What is stored

AtStock holds custody of the tokens it moves. That single fact drives everything below: a wallet exists per X account, the server can sign for it, and so what is stored about you is what is needed to know which wallet is yours.

This describes the service as it is deployed. It is a plain description, not a contract.

When you sign in with X we store your numeric X account id, your handle, your display name and your avatar URL, plus a session identifier in a cookie. The account id is the part that matters — wallets are keyed to it, so that a renamed or sold handle never moves anyone’s holdings.

For every transfer we store the amount, the token, the counterparty, the resulting transaction hash and whether it succeeded. If you message us on X, we keep what you sent so we can answer it.

From you, when you sign in or fill in a form. From X, when a handle is resolved to an account id. From the chain itself, when balances are read. Nothing is bought from anyone, and there is no tracking pixel, analytics tag or advertising identifier on this site.

A third-party custody provider holds the wallet keys. X sees the OAuth exchange when you sign in and the replies the bot posts. The public blockchain it settles on records every transfer — a public chain is public, so amounts, addresses and timestamps are permanently readable by anyone, by design and beyond anyone’s power to withdraw.

Nothing is sold. Nothing is shared for advertising.

One cookie, holding a session identifier so that a signed-in browser stays signed in. It is not used to profile anything and there is no third-party cookie on this site.

On whatever host this is deployed to, and with that custody provider for the wallet keys. That blockchain is a public network with nodes in many countries; a transfer recorded there is readable everywhere, permanently, by anyone. That is what a public chain is, and no policy can walk it back.

Account records and transfer history are kept as long as the service runs, because a wallet with no record of who it belongs to is a wallet nobody can open. Sessions expire on their own and can be revoked wholesale. Messages you send us on X are kept until they have been dealt with.

On-chain transactions cannot be deleted by us or by anyone.

Ask what is stored about you and it will be shown to you. Ask for the account record to be deleted and it will be — but understand what that means: the wallet is derived from your X account id, so deleting the record does not delete the wallet or its contents, and it does not remove anything already written to the chain. Move the tokens out first.

This is not built for, aimed at, or appropriate for children. Do not use it if you are under 18.

Wallet keys are held by a third-party custody provider and never touch this server in plaintext. Sessions are random identifiers in a cookie, and every session issued before a set timestamp can be invalidated at once. The rest is ordinary: credentials are held only in the environment, never in the code, and neither they nor the data store can be fetched over the web however the path is spelled.

None of which makes a custodial service risk-free. It makes it a service that says where the risk is.

This page changes when the software does. There is no notification list for it, which is exactly why it is short enough to re-read.

Message @atstock on X. Everything sent there is read.