# Privacy Notice **Version 1.2.0 · Effective 2026-08-17 · Controller: Autoctavian LLC (operator of Cofferline)** This is a plain-English description of what Cofferline does with data. The operator is bootstrapped and has engaged no counsel. Where something is not yet built (for example a formal retention schedule), this notice says so. ## Notice at collection (the short version) Cofferline is an API. Your identity is a **wallet address** — there is no signup form and **no email is collected**. When your agent calls the API we record **security and activity telemetry** (see below) including the request's edge-derived IP address and a truncated user agent, and we store the **treasury data you create** (policies, delegations, ledger, balances) and any **venue trade credentials** you choose to submit (sealed, write-only). We use this to run the service you asked for, keep auditable books, detect abuse, and screen against sanctions/jurisdiction rules. On-chain transactions you authorize are **permanent public records** we cannot delete. ## Who we are The service is operated by **Autoctavian LLC** ("Cofferline", "we"). This notice is between you and Autoctavian LLC. Privacy contact: `security@cofferline.com` (also published in `https://cofferline.com/.well-known/security.txt`). Because a Cofferline account is a wallet with no email, to prove you control an account for a data request you can **sign a challenge** from `POST https://api.cofferline.com/v1/auth/challenge` with that wallet — the same SIWE mechanism you authenticate with. You do not need an email account to reach us or to verify yourself. ## What we collect, and from where - **Wallet address** — your identity (the account primary key). Supplied by you at sign-in. - **No email / contact.** The account schema has an optional `contact` column, but **no endpoint populates it today** — we do not ask for or store email. - **Security & activity telemetry (audit log).** For every authenticated request we record a durable **audit fact** — your wallet address, HTTP method, path, a request id, and the response status — in an append-only log. Each unsealing of a venue credential is also logged with the operation that used it (anomaly detection). The raw **network context** (the **edge-derived client IP** — connection-derived at the edge, not client-spoofable — and a **truncated user agent**, ≤200 chars) is stored **separately** and keyed to the request id, so it can be **deleted on a short window** without touching the immutable audit trail (see retention below). - **Authentication material.** API-key and session tokens are **SHA-256 hashed at rest** (the plaintext is shown once and never stored). We keep each key's scopes and, if you set them, an optional source-IP pin and wallet pin. - **Treasury data you create.** Policies (versioned, immutable), delegations, conversion/gas intents, the double-entry ledger, and balances. - **Payment data.** Prepaid-balance credits, and auto-topup **authorizations** (the payer address, fixed value, nonce, and signature of each pre-signed USDC transfer). Prepaid USDC settles into the platform treasury — see the [custody matrix](/docs/custody). - **Venue trade credentials (optional).** If you trade on Polymarket you may submit a credential. It is **sealed with AES-256-GCM** (tenant+venue-bound), **write-only** (no endpoint returns it), and stored in one table alongside non-secret display facts (e.g. maker address, signature type). - **Webhook configuration.** Destinations you register and their per-account signing secret (the secret is stored unhashed because signing needs it). - **Statements.** Deterministic monthly financial summaries for your wallets, exported immutably to object storage. - **Screening & jurisdiction signals.** We screen counterparties against a sanctions (OFAC SDN) list held at the edge, and gate Polymarket surfaces by jurisdiction (mirroring the venue's own geo-restrictions). - **Support / feature requests.** If you submit one, its content and your requester address (optionally forwarded to the operator's notification channel). ## Why we process it To do the things you call the API to do: enforce your policy, execute conversions and gas top-ups under your delegation, route prediction-market orders, keep the ledger and produce statements, fund the treasury and settle payments, and run the service reliably. Security telemetry supports abuse and anomaly detection (including credential-use volume alerts). Screening and jurisdiction data support sanctions and venue-eligibility compliance. We do not sell data and we run no advertising or third-party analytics. ## Automated and rules-based decisions Several decisions are made by code, server-side and deterministically: **policy checks** (an action beyond your active policy is refused, naming the rule), **sanctions screening** (a blocked counterparty), **jurisdiction gating** (Polymarket surfaces refused from restricted origins), and **suspension / panic** switches an operator can set. Refusals are typed and carry a `remediation` and a `request_id`. To ask a human to review one, contact the operator with the `request_id`. ## Who receives data - **Venues and chains you choose.** When you convert or trade, the trade details (token pair, amount, your address) go to the venue you selected (CoW, ParaSwap, Polymarket) and the transaction goes to the public blockchain. - **Public blockchains.** Transactions you authorize are **permanent, public, and irreversible** on Base and Polygon. Deleting data from Cofferline does not, and cannot, remove an on-chain record. - **Webhook receivers you configure.** These are recipients you direct us to send to; you control them. - **Legally compelled disclosure**, where required. The venues, chains, and webhook receivers are **recipients you direct** — data reaches them because of an action you took, not a choice we made for you. ## How long we keep it **Purged on a schedule:** - SIWE auth nonces — 10-minute TTL, deleted about an hour after expiry. - Sessions — 24-hour TTL, deleted after expiry. - Idempotency keys — 7 days. - Payment challenges — 1 day if unused, 7 days after use. - **Raw request network context (client IP + user agent) — 90 days.** These now live in a store separate from the audit log and are deleted by the hourly housekeeping sweep once they pass the window. The durable **audit fact** they were keyed to (your address, the time, the operation, the request id, and the status) remains. - Coordinator outbox rows — 14 days; sealed signed-transaction envelopes are compacted to a hash after 90 days. - Terminal auto-topup signatures — cryptographically shredded once an authorization is settled, failed, or expired. - Dev-environment test accounts — 7 days. **Retained as long as your account is open, then handled by offboarding:** your account row and its treasury records, sealed venue credentials, and statement exports. When you **offboard** (see *Your choices*), API keys and sessions are revoked, delegations are flipped to revoked with on-chain unwind calldata, **every venue credential's ciphertext is zeroed**, auto-topup arrows are removed with cancellation instructions, the webhook secret and dead-letter bodies are deleted, your optional contact field is scrubbed, and your statement exports are deleted by the housekeeping sweep. Statement objects are safe to delete because they are deterministic **re-derivations of the ledger**, not the source of truth. **Retained permanently, by design:** the append-only **ledger**, **events**, **policies**, and the **audit facts** described above — these are the double-entry books and the security/accountability trail, and offboarding **does not** erase them. Your account **row itself is retired in place, not deleted**, because those immutable books reference it. Anything already on a **public blockchain** is permanent and outside our control. The platform's edge request logs are governed by the hosting provider's native log retention. ## Your choices - **Revoke API keys** (`DELETE https://api.cofferline.com/v1/keys/{id}`); sessions expire on their own. - **Revoke a delegation** on-chain from your owner key — your own transaction, no Cofferline cooperation needed. - **Revoke a venue credential** — the ciphertext is zeroed; rotate a Polymarket signer with the calldata from `GET https://api.cofferline.com/v1/pm/credentials/{id}/rotation`, which you execute yourself. - **Cancel a payment authorization** on-chain (`cancelAuthorization`) — unilateral. - **Export all your data** — `GET https://api.cofferline.com/v1/account/export` returns a complete, versioned JSON snapshot of everything your account holds (profile, keys/session metadata, policies, delegations, intents, ledger, balance, events, webhook config, auto-topup and venue-credential metadata, PM orders/positions, audit records, and a statement-object manifest). It never returns secret material — no token plaintext, no sealed ciphertext, no signatures. Authenticating is the wallet proof; the response is scoped to your account only. - **Offboard (close) your account** — `POST https://api.cofferline.com/v1/account/offboard`, echoing your own wallet address to confirm. This revokes every credential, zeroes venue-credential ciphertext, removes auto-topup arrows (returning the `cancelAuthorization` material — deleting our copy does **not** revoke the on-chain authorization), deletes the webhook secret and dead-letters, scrubs your contact field, deletes your statement exports, and retires your account. Export first if you want a copy. - **Access or deletion request** — the two endpoints above are self-service; you can also contact us, verifying with a wallet signature as above. Limits: append-only records (audit facts, ledger, policies, events) and anything already on a public blockchain **cannot be erased**, and your account row is retired in place rather than deleted because the immutable books reference it. ## Where processing happens The primary database and secret storage are hosted in the United States; compute and storage run on a global edge network. Venues, RPC endpoints, and public blockchains are global services. ## Security Venue credentials and sealed transaction envelopes are AES-256-GCM encrypted; credential and session tokens are hashed at rest; the runtime database role is DML-only and cannot alter append-only, trigger-protected tables; secrets are never in the repository. No system is perfectly secure and we make no absolute guarantee. ## Age Cofferline is infrastructure for autonomous agents and their operators, not a service directed at children, and is not intended for anyone under 18. ## Changes Material changes bump the version and effective date in the header above; the current version and links are also carried in the agent manifest (`https://cofferline.com/.well-known/cofferline.json`).