# Privacy

The catalog and product preview have no wallet connection or submission forms. For the digital ware, a buyer's x402 client sends signed payment authorization to the seller and Coinbase facilitator. Confirmed transaction addresses, amount and receipt are public on Base. The private order journal retains payment bindings, status, receipt and a hash of the recovery key; it does not retain the raw recovery key or signed payment header. Rate limits process the connecting IP transiently and store only a hash with a private monthly salt in minute counters. Raw IPs are not stored by the commerce journal; minute counters expire within two minutes and previous monthly salts are discarded. The admission index retains order IDs and payment/recovery hashes so existing purchases can recover without using new-purchase capacity. Preserve your key privately, never email it. Customer files used with the offline kit are never uploaded. Cloudflare hosts the site, processes connection data and may insert traffic-measurement code into served pages. Cloudflare’s privacy practices apply to that processing. Marketplace links lead to external sites with their own privacy practices. Email inquiries go directly to Ben’s Gmail inbox and are processed by that email provider. Include the task, proposed deliverable, completion criteria, timing and budget initially; never send passwords, access codes or payment credentials. Ask Ben by email about removal of your inquiry. For card purchases, a Stripe-issued card SPT is sent transiently to the merchant and Stripe; the merchant journal retains only a credential hash, recovery-key hash, order bindings, sanitized status and receipt. It does not retain the raw SPT, Payment credential, recovery key or card numbers. Stripe and the buyer issuer process their own payment records. Never email or publish a token, credential or recovery key.


## Interface Consistency Check

The Interface Consistency Check stores the prepared JSON report privately before payment, discards raw submitted contents after preparation, and retains input/report digests, a recovery-capability hash and sanitized payment metadata. Unpaid reports expire after 24 hours; the purchased-report recovery period is 30 days after confirmation. Unresolved payment records remain until reconciled. Compact audit markers remain within fixed storage capacity. No capability or report is a public static asset. Submit public documents only; never submit secrets.
<!-- guestbook invitation start -->

## Leave a trace guestbook

The separate [guestbook](/guestbook/) accepts a note, purpose, optional display name and optional HTTPS profile link. All new notes await owner moderation. Approved notes, names and links are public and may be copied by others; pending and hidden content is owner-only. No account, wallet, payment, email address or upload is required.

Notes remain until owner removal. Removal redacts note, name and profile link, retaining a receipt ID, content digest, purpose, date and noncontent audit to prevent duplicate restoration. Capacity is fixed. Abuse prevention keeps only privately salted daily IP hashes and bounded counters, scheduled for deletion after 48 hours; provider alarm retries may delay cleanup. No raw IP/user-agent storage, fingerprinting or profile URL fetching. Cloudflare separately processes hosting connection data.

The enhanced form retains an unresolved submission in this tab’s sessionStorage for exact retries until receipt is confirmed. Do not include private information, credentials or private task details. [Contact Ben](/contact/) for private matters/removal using the note date or receipt ID. A note is not a paid-job submission or promise of compensation.
<!-- guestbook invitation end -->

An attempt ID identifies an unconfirmed submission. A confirmed receipt records that the note was received for review; it does not check its current publication status. Review, publication and a personal reply are separate outcomes, with no guaranteed publication or reply. A receipt ID is not proof of identity or authorization.

Closing the tab or losing its session can lose the saved attempt. Confirmed receipt Copy/Save controls act only when you choose them and omit the note, name and profile. You decide whether and where to save; files and clipboard copies are outside session storage. A saved receipt is a snapshot, not a publication check. No public lookup of pending notes is provided.

For [private product questions, receipt help or removal](/contact/#private-help), provide minimal context: page link, approximate date, and attempt ID or receipt if available. Never send credentials, signed payment payloads or private purchase recovery keys.