Privacy Policy

This policy explains what personal data Truvo, a project operated by an individual (“Truvo”, “we”) processes when you use truvo.site and api.truvo.site, why, and what choices you have.

Request data (website and API)

When you load a page or call the API, our servers and our network provider receive technical data: your IP address, the date and time, the URL requested, the HTTP method and status, the user agent, and a request ID. API request logs exclude the authorization and x-api-key headers.

API keys

If we issue you an API key, we store only a SHA-256 hash of it, a label you give us, and when it was created or revoked. We never store the key itself.

Operator sign-in

The operator console (for Truvo’s own curators) uses one strictly necessary cookie, al_operator, to keep an operator signed in for up to eight hours. It is HTTP-only and is not set for regular visitors. Operator decisions are recorded with the operator’s handle in an audit log.

Messages you send us

If you email us, we keep your message and address to answer and, for correction requests, to document the change.

What we don’t collect

No accounts, names or payment details for visitors; no analytics or advertising scripts; no fingerprinting. The site’s fonts are served from truvo.site itself. Truvo describes token contracts; it does not index or profile wallet holders.

• To provide the Service: delivering pages and API responses.
• To protect it: rate limiting (per IP address, or per API key), preventing abuse, and investigating incidents.
• To fix problems: request IDs let us trace an error you report.
• To keep a record: the audit log documents who changed curated data and why.

Our basis is our legitimate interest in operating a secure, reliable public information service, and, for messages, handling your request.

We use these service providers, who process data on our behalf:

• Cloudflare: DNS, TLS and the proxy in front of truvo.site and api.truvo.site, which passes your IP address on for rate limiting.
• Runpod: hosting of the website and the API.
• Hugging Face: hosting of a static copy of the site.

These providers may process data in countries other than yours. We do not sell personal data or share it for advertising.

Request logs are kept only as long as needed for security and troubleshooting, then deleted or overwritten. API key records are kept until the key is revoked and the record is no longer needed. Audit log entries are kept permanently, because the integrity of the curation record depends on it.

Depending on where you live (for example under the EU/UK GDPR or Indonesia’s Personal Data Protection Law), you may have the right to access, correct or delete personal data about you, to object to or restrict its use, and to complain to a data protection authority. To make a request, contact [email protected]. We may need to verify that a request is yours.

The Service is not directed at children and we do not knowingly collect their personal data.

We will update this policy when our practices change; the date at the top shows the latest version. Questions: [email protected].

See also the Terms of Use.