Privacy policy.

UTXOHub is operated by Symmetric Labs Ltd, UK company number 17151399. We are responsible for the personal data described here (the “data controller”). This policy covers our website, API, interface for AI assistants and Telegram alerts bot. Our registered office and contact details are on this page.

When you enter a payment ID or Bitcoin address, our server asks our Bitcoin data provider for its public transaction history. The provider sees our server's request; we do not forward your IP address or browser details to it. Public Bitcoin addresses and transactions are not necessarily anonymous: they can be linked to a person.

If you scan a QR code from the search box, your browser asks your permission before the camera turns on, and the camera stops when you close the scanner. The camera picture, and any photo or screenshot you choose, is read on your device and never sent to us or anyone else. A code that holds a payment ID, address, block or wallet key opens its page, which is a lookup like any other. Anything else waits in the search box until you search for it. If the code holds a private key or recovery phrase, the scanner says so and sends nothing.

Our host, Vercel, receives your IP address, browser details, request time and requested page. A lookup in a page address can appear in hosting logs or error reports. We use this information to deliver pages, investigate faults and prevent abuse. Removing lookup details from visitor counts does not remove them from hosting logs.

If you email us, we receive your email address and anything you include, and use them to answer you. Please do not send passwords, private keys or recovery words. We never need them.

We use Vercel Web Analytics to see which pages help people. It uses no cookies. Counts include page type, referring site, approximate location, browser and device type. We remove payment IDs, Bitcoin addresses, wallet identifiers and search text from the page paths and event details we send to analytics. Browsers controlled by automated tools, and search engines' and other crawlers, aren't counted.

Vercel processes request information, including IP addresses, to distinguish visits without keeping the raw IP address in its analytics data. Its visitor identifier lasts up to 24 hours; aggregate counts last longer. See Vercel's analytics privacy details.

Your currency, theme, chart preferences and visitor-count choice are saved in your browser's local storage. We receive the currency and time range needed to fetch a price chart; its scale, grid and time-zone preferences stay on your device. Clearing site data removes these settings, including your opt-out. Your browser may also keep lookup URLs in its history.

If you choose Watch on a payment or address, its identifier and the time you saved it are kept in this browser's local storage. The Watchlist does not create an account or a saved list on our server, and does not sync between browsers or devices. We do not save balances or payment histories in the browser's Watchlist.

While you view the Watchlist, status checks send its identifiers to UTXOHub, which requests public data from our Bitcoin data provider. These checks are not included in assistant-usage counts, and saved identifiers and list membership are not sent to visitor analytics. The hosting-request handling described above still applies.

If you ask a payment's page or the Watchlist to notify you when a payment confirms, your browser asks for your permission and shows the notification itself. Your browser remembers your answer for this site; we keep nothing, and nothing is sent anywhere new. While a tab is set to notify you, it keeps checking about once a minute even in the background, as the open page does. A payment's page stops when you turn it off, the payment confirms or is replaced, or you close the tab; the Watchlist stops when you turn it off or close the tab.

Remove an item to stop keeping it in this browser. Clearing this site's data removes the whole list; private browsing may remove it when the private session ends. Removing a saved item does not erase hosting logs or public blockchain records. The Watchlist sends no email and does not monitor payments while it is closed.

If you use Send a signed transaction, we send the transaction you provide to our data provider for broadcast to the Bitcoin network. After a rejection, we may also look up its transaction ID with the same provider to check whether it already confirmed. Its addresses and amounts can become public before confirmation. If confirmed, it becomes part of the public blockchain. We cannot remove it from other people's nodes or the blockchain.

Apps and AI assistants can request the same public information through our API and MCP interface. Hosting logs still apply, and API answers may be reused for up to 10 seconds. We count the kind of lookup and, when recognised, the assistant's name, without including what was looked up. A request that adds stats=off to its address isn't counted. From our host's request records, we also count how many pages AI assistants and crawlers fetch, by the name they give. The assistant's provider handles your conversation under its own privacy policy.

Other websites can show a payment's status badge from UTXOHub, an image that links to the payment's page. If you open a page that shows one, your browser loads the image from us, so our host receives your IP address, browser details and the payment's ID, and usually the website's address as the referrer. Badge requests are not included in visitor counts. The website that shows the badge decides to show it and handles your visit under its own privacy policy.

If you choose Message me on Telegram on a waiting payment's page, Telegram opens a private chat with our bot, @utxohub_alerts_bot, with the payment's ID in the link, so Telegram receives that ID. You can also send the bot a payment ID yourself. The bot answers only people who message it first, only in private chats, and messages you only about payments you asked it to follow.

Telegram sends us each message you send the bot, with your chat ID and the name and username on your Telegram account. We use only the chat ID and the message text. We keep your chat ID and each payment ID you follow, at most five, with our database provider, Upstash, until we send that payment's alert, you send /stop, or seven days have passed since you asked us to follow it, whichever comes first. A check that runs at least every ten minutes deletes anything left over from a request that has expired. To prevent abuse, a count of the messages you sent in the last minute is kept for one minute. We do not keep your name, username or messages, and none of this reaches visitor analytics or assistant-usage counts.

To check those payments, our server asks our Bitcoin data provider about them, as for any lookup. Our messages to you go through Telegram, which handles your account and chats under its own privacy policy. Send /stop at any time to delete everything we keep about your chat. Blocking the bot stops its messages.

Vercel hosts the site and provides visitor counts. Our Bitcoin data comes from mempool.space, or from our own Bitcoin node when the site is set to use it. mempool.space then answers only when our node is down, has fallen behind or can't find what you asked about. While the site reads from mempool.space directly, a request mempool.space can't answer goes to Blockstream's public Bitcoin data service (blockstream.info) when that offers the same answer. Whichever answers receives the IDs, addresses or signed transactions needed to answer your request. Our server gets the Bitcoin price from Kraken's public market data and sends it nothing about you. To draw a picture of a public trading position for our posts, we send that account's public address to Hyperliquid. Upstash stores Telegram alert requests, a chat ID and the payment IDs it follows, and Telegram delivers our alerts bot's messages. Namecheap forwards messages sent to our contact addresses, and our email providers process the correspondence.

We may also disclose information when required by law or where necessary to handle a legal claim. We do not sell personal data or share it for targeted advertising.

Providers may process data outside the UK, including in the United States. Vercel's data processing agreement describes its transfer safeguards, including standard contractual clauses and UK transfer terms. Contact us for information about the safeguards relevant to your data.

We rely on our legitimate interests in providing public Bitcoin information, keeping the service secure, understanding its use and answering enquiries. This means using information for those purposes while considering your privacy rights. Where we must keep or disclose information to comply with the law, we rely on that legal obligation. When you ask our Telegram bot to follow a payment, we rely on our legitimate interest in sending you the alert you asked for. We do not use your data to make automated decisions with legal or similarly significant effects on you.

Hosting logs and analytics have different retention settings managed through Vercel. Logs support fault and abuse investigations; aggregate visitor counts let us compare use over time. A visitor identifier expiring after 24 hours does not mean all logs or counts are deleted then.

We keep correspondence for as long as needed to answer the enquiry, deal with follow-up questions or disputes, and meet legal obligations. The relevant purpose, any unresolved issue and applicable legal requirements determine how long it is needed. Browser settings and saved Watchlist items stay until you change or remove them, clear site data, or your browser discards that storage. Telegram alert requests are deleted when the alert is sent, when you send /stop, or within ten minutes of seven days passing since the request. Public blockchain records are not under our control.

You can ask for access to your personal data, correction, deletion or limits on its use. A right to receive a portable copy can apply in some circumstances. These rights have legal conditions, and we cannot erase the public blockchain.

You can object to processing based on our legitimate interests. Email privacy@utxohub.com to exercise your rights or raise a concern. To delete your Telegram alert requests at once, send /stop to the bot. We may need enough information to identify the relevant records and verify your identity. Never send recovery words or private keys.

We normally respond to rights requests within one calendar month. If the law allows more time for a complex request, we will explain the reason within that month. You can also complain to the Information Commissioner's Office, the UK data protection regulator.

We update this page when our practices change and show the revision date above. A new version does not remove your privacy rights. Our terms of use explain the service's limits.