Privacy policy

What personal data ChainWitness processes, why, for how long, where, and your rights. Last updated: 24 October 2026.

ChainWitness follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018). The data controller is ChainWitness (chainwitness.net). For anything about your data, use the contact form.

What we process

Public web content that mentions cryptoasset addresses. We collect from a hand-curated list of public sources — official notices, security research, news — and from public paste sites and code-sharing gists where scammers post wallets. Captured pages can contain personal data of third parties, such as names, emails or IP addresses. They are kept as evidence. Excerpts appear only in full reports, never in public previews, and we do not reproduce sensitive details such as dates of birth or document numbers, even when an official list publishes them. On paste sites we minimise what we show: a seed phrase or private key never appears on our pages or in our records of a finding (it is removed first), we mask third-party contact details near an address, we show only the text around the address, and we discard credential dumps (such as stealer logs) entirely, keeping no content. To preserve evidence, we keep a capture of each paste page we record (never of a discarded dump) as it was published, which can include a seed phrase or key. These captures stay with ChainWitness staff; one is opened to signed-in users only when we decide to expose a scammer's trap.
Your account. When you sign in with Google, we receive and keep your Google account identifier and your email address, and whether Google has verified that email. We do not receive your password, and Google does not send us your name or profile photo. Each device you sign in from gets a random session token in a secure cookie; we keep only its hash, with the time of sign-in and the browser's user agent.
Your profile. Your first name, last name, city, country and sex (or that you prefer not to say), which you give us when you create your account. Only ChainWitness staff see them; they never appear on a public page or next to your reports.
Scam reports you send. The address, network and asset, kind of scam, country, the date and amount you sent, your message, your attachments (photos lose their location and camera data), the links you give us with the captures we make of them, and our review. Once approved, the address, your message as edited by our reviewers, the country, the kind of scam and your attachments (blurred, if you ask) are published on the address page under an anonymous name like User 7K3Q2M, with the date you sent the report. Your name, email and the amount you sent are never published.
Wallets you follow. The addresses you follow, with your label, note, rules and suspect mark, their transaction events and your exposure analyses. A suspect mark only affects your own analyses and is never shown to other users or turned into a public label.
Waitlist. Your email and the IP address the request came from.
Review requests. Your email, your explanation, the signed message and signature if you provide them, and the IP address the request came from.
Contact messages. Your name, email, organization if you give it, your message, any address you mention, our replies and the IP address the message came from.
Investigation cases. Your name, email, who you are in the case, your country, the network, amount range and date, the addresses and transaction hashes you give us, your description, your attachments (photos lose their location and camera data), our replies, the reports we deliver, the activity we record on the addresses we monitor for the case and the IP address the case came from. Nothing from a case is published on ChainWitness without your written consent.
Exposure analyses. The address you search and the IP address the request came from, to limit automated use.
Lookups while signed in. The addresses you search in the search box, the address pages you open and the full reports you view while signed in, with the date and time. We use them to apply the limit on full reports for each account and to detect automated copying of our data.
Access records. Every request to our API is recorded with its date and time, the IP address and source port it came from, the request made, the browser's user agent and, when you are signed in, your account, including each sign-in and sign-out. Brazilian law requires us to keep these records (Marco Civil da Internet, Law 12,965/2014, art. 15).
Usage statistics. Our website sends PostHog the pages you open, the links and buttons you click, the page you came from, and your browser, operating system, device type and screen size, to count visits and see which parts of the site are used. It uses no cookies and stores nothing in your browser. To count visitors without identifying anyone, PostHog combines your IP address and your browser's user agent with the website and the date into an anonymous number that changes every day, then discards the IP address and the user agent. What you type into forms is never sent, forms with personal data are left out even of click counting, and on My Dashboard and your profile only the visit to the page is counted. Nothing is sent if your browser has Do Not Track or Global Privacy Control turned on. We never link these statistics to your account.
Anti-robot check. The review, contact, investigation case and scam report forms use Cloudflare Turnstile, which processes technical data from your browser to tell people from automated traffic.

Who at ChainWitness can see your account

ChainWitness administrators can see account data, including the wallets you follow with their labels, notes, rules and suspect marks and the addresses you looked up while signed in, to provide support, enforce the account limits, and keep the service safe from abuse. Every time an administrator opens an account, changes it or acts on it, the access is recorded with the administrator, the time and the reason. We do not sell or share account data with anyone. Access records are confidential: only administrators can consult them, every search and export is recorded, and we hand them to third parties only under a court order.

Why

To collect and preserve public open-source information and keep the service safe from abuse: legitimate interest (LGPD art. 7, IX).
To serve as evidence in judicial, administrative or arbitration proceedings: regular exercise of rights (LGPD art. 7, VI).
To create and run your account, follow your wallets and compute your analyses: performance of the service you asked for (LGPD art. 7, V).
To publish the scam reports you send, after review, to warn others: your consent when you send the report (LGPD art. 7, I), which you can withdraw at any time by withdrawing the report.
To know who sends each report, check the transfer on the blockchain and build anonymous statistics about scams with your profile: legitimate interest (LGPD art. 7, IX).
To write to you about early access: your consent when you join the waitlist (LGPD art. 7, I), which you can withdraw at any time.
To handle your review request and keep a record of the decision next to the report: legitimate interest and regular exercise of rights.
To answer your contact message and keep the conversation: legitimate interest.
To handle your investigation case, deliver the report and monitor the addresses for 12 months: performance of the service you asked for (LGPD art. 7, V).
To record what administrators do, so any access to your data can be checked later: legitimate interest and regular exercise of rights.
To limit full reports per account and detect automated copying of our data: legitimate interest (LGPD art. 7, IX).
To keep access records as Brazilian law requires: legal obligation (LGPD art. 7, II, and Marco Civil art. 15) for the first 6 months, then regular exercise of rights in judicial, administrative or arbitration proceedings (LGPD art. 7, VI).
To count visits and learn which pages and features are used, so we can improve the site: legitimate interest (LGPD art. 7, IX).

How long

Data	Kept for
Captures and evidence files	As long as they are needed as a record of what was published. A review decision can take an item off the public pages; the capture itself is kept.
Account, sessions, followed wallets, notes, suspect marks, events and analyses	Until you delete your account in My Dashboard, or 12 months without use, then deleted automatically. Signing out deletes that device's session.
Profile	Until you delete your account, or 12 months without use, then deleted automatically.
Scam reports, attachments and messages	Until you withdraw them or delete your account. Withdrawn and rejected reports are deleted after 180 days. Captures of the links you sent are kept as evidence of what the scam site showed, without any link to you.
Record of administrator actions	5 years, then deleted automatically. After your account is deleted, the record keeps only the account number, never your email.
Waitlist email	Until you ask us to remove it or the waitlist closes.
Review request (email, explanation, signature)	5 years after the decision, to answer any later dispute about it, then deleted automatically. The decision itself and any public note stay with the report.
Contact messages and our replies	2 years after the conversation is answered or closed, then deleted automatically. Messages marked as spam are deleted after 30 days.
Investigation cases (details, attachments, reports and the conversation)	5 years after the case is closed, as a record of the expert work, then deleted automatically. Cases we do not take on are deleted 2 years after the decision; spam after 30 days.
IP address of a waitlist, review request, contact message or investigation case	12 months, then deleted automatically.
IP address of an exposure analysis request	30 days, then deleted automatically.
Usage statistics (pages opened, clicks, browser and device type)	As long as PostHog keeps them under our plan. They carry no IP address and no account, and identify no one.
Lookups while signed in (addresses searched, pages opened, full reports viewed)	3 years, then deleted automatically, also after your account is deleted.
Access records (date, time, IP address and port of each request to our API)	3 years, then deleted automatically, also after your account is deleted. Longer only for specific records an authority asks us to preserve (Marco Civil art. 15, §2).

Where

Our servers and evidence storage run on Amazon Web Services in the United States; this website is hosted by Hostinger; sign-in is provided by Google; the anti-robot check is provided by Cloudflare; usage statistics are processed by PostHog in the United States. Exposure analyses query public blockchain services (mempool.space, Etherscan, TronGrid, Solana RPC and Koios for Cardano) with the addresses being analysed, never with your identity. These providers may process data outside Brazil.

Your rights

You can ask for confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, information about sharing, withdrawal of consent, and you can object to processing based on legitimate interest (LGPD art. 18). Use the contact form. You can delete your account yourself at any time in My Dashboard. For content that links an address or an indicator to you, the review form is the fastest route. You can also complain to Brazil's data protection authority (ANPD).

Our crawler

ChainWitnessBot collects only from a hand-curated list of public sources — including public paste sites and code-sharing gists — and respects robots.txt, except where a site's owner authorized us or its terms of use expressly allow automated collection. It reads only public pages and never touches closed forums, private groups or any site behind a login. See how it works, what it keeps from paste sites, and how to opt out on the crawler page.

Contact

Contact form