Privacy

Stabledesk is built and operated by Gaëtan Moreno, in Nîmes, France, who is responsible for the data described here. Questions, or a request to access or delete anything: studiomoreno@icloud.com.

Every request. Calls to the API and the machine-readable routes are counted per route and per day — for example, "/v1/tvl: 42 calls on 30 October". The count holds no IP address, no user agent and no key.

Web pages. Page views are measured with Umami Cloud, a cookieless analytics service: the page, the referring site, the browser, operating system and device type, and an approximate country. There is no cross-site tracking.

Your browser. Your theme choice and the terminal's watchlist are kept in your browser's local storage. They never leave your device.

API keys. A free key is created without an account. Stored with it: the key, a label if you choose one (up to 60 characters), its tier, when it was created, when it was last used, and how many calls it made, in total and per day. When a key is created, the operator receives a Telegram notification with its label and the first characters of the key — never the full key.

Webhook alerts. An alert stores the webhook URL you give it, its filters (token, address, minimum amount), and when it last fired. Delete it at any time with DELETE /v1/alerts/{id}.

Pro billing, if you pay for it: the order (key, amount, status, dates) and, once paid, the transaction hash of the USDC payment on Base, which is public on that chain anyway.

The MCP endpoint (/mcp), used by AI assistants: the questions and the answers are not stored. Only a daily count per tool name is kept, like the route counts above.

Rate limits. To enforce limits, a client's IP address is held in memory for the current minute (an hour for creating keys), then discarded. It is never written to disk.

Errors. When a request fails, the server logs the method and the error, never the URL, which can carry a key.

Stabledesk indexes public transactions on Arc: addresses, amounts and contracts, as anyone running a node can read them. Pages about individual addresses are kept out of search engines, the MCP endpoint offers no address lookup, and labels name protocols and infrastructure from their operators' published address lists, not people.

• Railway hosts the service; its infrastructure may keep standard connection logs under its own policy.
• Umami Cloud processes page views, as above.
• Telegram carries the operator's notifications: the key label and prefix when a key is created, and a daily count of calls per route and per key.

Nothing is sold, and nothing is shared beyond these.

• Route counts, keys and their call counters: for as long as the service runs, or until you ask for a key to be deleted.
• Webhook alerts: until you delete them.
• Billing orders: kept as accounting records.
• IP addresses: one minute in memory, an hour for key creation — never on disk.

Under the GDPR you can ask to see, correct or delete what concerns you — for instance a key and its counters. Write to studiomoreno@icloud.com with the first characters of the key. You can also complain to the CNIL, the French data protection authority.

If this page changes, its date above changes with it.