Privacy
Last updated 7 November 2026
Draft. This text has not yet been reviewed by legal counsel and may change before it is final. Items in [brackets] are still to be confirmed. Questions: support@otcblock.io.
OTCBlock is operated by [operator entity, to be confirmed]. This page says what the site and its API store about you, why, for how long, and who else sees it. There are no accounts with names or passwords, no cookies, no advertising and no third-party analytics. We do not sell data.
Public by design: the blockchain
Listings, offers, fills, settled deals and their amounts are transactions on HyperEVM. They are public, linked to your wallet address and permanent. Nobody, including us, can delete them.
What the API stores
- Wallet and sign-in. When you sign in with your wallet we store its address and an internal user id. Each sign-in creates a session, stored only as a hash of its token, which expires after 12 hours. Wallet addresses and past session records are kept for now; there is no automatic deletion of them yet.
- Access requests. The wallet, the contact you give (for example a Telegram handle or email), an optional desk name and note. Only pilot admins see them. Each request is deleted 90 days after it was made.
- Counter-offers. A signed counter-offer and its optional note (up to 280 characters) are kept so the other side can see them. They are not deleted automatically yet.
- Requests for quote. The request, the desks you invited and their signed quotes. They are deleted 90 days after the request expires.
- Telegram alerts (optional). If you link Telegram, we keep your chat id while it is linked, plus the alert texts we sent, which hold amounts and ids only. Unlinking deletes the chat id.
- Page counts. The site counts three steps per day: a home page view, an app page view and a wallet connecting. Only the step name and the day are stored, with no address, IP or browser detail. If your browser sends Do Not Track or Global Privacy Control, nothing is sent at all. Counts are deleted after a year.
Logs
Our load balancer logs each request to the API, including your IP address, browser user agent and the address requested. We use these logs to keep the service running and to stop abuse. They are deleted after 30 days. IP addresses are also held in memory for about a minute to rate-limit requests, and are never written to the database.
Backups
The database is backed up daily. Backups are kept for 14 days, so a deleted record can remain in a backup for up to that long.
Stored only in your browser
Your sign-in token is kept in this tab's session storage and disappears when you close the tab. Your address book, the deal links you made and your list of RFQ desks are kept in your browser's local storage. None of these are sent to us. Clearing your site data removes them.
Who else sees data
- Google Cloud hosts the site, API, database and logs, in Tokyo (asia-northeast1).
- Hyperliquid runs the public HyperEVM RPC and price service. Your browser connects to them directly to read the chain and spot prices, so they see your IP address.
- Your wallet provider sees the transactions and messages you sign, under its own terms.
- Telegram delivers the alerts, if you link it.
We share data with others only if the law requires us to. [Counsel to confirm wording.]
Your choices
You can use the site without signing in, turn on Do Not Track or Global Privacy Control to stop the page counts, and unlink Telegram at any time. To ask what we hold about a wallet you control, or to have it deleted, email support@otcblock.io. We may ask you to sign a message with that wallet to prove it is yours. On-chain data cannot be deleted. [Counsel to add the rights that apply by region.]
Changes
If this page changes, the date at the top changes with it.