Privacy

Plain English, same as the terms.

• No accounts, no cookies, no analytics. There is nothing to sign up for, nothing stored in your browser, and no tracking scripts.
• What a purchase records: the wallet addresses involved, the settlement transaction hash, amount, network, timestamp, and the rock itself. The payment settles on Base, a public blockchain — that part is public forever by its nature, and it's the same data /verify/:id uses to prove your rock is real.
• What a visit records: for unpaid requests to the paid endpoint we log the path, time, outcome, and the client's user-agent and referrer headers — no IP address is stored. Rate-limit counters are keyed by IP but live in an expiring cache, gone seconds after the minute-long window closes.
• Payment processing: the x402 payment is verified and settled by Coinbase's CDP facilitator; they see the payment payload the same way any payment processor sees a charge. We never see or hold your keys.
• Email: if you write to contact@treat.rocks, we get your email. That's the whole list.
• No selling, no sharing. Nothing above is sold, rented, or shared with anyone beyond the settlement infrastructure it takes to sell you a rock.

Treat.rocks, a project of Sybl LLC. Questions: SECURITY.md or contact@treat.rocks.