Privacy

Last updated October 2026

What we read

Public blockchain data, for the address you paste. That is the same information anyone can see on a block explorer — we just read a lot of chains at once and put it in one place. To do that, our server asks infrastructure providers (RPC nodes, block explorers, price and bridge APIs) about the address. They see the wallet address we look up, not who asked.

What we store, and for how long

• Wallet addresses and scan results. The address you paste and what we found for it. A finished scan is reused for about six hours. An anonymous report is deleted one hour after its scan finishes, unless you keep it by attaching an email or unlocking it. If you opened the payment screen, a small stub (report id, wallet address, payment amount) stays for 30 days so a late payment can still be matched. A paid report keeps its full data for the 14 days you can open it; a report attached to an email but not paid keeps its full data for one hour. After that only a summary row remains (wallet, headline numbers, unlock history), and that row is kept until you delete the wallet from your account or ask us to erase your record.
• Your email, only if you give it. Used to send your login link, to group your wallets into an account and to tie a purchase to you. It is stored on the reports you attach it to and, once you have signed in, in our contact list, until you ask us to remove it. Unsubscribing stops mail but keeps the address on file so the opt-out holds. Today the only email we send is your login link; if we ever send reminders about wallets you scanned, each one carries an unsubscribe link.
• Payments. No card details exist. An open invoice is your report id plus an exact amount; unpaid invoices are deleted after 30 days. Once you pay, we keep the record — chain, token, amount and transaction id — for as long as we run the service, as our proof of the sale. If you prove a payment by signing with your wallet, our operating log notes the first characters of that wallet. Credit packs also record the email they belong to.
• Referrals. If your browser kept a code from our earlier referral program, it is stamped on the reports you create, so the person who referred you is credited when you unlock one. Referrers’ records (email, payout wallet, earnings) are kept as part of our payout ledger. Links people share today are affiliate links, below.
• Feedback and sweeps. Feedback you submit after an unlock (the amount recovered, your note, the report’s wallet, your email if you were signed in) is kept as part of our records. When you complete a sweep or bridge through us, our server records the wallet, the amounts, the first transaction id and any referral code, for fee accounting. When you get Solana rent back through us, it records the wallet, how much came back, our fee, the transaction ids and the report you came from, if any.
• Junk coins. To tell which of your coins are junk (fffonchain.com/burn), our server reads each coin’s market on Solana and asks DexScreener for its price, by the coin’s address, never your wallet’s. The prices and your wallet’s list are kept in our server’s memory for a minute or two so the page can show them, and never written to disk.
• Top reclaims board. When you get rent back on Get Your Rent, our server checks each of its transactions on Solana itself and keeps the wallet, how much came back and when, to show the leaderboard and the latest reclaims on fffonchain.com/rent. They show wallets shortened (the first and last four characters), never in full, each latest reclaim with a link to its transaction on Solana, where anyone can already see it. The transaction ids are kept for a week so none counts twice. For the “found so far” total, when a check reads a whole wallet we keep a one-way fingerprint of it (never the address) and how much SOL it could get back, so checking again never adds up. Each run that gets SOL back also gets a share card: how much came back, the day, the wallet shortened and a link to its first transaction. Anyone with the card’s link can open it, and it is deleted after 30 days.
• Sell All Drops. To tell which of your coins pump.fun or StonkFun paid you (fffonchain.com/drops), our server reads each coin account’s history on Solana. What it learns about each one (your wallet, the coin, how much of it pump.fun or StonkFun paid, how much came from somewhere else and from which wallet, and which transactions it already read) is kept on our server for up to 30 days after its last check, for at most 10,000 coin accounts in all, so the next check only reads what is new. Prices come from each coin’s market on Solana or from Jupiter, asked by the coin’s address, never your wallet’s. Our server also reads StonkFun’s public list of the coins it pays in; nothing about you is sent with it. Your wallet’s list of coins is kept only in our server’s memory, until the next check clears it, and never written to disk. To build a sale through Jupiter, our server sends Jupiter your wallet address and the coin and amount you sell. When you sell drops through us, it records the wallet, each coin sold with its amount and what the sale paid, our fees, the rent that came back from the closed accounts, the transaction ids and the report you came from, if any. That rent counts on the top reclaims board like any reclaim on Get Your Rent.
• Affiliate links. One link covers every tool on fffonchain.com and claim_your_stocks. If you make a link, we keep the wallet that signed (it is where we pay you), your code, any project name we set up with you, your rate (the standard one, or a rate we agreed with you) and the rates it had before, the link you signed up through, when you made it, a count of visits through your link with nothing about who visited, and a hash of the key your browser keeps for it. If you pick a name for your link, we keep that name and when you picked it. Each sale, or Solana rent reclaim through Get Your Rent, that earns from a link is a line in our payout ledger: its transaction id, the seller’s public wallet, the chain, when the sale was made, the sale and fee amounts, whether it was a sale or a reclaim, what each link earned, and when it was paid or voided. Your link’s rank is worked out from these lines each time; it is not kept on its own. A seller’s wallet is also tied to the first link it sold or reclaimed through, and we keep the transaction id of every sale and reclaim we checked so none is counted twice. These are kept for as long as we run the service, as our payout records. A note of which link a Solana sale order came through (the transaction id, the seller’s signature on the order and the seller’s wallet), or a rent reclaim or a drop sale on Sell All Drops came through (its transaction id and the wallet), is deleted after 7 days. Someone who owns a link sees only totals and their own amounts by level, chain and date (to the cent and the day), never a seller’s wallet or transaction.
• Technical data. Your IP address is used in memory to rate-limit abuse; a repeated abuse hit is noted in our operating log with the IP. That log (unlocks, referral credits, sweeps, errors) keeps a bounded number of recent entries, currently the newest 20,000.

What your browser keeps

Except the affiliate invite code that is written into a stock sale you sign on an EVM chain (see cys-ref below), nothing your browser stores for us is shared with anyone else. This is every item, and when it reaches our server:

• Login session cookie (ff_sess) — set only after you sign in through a login link. It is a signed token that carries your email address and an expiry date, and page scripts cannot read it. Your browser sends it with every request to fffonchain.com for 30 days, so we know which account is asking. “Log out everywhere” in your account cancels every copy of it.
• Anonymous browser id (ff-cid) — a random string created the first time you click Scan in this browser. It is sent with each scan request, and once more if you leave the page while a scan is still waiting in line. We use it to tell your clicks apart from other people’s on the same wallet: a double click, a dropped connection or a reload brings you back to the same scan instead of starting a second one, and leaving frees your place in the queue. It is held in server memory for fifteen minutes and kept only as a hash on the scan record. It is not tied to your email and is not used to track you.
• Earlier referral code (ff-ref): from our earlier referral program. If your browser kept one, it is sent with your scan, when your report is saved, and when you complete a sweep through us, so the person who referred you can be credited. The first code wins and is never overwritten. Links opened today don’t set it: they are affiliate links (cys-ref, below).
• Affiliate invite (cys-ref): if you arrive through someone’s affiliate link, on any page of fffonchain.com or through claimyourstocks.com, its code and the date are kept for 90 days so that link can be credited for your sales and rent reclaims. The last link you open is the one kept (the one before it too, in case the newer code turns out not to exist). When a wallet connects, it gets the link kept at that moment, and a link you open later doesn’t change it: a note (cys-ref-lock) keeps each wallet you connected here with its link (up to 20 wallets). That note never leaves your browser; the wallet’s link is what goes with its sales and reclaims, below. The code is taken out of the address bar right away. It is sent to us once per browser session to count the visit, when you make your own link (as who invited you), with each stock sale, and with each Solana rent transaction you send through Get Your Rent or Sell All Drops. On Solana it goes with the sale order or the transaction; on other chains it is written into the swap you sign, so LI.FI sees it and, like the sale itself, it is public on-chain. A note for this browser tab (cys-ref-seen, in session storage, a short list of link codes) remembers which links’ visits were already counted, so a reload doesn’t count one twice. It never leaves your browser and is gone when the tab closes.
• Your affiliate link (cys-aff): after you sign for your own link, your code, the wallet that signed and a random key are kept so the Earn page can show your numbers without asking you to sign again, and your link’s name once you pick one. Only the code and key are sent, to load those numbers or save your choices, and we keep just a hash of the key. Signing again in another browser gives a new key and the old one stops working. Your code, or your link’s name, is also put in the Share on X text after a sale.
• Remembered email (ff-email) — if you typed an email to keep a report, it stays in your browser so you do not have to retype it. It is offered as a masked “use b•••@x.com” chip; nothing is sent until you choose it and press the button. It is never attached to a report automatically.
• Per-report preferences — whether you finished keeping a report (ff-saved-<report>, which also records the address you chose), whether you left feedback on it (ff-fb-<report>), your light/dark theme (ff-theme), a note that you have seen the homepage intro (ff-entered), and a per-tab marker that stops a reopened report from re-running its deep trace. These never leave your browser.

Clearing site data for fffonchain.com removes all of it.

Server logs and backups

• Web server log. Each request line as your browser sent it, which can include the wallet address, report code or browser id that was in the address bar, plus the result, timing, your IP address and browser type. Kept for 14 days. We also read it to count visits, in aggregate, for our own admin dashboard; those counts are never shared, and no third-party analytics are involved.
• Application log. Report ids and the first characters of wallet addresses, never emails or IP addresses. It is trimmed by size rather than by date, so entries can remain for several months.
• Backups. Hourly copies of our database are kept for up to 15 days. A copy taken just before each software release is kept for 14 days, except the two most recent ones (the current release’s undo copy and the one before it), which stay until later releases replace them. Data you delete, or that expires, can therefore persist in a backup for that long.

Other services your browser contacts

We run no third-party analytics, advertising or tracking scripts. Your browser does talk directly to a few outside services. Token logos on a report load from Trust Wallet’s asset library, from DexScreener and, for Solana tokens, from whatever image host the token’s own metadata names; they see your IP address and browser type, not who you are. If you use the Sweep, Bridge or SolSweep tools, your browser talks to your wallet extension (MetaMask, WalletConnect, Phantom or Solflare) and to the routing services LI.FI and Jupiter, which necessarily receive the wallet you connect and the trade you ask for. claim_your_stocks connects wallets through Reown (WalletConnect), which sees your wallet address when you connect. The Solana rent page does too, and your browser only reaches Reown there once you press Connect wallet. The Earn page, where you sign for your affiliate link, connects through Reown like claim_your_stocks. Each of these has its own privacy policy. Sell All Drops (fffonchain.com/drops) is the rent page too, and connects your wallet the same way.

What we never do

Ask for or store private keys or seed phrases. Sell your data. Move your funds. Follow you around other websites.

Your choices

Scan without ever giving an email. Delete any wallet from your account. Unsubscribe from emails in one click. Clear your browser’s site data to remove everything stored on your device. Or email hi@fffonchain.com and we will delete your wallets and their reports, and stop contacting you. Ask us to erase your record entirely and we will do that too — a person handles it, so allow a few days.

Questions

Email hi@fffonchain.com. The rules for using the service are in the terms.

← Back to the scanner