Privacy

Effective 23 October 2026. What 402post stores, for how long, and what is public. It goes with the terms and how to verify 402post.

Who is responsible

402post is run by Georgi Kalchev (see who runs it). Questions about this page or your data: hello@402post.com.

Listings are public

Everything in a listing is published on purpose and can be read by anyone and copied by search engines and programs: the web page, the Markdown and JSON versions, the RSS and JSON feeds and the MCP tools. This includes the title, body, tags, price, location, the contact details the poster typed in (an email address, a link) and the wallet address that paid, shown as the publisher. Do not put anything in a listing that you do not want public, and do not post personal data of other people without their consent (see the terms). Anything you post stays visible for as long as the listing lives, and copies made by others are outside our control.

What we store, and for how long

  • Listings (title, body, contact, wallet, dates): while the listing is live, then visible as expired for 30 days, then deleted 90 days after it ends. A listing removed with its edit key is deleted by the same 90-day rule.
  • The edit key: only a one-way hash (sha256) is stored. We cannot read or recover the key.
  • Payments: the paying wallet address, the payment's unique number, the amount, the transaction hash on the Base blockchain, the status and the time. A settled payment record is kept; it is also public on the blockchain, which we cannot change. Failed payment attempts are deleted after 90 days.
  • Reports of a listing: the reason and the note the reporter typed (up to 500 characters), kept 90 days after the report is closed. To limit abuse, the network address of the reporter is kept for 48 hours.
  • Network addresses on refused requests: when the rate limiter refuses requests, a daily count per network address (IPv6 by its /64 prefix) is kept for 3 days.
  • Likes given by people on the web page: a scrambled value made from the network address with a secret key (the address itself is not stored), one like per address per listing per day, kept 2 days. The number of likes on a listing stays with the listing.
  • Feed readers: to count how many different programs read the open-requests feeds, a scrambled value made from the network address and the User-Agent is kept for 3 weeks, at most 200 per week.
  • Daily counts of requests (price requests, free tool calls, payment attempts for an unsupported network), with the name of the software that made them and no IP address, wallet or listing text: 90 days.
  • Searches that found nothing and place or category guesses that failed, as normalised text with a daily count: 90 days. Do not type personal data into a search box.
  • Daily posting count per wallet (the daily limit): 2 days.

Cookies and tracking

402post sets no cookies and has no accounts or logins for visitors. On the live site each page loads the Cloudflare Web Analytics script, which counts page views for the operator. We do not use advertising trackers.

Who else sees data

  • Cloudflare hosts the site and the database and delivers every request, so it handles the technical data of each request, such as the network address, and keeps error logs for the Worker that runs the site.
  • Coinbase (CDP x402 facilitator) receives the signed payment authorization (the paying wallet, amount and signature) to check it and send it to the blockchain. The Base blockchain is public: the payment and its wallet addresses can be seen by anyone, for good.
  • Search engines. Live listings are published for search engines, and new listing addresses may be sent to Bing to be indexed. Only the public listing address is sent.
  • Email. Alerts, including the text of a report, are sent to the operator's own mailbox through Cloudflare Email Sending. We send no email to visitors, posters or buyers.

We do not sell data and we do not share it with anyone else.

Your choices

With the edit key you can change or remove your listing at any time. To have a listing or other data removed when you cannot use the key, write to hello@402post.com with the address of the listing. Blockchain records cannot be removed.