Privacy Policy

Last updated: 2026-04-17

Summary

ArcPay is a payment protocol on the Arc Network. Most data — payments, balances, creator registrations — is public on-chain. We operate a minimal off-chain backend strictly for: OAuth handle verification (X/Twitter, Google, etc.), social-login wallet creation (via Privy), and serving static UI.

We do not sell your data. We do not run ads. We do not track you across the web.

What we collect

From the browser extension

• The extension reads the DOM of x.com / twitter.com to extract the author handle of each visible tweet. This runs entirely on your device.
• No data leaves your device until you explicitly click the 💸 Tip button, which opens arcpay.finance/{handle} in a new tab.
• The extension stores no cookies, no identifiers, and makes no background HTTP requests.

From arcpay.finance and app.arcpay.finance

• Wallet address — when you connect a wallet or sign in.
• Email / social identifiers — only if you log in with email, Google, Twitter/X, Discord, Farcaster, or GitHub. Managed by Privy.
• X/Twitter handle — if you complete the claim flow (/claim), we perform the OAuth 2.0 PKCE flow and read your handle. We do not post on your behalf. We do not read your DMs or tweets.
• Request logs — standard Vercel edge logs (IP, user-agent, path) for 24 hours for abuse detection. Not linked to wallet or identity.

On-chain (public, by design)

• Tip amounts + messages + sender/recipient addresses (via TipJar, TipJarByHandle).
• Subscription purchases and active status.
• Content unlocks and API call receipts.
• Usernames registered in UsernameRegistry.

Third parties

• Privy — authentication + embedded wallets. Privy policy
• Vercel — hosting, edge functions, analytics-free logs. Vercel policy
• X (Twitter) API — handle lookups via Bearer Token + OAuth 2.0 for claim flow. X policy
• Arc Network — public L1 RPC.

Cookies

Short-lived (10 min) HttpOnly cookies used during the X OAuth flow only: arcpay_state, arcpay_pkce, arcpay_recipient. Deleted immediately after callback. No tracking cookies.

Data deletion

On-chain data is immutable and cannot be deleted. To stop associating your wallet with ArcPay, simply stop using the service — nothing off-chain requires deletion because we store nothing off-chain beyond the 24-hour edge logs, which expire automatically.

Contact

Questions: open an issue at github.com/wanggang22/arcpay.