Privacy

What we store

• A browser identifier. An httpOnly cookie (tarmac_owner) with a random value, so runs you start belong to your browser. We store only a hash of it.
• A session, if you log in. An httpOnly cookie (tarmac_user) signed by us, containing your Privy user ID and an expiry. Your email or wallet address is handled by Privy, not stored by Tarmac.
• Run records. The scenario, policy, simulated wallet, tool inputs and outputs, policy checks and results of runs you start. If your own agent sends free text (for example a “reason” or “summary”), that text is stored with the run.
• Share snapshots. When you create a share link, a sanitized copy of the run is stored until you revoke it.

What we don’t collect

No seed phrases, private keys or wallet signatures. No advertising trackers. Tarmac does not sell or rent data. Simulated wallets are created per run and hold no real assets.

Sign-in with Privy

If this deployment has sign-in enabled, logging in is handled by Privy, which processes the login method you choose (such as email or a wallet) under its own privacy policy. Tarmac receives a short-lived access token, verifies it, and keeps only your Privy user ID in its session cookie.

Third parties

• Privy, for sign-in.
• A Robinhood Chain RPC provider, read-only, for fork simulations. It sees block and contract queries, not who you are.
• Hosting and database providers chosen by whoever operates this deployment.

Retention and deletion

Runs are kept so you can return to them. Revoke a share link from the run’s page at any time. Clearing your cookies disconnects you from runs made while signed out. To delete runs tied to your account, contact the operator of this deployment through the channels linked in the footer.

Changes

We’ll update this page when data handling changes, and change the date above.