Titanium Hut

Vault

ALMSTINS PRIVACY POLICY

Effective Date: November 6, 2026  ·  Version: 1.4
Operator: Almstins LLC ("Almstins," "we," "us," "our")

1. Introduction

This Privacy Policy explains what information Almstins collects, how we use and protect it, and the choices you have, when you use almstins.com and related applications and features (the "Service").

Core principle — tenant isolation. Almstins operates under strict tenant isolation. Your data belongs to you and is segregated from every other user. Our admin tools show only what we need to run the Service: each account's email, its sign-up and last sign-in dates, and how many wallets, exchange accounts, and imports it has, plus a 30-day log of counts from syncs, imports, and automatic sorting (for example, how many transactions were classified, set aside as dust, or still need review). We read the support messages you send us, and we are emailed when an account is created or subscribes. Our admin tools do not show your transactions, wallet addresses, or documents. Your data is never used for any purpose other than those listed in Section 4.

2. Our Privacy Architecture (Binding Guarantees)

These are architectural commitments that shape every section below:

  • No attribution. We never link a blockchain address to a person's identity. We do not perform KYC, identity verification, address clustering, or de-anonymization, and we do not build any directory that links addresses to people. Apart from labels in your own account, which only you see, the only names we show next to an address come from our own curated list of well-known contracts and exchanges; from public records published for the address, such as an ENS name or a contract name published with verified source code on Etherscan; or from an organization that proved it controls the address and chose to publish it (Section 5).
  • Tenant isolation. Every record is scoped to your account. No user, and no white-label operator, can access another tenant's data. The exceptions are records you choose to share, such as Verify Destinations you prove, which answer public checks as described in Section 5; receivables records, which anyone holding a receivable's ID can view (Section 3.1); and evidence you upload through an attestation link, which the people who sent you that link can see (Section 3.1).
  • No surveillance. We do not track your off-platform behavior and do not proactively monitor third-party blockchain addresses. You provide the addresses and records you want organized.
  • Read-only, no custody. We never hold keys or move funds, so we never possess the credentials that would make your assets reachable through us.

3. Information We Collect

3.1 Information you provide directly

  • Account information: your email; if you sign up with a password, a salted one-way hash of it (never the password itself); your sign-up and last sign-in dates; an optional separate email for alerts; and your subscription tier. If you sign in with Google or GitHub, we also keep the account number that provider uses to identify you (Section 10). We do not ask for your name to create an account: a name supplied by Google or GitHub is not kept, and email/password signup asks only for an email and a password. A name can still reach us in the ways listed below, for example on a receivables record, on an attestation, or as the sender name on an email you send us. (Stripe may hold a billing name if you subscribe.)
  • Cryptocurrency data: wallet addresses you supply, public on-chain history for those addresses, and transaction records.
  • Almstins Agentics (if you use the Agent Vault): the agents you create and the label you give each one; the wallet addresses you register as an agent's own wallets; the destination addresses you register for an agent, with any label you give them; your report and alert settings; and, if you make an agent API key, the domain you proved to get it, when the key was made and last used, and a one-way hash of the key (the key itself is shown to you once and is not kept). Section 5 describes the dated record the Agent Vault keeps.
  • Address labels and notes: labels and notes you write, including an optional phone number for a counterparty (for example, a Venmo contact). They stay in your account (Section 5).
  • Financial data: exchange CSVs you import, transaction amounts, cost basis, and gains/losses.
  • Document attachments: receipt images, PDFs, and supporting documents you upload.
  • Receivables records (if you use the receivables desk): client and debtor names, invoice details, payment instructions, contract files you attach, and the email addresses of people you ask to confirm. Anyone who has a receivable's ID can view that record without an account, including names, amounts, payment instructions, claims against it, and confirmations, but not the attached files. The ID is computed from the record's details, so anyone who knows those details exactly can compute it too. The people you ask to confirm can also open the files you attach.
  • Evidence you upload through an attestation link someone sends you: your answer, the name you type, any notes, the files and photos you upload, a signature you draw, and, if you allow your browser to share it, your device's location at the moment you take a photo. A photo or file also keeps any details stored inside it, such as where and when a photo was taken, if your camera recorded them. The people who sent you the link can see all of it.
  • Community Content: we do not currently offer fraud flags or reviews, and nothing is collected through them. Claims of an address are made through Almstins Verify (Section 5). See Section 6.
  • Communications: support tickets, feedback, error reports, and emails you send us, which we keep with the sender name your email shows.

3.2 Information collected automatically

  • Usage data: pages visited, features used, session duration.
  • Device information: browser type, operating system, and IP address (the latter also used for sanctions/geo controls).
  • Log data: timestamps of actions, error logs, API calls.
  • Agent check records: when an agent asks for a check with an API key that is linked to one of your agents, the Agent Vault records the address asked about, the time, the answer, which key asked, and a salted one-way hash of the caller's IP address (never the IP address itself). Checks made without a key, or with a key that is not linked to an agent, are not recorded (Section 5). On a plan with a daily limit, a check past the limit is answered and not recorded, except one that comes back flagged.
  • Analytics: Google Analytics records the pages you visit and the actions listed in Section 9 under a cookie ID for your browser. Our own logs of dashboard and sign-in page requests keep the page, your country, and salted one-way hashes of your IP address and browser details. Our logs of checks run on the public checkers keep your country and salted one-way hashes of your IP address and of the address or domain checked. See Sections 9 and 10.

3.3 Information we do NOT collect

  • Private keys or seed phrases (we never request these).
  • API keys or passwords for your exchange accounts (data is imported via CSV, via screenshots you upload, or read by public address).
  • Biometric identifiers or government IDs.
  • Identity-linking data — we do not perform KYC.
  • Card numbers, or the login details for your own bank. We never ask for them, and card data for billing is handled solely by Stripe. The receivables desk has an optional payment-instructions field: what you enter there, which may include bank account details, is stored with that record and shown to anyone holding its ID (Section 3.1). If a screenshot or receipt you upload shows an account or card number, it is part of that image: we store images you save to your account (Section 3.1), and we send Anthropic the screenshots you ask us to read and the receipt images you attach on a paid plan (Section 8).

4. How We Use Information

We use information only to:

  • Provide the Service to you (e.g., compute cost basis, render your dashboard, generate reports, run safety checks you request).
  • Authenticate your account and prevent unauthorized access, fraud, and abuse.
  • Check links and wallet addresses that appear in email sent to or from our own inboxes against phishing, sanctions, and mixer lists we hold ourselves. Nothing from those messages is sent to an outside service for this.
  • Answer public checks on Verify Destinations you have proven (Section 5), and show a receivables record to anyone holding its ID (Section 3.1).
  • Send you a short series of getting-started emails after you sign up, and a series about Almstins Verify after you register your first Verify Destination. They describe features, including our paid plans. Accounts that use only our financing desks do not get the first series. Each email has an unsubscribe link that stops the rest of that series.
  • Send you a welcome email the first time you open Almstins Agentics and, if you signed up before the Agent Vault opened to everyone, one email on the day it opens. Accounts that use only Almstins Agentics do not get the getting-started series.
  • Run the Agent Vault for you: answer the checks your agents ask, keep the dated record of them, read the chain for the transfers of an agent's own wallet, and send the reports you turn on and the alerts described in Section 5.
  • Operate community safety features, if offered, in anonymized, aggregated form (Section 6).
  • Respond to your support requests.
  • Improve the Service through analytics (Sections 3.2 and 9).
  • Comply with legal obligations and valid legal process.

We never use your information for advertising (including targeted advertising), profiling, model training, or sale, and we never share it with third parties for their own commercial purposes.

5. Blockchain Address Handling

  • What we collect: addresses you enter, addresses extracted from your imported CSVs, and addresses observed in public on-chain data for wallets you add. Counterparty addresses may be auto-added to your private address book to help you organize transactions.
  • Labels stay in your account. A label you save (e.g., "Joe's Coffee"), and any phone number you add to it, lives only in your account and is never published or shared with other accounts. Labels you give Verify Destinations are not shown publicly either, with the one exception described below. Separately, the Service shows names for well-known contracts and exchanges from a list we curate ourselves, and public ENS and Etherscan contract names.
  • No attribution. We never associate an address with a person or build a public address-to-identity map. Where you use your own records to evidence your own ownership, that is your voluntary self-disclosure — not something we perform on you or others.
  • Retention/deletion: addresses are retained while needed to provide the Service and per legal retention requirements; you may delete them subject to Section 11.
  • Almstins Verify — registered Destinations: if you use Almstins Verify, we store the payment Destinations you register (receiving addresses, QR codes, or links), any label you give them, and the proof that you control them. You prove control with a small payment you send from the address back to itself, which we read on-chain; with a file or DNS record you publish on your own domain, which can include an encrypted list of your addresses; or, for a payment link, by registering it from an account that has already proven its domain. We never ask you to connect a wallet, sign a message, or give us keys. For a PIX or UPI payment QR, we also keep the payee or merchant name it contains, which is shown only to you. We use this data to monitor those Destinations, alert you to changes, answer public checks once a Destination is proven, and start the Verify getting-started emails (Section 4). Camera-based QR scans (Section 7) are decoded on-device: we receive only the decoded destination string, never the image. We do not link your Destinations to your customers and do not monitor third parties.
  • What a public check shows: once you prove a Destination, anyone who enters that address or link in our checkers, or asks our public lookup, can see that it is Claimed or Verified, since what date, and its blockchain or payment rail. For a Verified Destination, the answer also shows the domain that published it and, if your account has a verified business name, that name and the domain it comes from. A label you typed is never shown publicly, except a label that matches the name of a domain you have proven (for example, Acme for acme.com), which becomes your verified business name. A Destination you have not proven is never shown at all. Your email, your account, and your proof artifacts are never shown to anyone. This is your voluntary disclosure of your own Destination; it is not attribution of any third party, and we still perform no KYC and build no directory that links addresses to people.
  • Almstins Verified Entity — public address verification (B.8): if you operate a Verified Entity (an exchange, business, institution, or other organization), you may register a domain you control and publish, on that domain, the receiving addresses you represent as your own. Here, by design and at your choice, the verified addresses and the domain that published them are shown publicly — so anyone can check an address before paying it. This is your organization's voluntary self-disclosure of its own addresses, not attribution we perform. We confirm control by Domain Attestation (an Almstins-issued challenge you place on your own domain). We then read your address list from an endpoint on your domain, using a read-only API key you give us, which we store encrypted, and we cache and mirror what your domain publishes; your published record is the source of truth. Your account identity (email), the proof artifacts, and the link between your account and your domain stay private and tenant-isolated, never displayed. We still never link a third party's address to an identity, perform no KYC, and build no public or cross-tenant address-to-identity directory for anyone who has not themselves proven control. We do not use public verification lookups to profile who is checking. You can revoke an address at any time by removing it from your published record. Applies where and when this Surface is offered.
  • Almstins Agentics — the Agent Vault: if you use the Agent Vault, we store the agents you create, the wallet addresses you register as an agent's own wallets, and the destination addresses you register for an agent, with any label you give them. When you add a destination, we check it against sanctions lists, security screening, and the Verify registry (Section 10), and we keep what those checks found. Each check your agent asks with its API key is screened the same way at that moment, against sanctions lists and security screening; a check that finds something is answered flagged and, if the address is one of the agent's destinations, it is flagged on the agent's list. When the same address passed that screening recently, we may reuse that answer instead of screening it again, for up to ten minutes after the address was last checked; the record marks such a check as cached and keeps the time the reused screening was made. For this we keep, for your account, a short list of up to ten addresses whose screening passed, which an address leaves after ten minutes without a check, or at once on any flag or sanctions list update. We also keep a dated, append-only record for each agent: every check asked with the agent's API key (the address asked about, the time, the answer, which key asked, and a salted one-way hash of the caller's IP address), including checks about addresses that are not on the agent's list, which records that your agent asked and does not put the address under watch; and every direct transfer we read of the agent's own wallet, in either direction (its transaction hash, the address on the other side, direction, amount, asset, USD value at the time, and block time), together with what the agent's list said about the other side at the moment of recording: trusted, pending, or flagged for a destination you registered, or not on the list. A transfer out to an address not on the list, with no check asked about it in the hour before, is marked as unmatched. Past the plan's daily limit, a check is answered and not recorded, except one that comes back flagged, and the check that finds the limit used up carries a mark. To find those transfers, once a day, about once a minute while your Live page is open (one agent at a time, in turn, up to a daily limit), or when you press a button, we read the block explorer's listing for the agent's own wallet (Etherscan for Ethereum and Polygon, Routescan/Snowtrace for Avalanche). The addresses on the other side of those transfers are public on-chain data of a wallet you registered, the same kind the Service keeps for any wallet you add (the first point of this Section). We do not read a destination's own history, nor the history of any address that is not an agent's own wallet. We read only the wallets you register, never the history of any other address. We never link an address to a person, and we do not monitor third parties. The labels you give agents and addresses stay in your account and are never shown publicly. We use the record to show you your agent's page, to build the daily report you can download as a signed PDF, to make the signed export you can ask for, to send the report emails you turn on, and to email you at once whenever a check your agent asks is answered anything other than proven, at most one email an hour for the same address (for an answer of established, only if you turn that email on), and to email you at once when a transfer out of an agent's wallet is marked as unmatched, at most one email an hour for the same address; those emails carry counts or the name of the answer, and never an address, a label, or an amount. Removing an agent or a destination takes it off your lists and stops it being read, but the events already recorded stay in the record until you delete your account (Section 11).

6. Community Safety Features (Flags, Reviews, Claims, Badges)

Applies when and where these features are offered.

  • Current status: we do not currently offer fraud flags or reviews, and nothing is collected through them. If we offer them, the rules in this section apply.
  • What is stored: the fraud flag or structured review, keyed to a blockchain address, not to a person.
  • Reviews are predefined selections only (no free text, no star ratings); only aggregate counts are displayed, never an individual review or reviewer identity.
  • Reporter/claimant identity is stored solely for abuse-prevention and rate-limiting and is never displayed or linked to a person publicly or to other tenants.
  • Validation: surfaced fraud signals are gated by an independent third party (e.g., GoPlus); we do not publish a user headcount.
  • Claims and control proof: the only way to claim an address today is Almstins Verify. You prove control as described in Section 5, for example with a small payment you send from the address back to itself. We never ask you to connect a wallet, sign a message, or provide keys. A proven claim is publicly checkable as described in Section 5.
  • Badges: when someone checks a proven Verify Destination, our checkers can show a Claimed or Verified badge with the details listed in Section 5, and nothing more.
  • Corrections are handled by re-validation against the independent source, not by disclosing who contributed a signal.

7. Merchant Verification & Camera Features

Applies wherever the Service uses your camera: the wallet checker, Almstins Verify, and attestation links.

  • One-time QR scans are decoded on your device; the image is never stored or sent. The camera runs only while the scanner is open and stops at the first code it reads. A scanned wallet address is checked right away. On the wallet checker, a scanned link is placed in the box and is not checked until you press the check button. On the Verify scan page, and when you check a sign from your Verify dashboard, a scanned link is checked right away. A check sends what was scanned to our servers, and an address or web link also goes to the screening services in Section 10.
  • Evidence photos: an attestation link someone sends you can open your camera so you can photograph work as evidence. Those photos are uploaded and stored, as described in Section 3.1.
  • No always-on camera. Almstins has no continuous or always-on camera feature.

8. AI Features

Some features send data to our AI provider, Anthropic (Claude), in the cases below:

  • Screenshot reading: when you use "Scan Screenshot" (address labels), "Import Screenshot", or "Parse & import" (screenshots you saved on the Transactions page), the whole image is sent so Claude can read the wallet address or transaction in it. Anything visible in it, such as names, amounts, and account details, is sent too, so crop out anything you would rather not share. Unlike camera QR scans (Sections 5 and 7), which are decoded on your device, these images leave your device.
  • Transaction triage (paid plans): for each unresolved transaction, its direction, asset, amount, USD value, type, description, source, date, and your own notes and category.
  • Receipt validation (paid plans): whenever you attach a receipt image to a transaction on the Research page, the image is sent automatically so it can be compared with that transaction. There is no separate step. PDFs are not sent.

Outputs are not authoritative. Addresses read from a screenshot are placed in the form for you to check before you save them. A transaction read from a screenshot is saved to your records right away; check it, and delete that import if it is wrong. Triage fills in a category and a note on transactions it rates as an obvious purchase, income, or own-wallet transfer when they have no category yet, and leaves the rest for you; you can change any of them. Receipt results are suggestions you review.

9. Cookies & Analytics

We use a small number of cookies and similar browser storage:

  • Essential: your sign-in session and its security checks, and the demo session if you try the demo. The Service does not work without them.
  • Preferences: your language choice, and small settings such as text size or whether you have already seen a page's introduction, kept in your browser.
  • Analytics: Google Analytics sets its own cookies to count visits, see which pages are used, and count a few named actions: signing up, signing out, adding a wallet (with the blockchain you chose), running the wallet checker, running the site checker (with its red, yellow, or green result), clicking a sign-up button on the checker page, and using the demo (starting it, leaving it, viewing its pages and year-end summary, or clicking its sign-up button). Our tag turns off Google signals and ad personalization. We also keep a small marker in your browser so we count a new account's sign-up only once. Section 10 says what Google Analytics receives.

We do not use cookies for advertising. We do not currently show a cookie consent banner. To opt out of Google Analytics, block cookies for almstins.com in your browser, use a content blocker, or install Google's opt-out browser add-on. The Service works without analytics cookies.

10. Third-Party Services

We share the minimum data needed with the service providers below, grouped by purpose. Where it matters, we say what each one receives.

  • Sign-in: Google and GitHub, only if you choose to sign in with them. They share your email address and basic profile (such as your name and photo) with us. We keep your email and the account number the provider uses to identify you, which is how we recognize you the next time you sign in. We do not keep your name, your photo, or the provider's sign-in tokens. They learn that you signed in to Almstins.
  • Billing: Stripe receives your email, your plan, and an internal account ID. You enter card details directly with Stripe, a PCI-DSS Level 1 provider; we never see them.
  • Hosting and database: Render hosts the Service, our Postgres database, and our server logs. Render serves the site through Cloudflare's network, which sees each request and your IP address.
  • Email: an email/SMTP provider (sign-in links, verification, welcome, report, alert, and account emails, and messages you ask us to send to a counterparty), Resend (getting-started emails after you sign up or first register a Verify destination), and the providers that host our own inboxes, including Google (Gmail) (support, contact, and reconciliation-help messages, error reports, and notices of new sign-ups and subscriptions). Each receives the recipient's email address and the message.
  • Analytics: Google Analytics receives the pages you visit and the page you came from (each without the part of the web address after "?", except campaign tags such as utm_source), the named actions listed in Section 9, a cookie ID, browser details, and your IP address. Our tag turns off Google signals and ad personalization. IPinfo receives your IP address, to look up its country; from that lookup we keep only the country, filed under a one-way hash of the IP. Some pages also load fonts, icons, or images directly from Google Fonts, Google's icon service, jsDelivr, and image hosts, which see your IP address and browser as any website does. From the icons a page requests, those services can tell which exchanges or tokens appear in your account.
  • Blockchain data: Alchemy, Etherscan, Routescan/Snowtrace (Avalanche), Blockstream (Bitcoin), litecoinspace.org (Litecoin), the public XPR Network servers (XPR Network, which receive the account name), a Solana RPC provider, Mysten Labs (Sui), the Rootstock public node, Sovryn and The Graph (subgraphs), and the Aave API. They receive the public wallet addresses and transaction IDs we need to read, never your account details.
  • Prices: CoinGecko, DefiLlama, and Yahoo Finance receive the tokens or stock symbols to price and the dates, never your wallet address or account details. Coinbase (its public exchange price data, for older Bitcoin and Litecoin prices) receives only the coin and the dates, nothing about you.
  • Safety checks: GoPlus Security, honeypot.is, Chainalysis (its sanctions-screening service), Chainabuse (run by TRM Labs, and only while we have that lookup switched on), Google Safe Browsing, VirusTotal, and URLScan.io receive the address or link being checked; we add nothing about you to a check. For a link, GoPlus, Google Safe Browsing, and VirusTotal receive the full link, including anything after the domain, while URLScan.io receives only the domain. We only ask VirusTotal whether it already has results for a link; we never submit a link for it to scan. Avoid checking links that contain private access codes or personal details, including private links someone sent you. Section 13 says more about the services run by chain-analysis firms.
  • AI: Anthropic receives what the AI features in Section 8 send, only when you use them.
  • Time-stamping: OpenTimestamps calendar servers (run by OpenTimestamps, Eternity Wall, and Catallaxy) receive only a one-way SHA-256 fingerprint, never the record itself. Blockstream supplies the public Bitcoin block data used to check a stamp.

We also download public phishing, sanctions, and price lists (for example, from GitHub and CoinPaprika); those requests carry nothing about you. These providers have their own privacy practices; we are not responsible for their handling of data.

11. Data Retention

We keep data while your account is open and as long as needed to provide the Service, to comply with legal obligations, and to resolve disputes and enforce our agreements. You can delete your account and data yourself at any time, or ask us at privacy@almstins.com. Deletion removes all of your account's data except records other parties rely on in our financing desks, such as receivables, projects, claims, confirmations, attestations, and their documents, which we keep for those parties under this section. The Agent Vault's record is append-only while your account is open: removing an agent or a destination stops it being read and takes it off your lists, but the events already recorded for it stay in the record, so that the record stays complete. Deleting your account deletes the record with everything else. We do not keep your tax records for you after you delete your account, so export what you need first; tax records often need to be kept for 7 years or more. Emails you sent to our inboxes, and billing records Stripe keeps, are not part of your account's data; you can ask us at privacy@almstins.com to delete those emails. Deleted data cannot be recovered from the Service, though it can remain in our database host's backups until they expire.

12. Security

We use industry-standard measures, including HTTPS for data in transit; encryption at rest of stored data, provided by our database host; additional AES-256-GCM encryption, applied by us, for Verified Entity API keys and for the saved copy of a roster address list; role-based access control; and breach-response protocols. However, no system is fully secure, and we cannot guarantee absolute protection against all attacks or breaches.

13. Legal Requests and Law Enforcement

We may disclose data only when required by valid legal process (such as a subpoena or court order) or to investigate fraud or abuse with proper legal authority. We do not share data with law enforcement absent valid legal process, and chain-analysis firms receive nothing from us beyond the address checks described below. Where legally permitted, we will notify you of legal requests for your data. We do not honor informal requests.

Address and link checks. When you, or anyone using our checkers, asks us to check an address or link, our servers send that address or link to the screening services in Section 10. They include services run by the chain-analysis firm Chainalysis and, while that lookup is switched on, TRM Labs (which runs Chainabuse). A check carries the address or link (and, for some services, which blockchain it is on) and nothing else about you: not your name, email, account ID, or IP address. These are lookups only: we never submit a link or address for scanning. Addresses and links in email sent to or from our own inboxes are checked only against lists we hold ourselves and are never sent to these services. We do not file scam or fraud reports about anyone, with these services or with anyone else.

14. International Data Transfers

Your data may be processed and stored in the United States or other countries. By using the Service, you consent to such transfer and processing, subject to applicable data-protection law.

15. Children's Privacy

The Service is intended for users 18 and older. We do not knowingly collect data from minors and will delete such data if discovered.

16. Your Rights

Subject to applicable law (including GDPR and CCPA), you may:

  • Access a copy of the data we hold about you;
  • Correct inaccurate data;
  • Delete your account and data (except records other parties rely on in our financing desks, as described in Section 11, and subject to legal holds);
  • Opt out of analytics and optional features;
  • Port your data via export in a standard format.

We do not sell personal information and do not "share" it for cross-context behavioral advertising. To exercise any right, contact privacy@almstins.com.

17. Changes to This Policy

We may update this Policy. Material changes will be notified by email or in-product notice; continued use after the effective date constitutes acceptance.

18. Contact

Privacy Officer — Almstins LLC — privacy@almstins.com