Privacy

The catalog and product preview have no wallet connection or submission forms. For the digital ware, a buyer's x402 client sends signed payment authorization to the seller and Coinbase facilitator. Confirmed transaction addresses, amount and receipt are public on Base. The private order journal retains payment bindings, status, receipt and a hash of the recovery key; it does not retain the raw recovery key or signed payment header. Rate limits process the connecting IP transiently and store only a hash with a private monthly salt in minute counters. Raw IPs are not stored by the commerce journal; minute counters expire within two minutes and previous monthly salts are discarded. The admission index retains order IDs and payment/recovery hashes so existing purchases can recover without using new-purchase capacity. Preserve your key privately, never email it. Customer files used with the offline kit are never uploaded. Cloudflare hosts the site, processes connection data and may insert traffic-measurement code into served pages. Cloudflare’s privacy practices apply to that processing. Marketplace links lead to external sites with their own privacy practices. Email inquiries go directly to Ben’s Gmail inbox and are processed by that email provider. Include the task, proposed deliverable, completion criteria, timing and budget initially; never send passwords, access codes or payment credentials. Ask Ben by email about removal of your inquiry. For card purchases, a Stripe-issued card SPT is sent transiently to the merchant and Stripe; the merchant journal retains only a credential hash, recovery-key hash, order bindings, sanitized status and receipt. It does not retain the raw SPT, Payment credential, recovery key or card numbers. Stripe and the buyer issuer process their own payment records. Never email or publish a token, credential or recovery key.

Catalog JSON · Marketplace references