Privacy and data
This page lists what the service stores, with retention values taken from the code.
#Stored data and retention
| Data | Fields | Where | Kept |
|---|---|---|---|
| Transfers | Public chain data and labels | Database | 7 days, pruned hourly |
| Status samples | Chain state, lag, errors | Database | 30 days |
| Saved copies of lookups | The last answer per wallet, token, stablecoin and DEX lookup, including the address looked up. No caller identity. | Database | 7 days |
| Accounts | Account id, Solana wallet address, created time, last seen time, linked Telegram chat id | Database | No automatic deletion |
| Sessions | SHA-256 hash of the token, account id, expiry | Database | 7 days, removed at the next hourly prune or at sign-out |
| Sign-in challenges | Nonce, address, message, expiry | Database | Deleted on first use, else at the first hourly prune after 5 minutes |
| Telegram link codes | Code, account id, expiry | Database | 15 minute life, removed when used or replaced |
| API keys | Key id, SHA-256 hash, label, created time, last used time, revoked flag, account id | Database | No automatic deletion |
| Key usage | Key id, UTC day, count | Database | No automatic deletion |
| Rules | Name, expression, URL, format, secret, state | Database | Until you delete them |
| Webhook deliveries | Rule id, event, status, attempts, error | Database | 14 days |
| Delivery payload | Event JSON | Database | Cleared after delivered or failed |
| Contact messages | Name, email, company, topic, message | Database | 30 days after sending |
| Rate limit counters | SHA-256 of the IP, count | Memory only | Lost on restart |
| Stream connection counts | SHA-256 of the IP | Memory only | Lost on restart |
| Upstream cache | Answers from sources | Memory only | By cache time |
A contact row that could not be forwarded after 50 attempts stays in the database and is not pruned, so that the message is not lost. The payload of a contact row is replaced by {} once it has been forwarded.
A revoke does not delete the key's row. It marks the key revoked. To delete a rule and its secret, use Delete a rule. That also deletes the rule's delivery log. There is no endpoint that deletes an account. To ask for this, write to contact@farbeamlabs.com.
A wallet address is public. If you sign in, your account links it to your keys, your rules and any linked Telegram chat. If you do not want that link, use a wallet that you keep for this purpose, or read the API with no key.
#What the app does not collect
- No request log is written by the app. Unexpected 500 errors print the method, path and message to the process log. That line holds no IP address.
- No email, name or password is needed for an account or a key.
- IP addresses are not written to disk by the app. They are hashed and held in memory for rate limits and stream counts.
- No third-party analytics, pixels or ad scripts run on the site.
- Fonts are self-hosted, so loading a page makes no request to a font provider.
- The site sends
Referrer-Policy: no-referrer.
#Browser storage
| Item | Place | Purpose |
|---|---|---|
| Theme and code language choice | localStorage | Display preference |
| Playground API key | Page memory | Lost when the page closes |
| Session | fb_session cookie, HttpOnly | Set only after wallet sign-in. Lasts 7 days. |
The session cookie is the only cookie. Reading the API needs no cookie.
#Data about wallets
Farbeam stores public chain data. It also stores labels, which are 54 hand-curated names for public addresses, such as exchange wallets and contracts. Labels are not applied to private individuals by policy. To report a label as wrong, write to contact@farbeamlabs.com.
Stored rows expire after 7 days, but the chain itself keeps the original records, and Farbeam cannot change or remove those.
#Data sent to third parties
When you request a lookup, the server may send the address, token or transaction to the sources that serve it. Your IP and key are not forwarded. See data sources for each source, and read their policies as well. If you save a webhook URL, the server sends event data to that URL. If you link Telegram, alert text goes to Telegram for that chat.
#Your choices
| Action | How |
|---|---|
| Stop using a key | DELETE /keys/{id} or DELETE /me |
| End a session | POST /auth/logout |
| Unlink Telegram | DELETE /account/telegram, or send /stop to the bot |
| Remove a rule and its secret | DELETE /rules/{id} |
| Use the API with no key | Yes, for all read endpoints at 30 units per minute |
| Ask about a contact message | contact@farbeamlabs.com |
#Questions
Write to contact@farbeamlabs.com. Security items are on the security page.