Privacy Policy

sBTC Pay is non-custodial payment software on the Stacks blockchain. We designed it to need as little of your data as possible: there are no accounts, no passwords, no email sign-up, and no identity verification. This policy explains what little we do handle, where it lives, and what we can and cannot delete.

The short version

• Your wallet address is your login. We never see your private keys or seed phrase.
• We run no advertising trackers and no third-party analytics.
• Payments happen on a public blockchain. That data is visible to everyone and permanent; nobody, including us, can delete it.
• We keep an off-chain copy of on-chain activity to make the dashboard fast. That copy we can delete on request.

Data we handle

Wallet addresses. When you connect a wallet, we receive your public Stacks address. Addresses are public information on the blockchain; we use yours to show your invoices, payments, and balances, and to authenticate dashboard requests.

Merchant profile data. If you register as a merchant, the name, description, and logo URL you choose are recorded on-chain (public and permanent) and cached in our database. A webhook URL and webhook secret, if you configure them, are stored off-chain only.

Payment activity. Invoices, payments, subscriptions, and refunds are events on the Stacks blockchain. Our indexer mirrors them into a database so the dashboard can query them quickly. The mirror contains nothing that is not already public on-chain, except delivery logs for your webhooks.

Browser storage. We use your browser's localStorage for your wallet session, a short-lived authentication token (24 hours), and interface preferences. We do not use tracking cookies.

Technical logs. Our infrastructure providers keep standard server logs (IP addresses, request timestamps) for security and reliability. We do not build profiles from them.

Services we rely on

• Vercel hosts the website.
• Supabase hosts the database and the functions behind webhooks and authentication.
• Hiro APIs provide blockchain data (your browser queries them directly).
• Coinbase and CoinGecko provide BTC and STX price quotes (your browser queries them directly; we send them nothing about you).
• Your wallet (Leather, Xverse, or a WalletConnect-compatible wallet) handles keys and signing under its own privacy policy.

What we do with data

We use the data above to operate the product: showing your dashboard, generating payment links, delivering webhooks to endpoints you configured, and keeping the service secure. We do not sell data, share it with advertisers, or use it for marketing.

On-chain data is permanent

This is the most important thing on this page. Every payment, invoice, registration, and refund is a transaction on the public Stacks blockchain, linked to the participating wallet addresses, replicated across the network, and permanent by design. If you need a payment to be private or erasable, a public blockchain is the wrong tool, and no privacy policy can change that.

Deletion and your rights

You can ask us to delete anything we control: the off-chain cache of your activity, your webhook configuration, and delivery logs. Open an issue at github.com/nicholas-source/sbtc-pay/issues from context that demonstrates control of the wallet in question. Note that our indexer mirrors public chain data, so records of on-chain events may be re-created by re-indexing; what we can permanently remove is the off-chain-only data (webhook URLs, secrets, and logs). You can also disconnect your wallet at any time and clear the site's localStorage from your browser.

Children

sBTC Pay is not directed at anyone under 18, and we do not knowingly collect data from them.

Changes

If this policy changes, we will update this page and the date at the top. Material changes will be noted in the project's release notes.

Contact

Privacy questions and requests: github.com/nicholas-source/sbtc-pay/issues.