse and takedown email address] with the handle, what you saw and when.

We can remove a page, reset a handle, blank stored donor text, and disable donations. We cannot remove a recording made by someone else, and we cannot undo a broadcast that has already happened.

[state your target response time for these reports, and make it one you can actually meet.]

14. If there is a data breach

If personal data we hold is exposed in a way that is likely to cause you serious harm, we will:

1. Contain it and work out what was affected.
2. Tell affected creators directly, by email, at the address on the account — not by a quiet note on a status page. Where donors are affected we will publish the notice prominently, because we have no way to email you.
3. Tell you what was taken, what we have done, and what you should do (for example: change your password, and change it anywhere you reused it; or rotate your alert token).
4. Notify [the relevant regulator — for an Australian operator this is the OAIC under the Notifiable Data Breaches scheme] within [statutory deadline, e.g. 30 days for the NDB scheme, 72 hours under GDPR].

We will not delay telling you in order to make the incident sound better.

15. Changes to this policy

If we change this policy in a way that materially affects you — new data collected, a new third party receiving it, a shorter retention period — we will email creators at least [notice period] before the change takes effect, and publish the change here. We cannot email donors, so for donors a change takes effect when it is published. Minor corrections will be published with an updated date at the top of this page.

16. Contact

• Privacy questions and requests: [privacy contact email address]
• Abuse, impersonation and takedown: [abuse and takedown email address]
• General support: [support contact]
• Postal: [registered address]

See also: the Terms of Service, and the Risk Disclosure — which explains, in plain English, how you can lose money using this service.