Privacy Policy
Last updated: 3 October 2026
Scope and contact
This policy describes OnChainDiligence's free public MCP tools, its free observation-only receipt endpoint, and the relevant data handling of the wider OCD service. Contact the OnChainDiligence operator at support@onchaindiligence.com with privacy questions or requests.
Free Plugin inputs and purposes
Payment inspection processes the public wallet addresses, network, token contract, amount, optional resource URL and policy constraints you supply to compute a deterministic comparison. Resource URLs are parsed, not fetched. Receipt retrieval uses an exact public receipt ID. Verification processes either a public receipt ID or the signed envelope you choose to provide, to check its structure and proof. Do not submit private keys, API keys, passwords, MFA or one-time codes, recovery credentials, payment authorizations, private URL parameters or unrelated personal or sensitive information. The information these tools need is limited to public blockchain addresses, network and asset identifiers, payment amounts and recipients, policy limits you choose, public OCD receipt IDs, and receipt envelopes you choose to share.
The public ChatGPT MCP is anonymous. It needs no OnChainDiligence account and does not create payments, sign or authorize transactions, hold funds or create private operations. Its inspection, retrieval and verification tools are read-only; its receipt-creation tool is described under free observation-only receipts below. Your information is used only to compare a proposed payment with the rules you supplied, retrieve an exact public OCD receipt, verify a receipt proof, create a receipt for a completed transaction when you ask, and operate, secure and troubleshoot the service.
The inspection, receipt retrieval and verification tools do not create accounts, operations, payments, receipts or webhooks. Inspection inputs and directly supplied verification envelopes are not written to OCD's business-record database by these tools. Verification does not echo the supplied envelope. Retrieval returns the complete existing public signed envelope so its proof remains checkable; public receipts can contain public addresses, transaction hashes, amounts and signed claims.
Free observation-only receipts
The free POST /observe-payment endpoint and the public MCP create_payment_receipt tool, which share one observation-receipt capability, process the network and transaction reference you supply, plus any optional expected recipient, asset or amount you choose to assert. OCD uses them to independently observe that transaction on the public blockchain. When the observation is definitive, OCD creates a signed receipt and stores it, together with the network and transaction reference, as a durable OCD record under the retention terms below; a later request for the same transaction returns the same stored receipt. If the transaction is not found or not yet final, no receipt is stored.
These receipts are unlisted: they are not shown in any public list or activity feed, but anyone who has the exact receipt ID can retrieve it. This is not authenticated or private access. A receipt can contain public addresses, transaction hashes and amounts, and the underlying blockchain data remains publicly available independently of OCD. Abuse protection uses a best-effort, per-instance rate limit keyed by the requesting IP address and held only in server memory; the endpoint does not write your IP address to OCD’s database. Normal hosting processing described below still applies.
Infrastructure and recipients
Vercel hosts the website and MCP service; Neon/Postgres stores durable OCD records. Receipt verification reads OCD's public signing-key registry. Normal hosting/security processing may involve IP addresses, request timing, status and technical request metadata. The public MCP's inspection, retrieval and verification tools do not intentionally write application usage telemetry, usage events or diagnostic logs from their tool handlers, and do not intentionally persist their tool inputs or sessions as business records. The create_payment_receipt tool is different: when it creates a NEW observation receipt, OCD stores that signed receipt together with the transaction’s network and transaction reference as a durable record, and may emit a coarse operational event for the receipt-creation (the same applies when a new receipt is created through the HTTP /observe-payment endpoint). That event is written to the runtime log and, on a best-effort basis, to OCD’s usage-event records, and contains only bounded fields such as the route, receipt kind and network. It does not intentionally include the transaction reference, request body or receipt contents. Requesting a transaction that already has a receipt returns the stored receipt and does not create another one. No wallet keys, signing credentials or payment authorizations are requested or retained. This does not limit the hosting provider processing described above. The separate HTTP receipt endpoint may log a structural-corruption diagnostic if a stored receipt fails an integrity check. Infrastructure and security logs generated by hosting providers may be retained under those providers' own operational and security retention policies; no specific retention period is stated here.
When you use a client such as ChatGPT or Codex, the client provider handles your conversation and tool exchanges under its own terms and privacy policy. These tools send responses back to that client. Website fonts are loaded from Google Fonts, which receives browser connection information. Processing may occur outside your country; this page does not promise UK/EU-only residency.
Separate paid services can query their disclosed data providers, including public sanctions sources, Companies House and SEC EDGAR, and payment/RPC infrastructure where relevant. The free Plugin does not call these paid screening tools or a payment facilitator.
Wider product records and retention
Operations, lifecycle steps, signed receipts, execution bindings, chain observations, merchant-evidence records and webhook delivery metadata currently have no automatic deletion period. They remain in the current environment unless manually removed or a retention policy is introduced. No fixed deletion schedule is promised. Public signed receipts are designed for durable verification and may be copied by others; blockchain data and third-party copies cannot be erased by OCD.
Raw merchant response bodies are not accepted or stored by the merchant-evidence feature. It stores caller-reported digests, byte counts, status, content type and allowed header metadata, labelled CALLER_REPORTED, not verified delivery.
Keys and credentials
OCD does not request or store customer wallet private keys. Account API keys and operation recovery credentials are stored as hashes. The finalization authorization store uses capability hashes; an authenticated lifecycle recovery path also retains the raw finalization token in its lifecycle step so the same operation can resume. Webhook signing secrets are stored server-side because outbound signing requires the secret. None of these values are exposed through the free Plugin.
What OnChainDiligence does not certify
Results from these tools do not certify payment safety, legal compliance, merchant legitimacy, sanctions status, or delivery or completion of any service. ALLOW is a comparison with the rules you supplied; VALID means a receipt proof verifies.
User controls
You can choose not to send an envelope or optional proposal data, and stop using or disconnect the Plugin in your client. Only public receipts are retrievable by ID; private and unknown IDs are indistinguishable. Wider-product customers can delete their own webhook endpoint, which removes its delivery history. There is no self-service account or operation deletion API today.
Contact support to request access, correction or deletion of personal data, or to raise an objection. We will assess requests under applicable law and explain relevant limitations; this is not a promise that immutable public records or third-party copies can be deleted. You may also contact your applicable data-protection authority. Do not email secrets as evidence of identity.
Support messages, logs and updates
If you contact support, we process your email address and the information you choose to send to respond and investigate the issue. No fixed automatic deletion period for support correspondence or hosting logs is promised here. The free MCP endpoint does not set a login cookie. Your client and hosting providers may perform their own security processing. Changes to this policy will be posted with a revised date.