A public ledger does not make every investigation public business.

The service receives the address, contract, or transaction identifier entered by the user. It sends that identifier, or derived public-chain parameters, to the enabled sources needed to answer the lookup: Alchemy (EVM networks and transfer history; if Alchemy is unavailable, the Pocket Network or dRPC public endpoints), mempool.space (Bitcoin), and Sourcify (verified contract metadata). Those providers can observe the request and the operator's server metadata, not the visitor's browser.

Sanctions and phishing screening compare identifiers in the result with locally stored copies of the OFAC SDN List and ScamSniffer's open phishing-address database. Both lists are downloaded on a schedule; lookups themselves are never sent to those sources.

Do not use the hosted beta for a confidential investigation if disclosure of the seed to Vercel, Cloudflare, Upstash, or an enabled chain-data provider would create risk. Use investigator-controlled infrastructure instead.

• Vercel and Cloudflare may process IP addresses, request headers, device or challenge signals, and operational logs to deliver and protect the site.
• The application converts the requesting network address into a keyed HMAC value before storing rate-limit counters in Upstash. It does not put the raw address in those limiter keys.
• Hourly and daily limiter keys expire shortly after their UTC boundary. Turnstile tokens are submitted for one verification and are not intentionally retained by this application.
• Infrastructure processors may retain their own security and service logs under their policies and configured account settings.

On this public deployment, raw third-party responses are not sent to the browser; only their SHA-256 digests and the derived findings are. On local or investigator-hosted deployments, successful raw responses can be compressed, encrypted with a non-extractable browser key, and stored in that browser for up to 30 days. Session trails and exported files remain on the investigator's device unless the investigator chooses to share them. Clearing site data, changing browsers, or losing the local key can make that material unavailable.

Browser-local encryption is a safeguard, not a promise that source material may be republished. Investigators remain responsible for source terms, minimization, redaction, retention, and lawful disclosure.

• The beta has no user accounts, payment profile, watchlist, bulk upload, or hosted investigation history.
• Query and security data are used to return evidence, enforce limits, diagnose failures, and protect the service—not to assert identity or guilt.
• Requests to access, correct, or delete operator-controlled personal data will be assessed under applicable law after identity and scope are verified.

The operator is OverWatch Labs. Privacy questions, objections to processing, and complaints go to info@forensia.ai.

Grievance officer: to be designated before public launch, info@forensia.ai. Complaints are acknowledged within 3 days and resolved within 30 days.

A person who believes an address result concerns them can ask for a review of the operator's wording, leads, or display through the corrections process, without having to prove identity publicly.