# Wallet of Agents privacy notice

Version 2026-10-26. This notice explains what the hosted Wallet of Agents service stores, what it logs and what is public.

## What we store

- Your name, account id and the plan you paid for, with its dates.
- A one-way hash of your account secret (never the secret itself).
- Your Nostr public key, if you give one.
- Your receive-only wallet connection, encrypted at rest. It can create and look up invoices only.
- Your wallet's node key (the payee key on your invoices). This is public on every invoice anyway.
- Invoices we asked your wallet to create for your address: amount, payment hash, the payer's comment if any, and times.
- Receipts for settled payments, signed by us.
- Billing records for what you paid us: order id, items, amount, payment hash and time.

## What we log

- Operational events: account created, wallet connected or disconnected, payment received (amount, no payer details), renewals, errors and refusals.
- We never log wallet connection strings, account secrets or authorization headers. Log lines are scrubbed for them before they are written.
- Your IP address is used in memory for rate limits. Unpaid orders keep a salted one-way hash of it until the order is paid or expires. A free sign-up keeps the same salted hash for 24 hours, to limit free sign-ups per address, then it is removed. Our web server keeps no access log.
- For each name we keep the time of the last payment attempt to it (no payer details, no IP), so a name people still try to pay is not released. When a name is released, that time is written in the public log.
- Free tier: to decide whether your next Lightning address period is free, we add up the amounts on your own signed receipts from the 30 days before it. The total and the decision are shown to you in your account and kept in our internal audit log. They are not public; the public log only says "renewed", the same as for a paid renewal. (Added 2026-10-26.)
- We do not use cookies, trackers or analytics. We do not ask for an email address or a real name.

## What is public

- Your Lightning address and, while it resolves, its LNURL-pay details.
- Your payee node key, Nostr public key (if given) and sign-up date in the discovery listing, unless you set listed to false. Anyone can still look up a single active address.
- The registration log: name registered, wallet connected or disconnected, renewed, released, with times and node keys. It is append-only and signed.
- A receipt is readable by anyone who has its payment hash (the payer and you).

## How long we keep it

- Payment history: 90 days on the Lightning address plan, 365 days on Pro.
- Unpaid invoices: about one day after they expire.
- Operational logs: rotated after 90 days.
- Billing records: kept for 24 months for accounting.
- When you leave: your wallet connection is deleted at once and your receipts are deleted at the next clean-up. The name record is kept while the name is held, then marked released.
- When a plan lapses past the hold period: your wallet connection is deleted and the name released.

## Who else sees data

- The Nostr relays named in your wallet connection carry encrypted messages between WoA and your wallet.
- Payers see the invoice your wallet created.
- Our hosting provider runs the server the service is on.
- We do not sell data, and we share it only when the law requires it.

## Your choices

- Hide your listing (PATCH /woa/v2/account with "listed": false).
- Export your history (GET /woa/v2/account/history).
- Rotate your secret, disconnect your wallet, or leave at any time, for free.

## Contact

X: @WalletOfAgents. Nostr: Wallet of Agents. Security: /.well-known/security.txt.