A public ledger does not make every investigation public business.

Google Analytics 4 is off until you allow it in the analytics notice, footer preferences or first-search form. Earlier page-only grants require a fresh choice before this broader measurement starts; earlier declines remain respected. Previous basic product analytics consent does not enable Google. Declining either choice does not block the product. The Google choice expires after 90 days and can be switched off in the same controls.

When enabled on web3.forensia.ai, Google receives coarse page categories, accepted-form submissions, workspace visits and search starts, completions, cancellations and failures, analytics cookie identifiers and browser/device and connection information. Categories include Explore, cases and workspace; they do not include full URLs, query parameters, searched addresses, transaction hashes, form values, names, emails, notes or investigation contents. The tag runs in an empty document separate from the workspace interface. Automatic search and form listeners cannot observe your investigation. Accepted submissions do not establish that a person or email address is new. Events record only actions that begin and finish under the same current Google consent; past actions are never replayed. Page views are grouped by category, so navigating within the same category is not counted as another page view.

Google processes this information under its service policies and may process it internationally. Analytics cookies have a 90-day expiry without sliding renewal. Advertising storage, advertising user data, personalization and Google Signals are disabled by this integration. Google property retention settings are separate from our first-party database retention. Switching this choice off unloads the Google document and removes this tag's analytics cookies; it cannot undo requests already sent or delete historical reports from Google. First-party usage-record deletion is separate.

Opening an Explore profile or lesson records its title, local link and last-opened time in this browser. Saved and marked-read choices, followed topics, practice progress and the last visit to My Explore are also browser-local. They are not synced to an account or used as newsletter consent. My Explore provides controls to remove entries and clear Explore data. Clearing this browser's site data also removes them.

The free unit, identifier, calldata and timestamp utilities process inputs locally and do not save them. Choosing a separate workspace lookup sends that lookup through the existing investigation service. Source listings and network conditions are collected by the server from public or configured providers, independently of your reading choices. Opening a publisher link visits that publisher's website.

Basic product analytics is off until you choose Allow basic product analytics in the first-search form or footer preferences. Both controls reflect the same browser preference. It is separate from the required first-search signup and newsletter consent. Declining analytics does not prevent searches. Once enabled, it measures visits, coarse device and referral categories, known campaign labels, search types and networks, success or failure categories, feature actions and active time in sections. Unknown campaign text, full referrers and page URLs are not retained. Hidden, unfocused and idle time is excluded from active-time estimates.

Active-time estimates use one active tab at a time in this browser. Browser suspension, blocked storage and tab switching can leave gaps; this is not a precise measure of reading time. Export measurement distinguishes preparation, failure and download clicks, not confirmed file delivery. Failure events contain a format category, not your file contents or raw error messages.

The analytics payload does not include the searched address or transaction, your name or email, wallet balances, saved investigations, notes, documents, keystrokes or a recording of your session. A random browser identifier lasts up to 90 days, and a session ends after 30 idle minutes. These identify a browser, not a verified person. Basic usage is not linked to the signup contact list. Exact-target and contact-linked analytics are not enabled in this release.

Vercel processes analytics requests and Neon stores analytics in the United States. Event records older than 90 days are excluded from reports and removed from active storage by scheduled cleanup. Cleanup normally runs hourly; interruptions can delay physical removal. Identifier-free aggregates are retained for up to 395 days. Provider security logs and recovery backups follow their separate retention settings and may outlast active records. No advertising pixels, cross-site tracking or sale of usage data is part of this feature.

Switch analytics off to stop future basic usage measurement. Delete earlier usage records requests deletion from active storage and keeps the removal code until the server acknowledges success. Codes stay in this browser for up to 180 days; clearing browser data loses them. A hashed withdrawal marker remains for 90 days to reject delayed events. Deletion does not remove anonymous totals, signup records, saved investigations or files you downloaded. Recovery data is not used for reporting; any recovery must reapply expiry and deletion restrictions before collection resumes.

Separate identifier-free service counters measure request outcomes, duration ranges and provider-call counts to operate the service. They contain no browser identifier, exact search, contact information or raw error text and are not conditional on optional usage consent. Analytics is sampled by consent, browser restrictions and capacity limits; it cannot establish the total number of people using Forensia.

If you sign up, by checking the consent box, by submitting the first-search form or by sending the Contact us form in the site footer, Forensia stores your name as you typed it, your email, submission and expiry times, consent-text version, a web-signup label and the approved site identifier in the operator's Upstash database. A newsletter signup made from 9 October 2026 is kept until you withdraw it, and for two years at most. A Contact us request, and any signup made before that date, expires after 90 days. We do not attach searched identifiers, investigation results or page-query URLs. Where the first-search form is shown, giving a name and email is required before your first search in that browser; the later signup forms are optional.

Cross-site signup collection is disabled by default. If separately approved and enabled, the same signup service can also receive separately consented OverWatchLabs product-update requests from overwatchlabs.ai. Each site's consent and expiry remain separate, even for the same email address; signing up on one does not subscribe you to the other. Older records without site attribution are not silently assigned new consent. Sharing storage does not authorize a combined-brand marketing campaign.

A first-time visitor sees a name-and-email form before their first search and must submit it to continue. Submitting it also records your agreement to receive the Forensia newsletter by email (product updates, new case studies and new blog posts), which you can withdraw at any time without losing access. That the form was submitted is kept in local storage on your device so it is not shown again in that browser; clearing site data, or using another browser or device, shows it again. If signup itself is unavailable, the search is allowed through and the form is shown again later. Once a signup is recorded in a browser, the later invitation is not shown there. The Contact us form in the footer is optional. Sending it records your agreement to be emailed about your enquiry, under its own consent label, and it counts as a recorded signup for the purpose of not asking again. The later signup invitation stores only a shown/not-shown preference in session storage, so it is not repeated in the same browser-tab session. Neither preference contains a name, email or investigation identifier, neither is sent to our server, and neither is proof of signup or consent.

Verification uses Cloudflare Turnstile. Vercel, Cloudflare and Upstash process the request and operational metadata under their service policies. Separate keyed abuse counters expire within an hour or day. No subscriber list, counts, email addresses or database credentials are returned by a public read endpoint.

A new signup receives a private withdrawal link on screen and, where email delivery is switched on, in its confirmation email. Keep it to remove the signup immediately. Duplicate submissions do not replace the original withdrawal link. If you lose it, or signed up before this version, email abhimanyu.gupta@overwatchlabs.ai from the submitted address to request access, correction or removal. Earlier records are not silently deleted or treated as fresh consent.

Where email delivery is switched on for this deployment, a new Forensia signup is sent one confirmation email from info@forensia.ai. It repeats what was received and carries the same private withdrawal link. A duplicate submission sends nothing. Email ownership is unverified, so the confirmation may reach someone who did not type the address; its link removes the record at once.

People who signed up for the Forensia newsletter may be sent it from info@forensia.ai: product updates, new case studies and new blog posts, only when there is something new. People who signed up before 9 October 2026 agreed to product updates only, so they are sent product updates and nothing else. A footer Contact us request is not added to the newsletter. Every newsletter carries an unsubscribe link unique to its recipient, and the same one-click unsubscribe that mail apps show; either removes the stored record. Newsletters are sent by the operator from a local tool, not by a public route. Messages contain no tracking pixels and no tracked links. Email is delivered through Resend, which processes the recipient address and message content under its service policy.

The optional Explore digest has its own consent version and separate subscription record. It covers original Forensia explanations and corrections, not every publisher headline. An earlier newsletter signup or contact enquiry does not enroll you. Its name, email and consent are retained until withdrawal and for two years at most. Its withdrawal link removes that digest subscription; other separately agreed subscriptions remain separate. Digest issue delivery is not active at this release stage.

We do not sell the list or combine it with wallet lookups. Infrastructure logs or backups may outlast application-record expiry under provider policies.

The service receives the address, contract, or transaction identifier entered by the user. It sends that identifier, or derived public-chain parameters, to the enabled sources needed to answer the lookup: Alchemy (EVM networks and transfer history; if Alchemy is unavailable, the Pocket Network or dRPC public endpoints), mempool.space (Bitcoin), and Sourcify (verified contract metadata). Those providers can observe the request and the operator's server metadata, not the visitor's browser.

Sanctions and phishing screening compare identifiers in the result with locally stored copies of the OFAC SDN List and ScamSniffer's open phishing-address database. Both lists are downloaded on a schedule; lookups themselves are never sent to those sources.

Successful metadata responses from the official Sourcify API may be reused for five minutes, with their original capture time and response hash. The process-local cache holds at most 32 entries and 8 MiB of response text, keyed by network, contract address and requested fields—not by visitor or email. Expired entries are discarded on the next cache operation or when the process ends; they are never served after expiry. This cache is not written to a database and does not change raw-evidence download restrictions. Custom provider endpoints are not cached by this feature.

Do not use the hosted beta for a confidential investigation if disclosure of the seed to Vercel, Cloudflare, Upstash, or an enabled chain-data provider would create risk. Use investigator-controlled infrastructure instead.

• Vercel and Cloudflare may process IP addresses, request headers, device or challenge signals, and operational logs to deliver and protect the site.
• The application converts the requesting network address into a keyed HMAC value before storing rate-limit counters in Upstash. It does not put the raw address in those limiter keys.
• Hourly and daily limiter keys expire shortly after their UTC boundary. Turnstile tokens are submitted for one verification and are not intentionally retained by this application.
• Infrastructure processors may retain their own security and service logs under their policies and configured account settings.

If you choose Save result, this browser stores up to five investigations, each containing at most two captured results and optional review entries. Saved investigations are not encrypted or synced to the operator, signup service, data providers or an AI service. Reopening one does not run a fresh lookup. It remains until you remove it or browser storage is cleared or evicted; download a JSON backup to retain a copy. Local removal does not delete files you previously exported. Importing a file checks its format and internal consistency, not its author or the truth of its claims.

Documents in Saved is optional. You may attach up to four UTF-8 text or Markdown files per investigation, each at most 128 KiB (512 KiB combined), within the investigation's 2 MiB limit. Original text, supplied source information and selected excerpts stay unencrypted in this browser. This feature does not upload files, send them to an AI service or fetch their source URLs. Document-enabled JSON backups include the full original text; Markdown reports include selected excerpts and attribution. Only attach material you are authorized to retain, and review sensitive content and sharing rights before exporting or distributing it. Remove a document and its excerpts in Documents, or remove its saved investigation; previously downloaded copies remain unchanged.

If you choose Save trace, a separate browser-only store retains up to five Bitcoin output traces (2 MiB each, 10 MiB total). Each contains its original investigation and up to four attempts, including failures or pending checks. It is not encrypted or synced and is not included in Save result. Check next transaction deliberately sends the next public transaction identifier to the configured Bitcoin source through the same guarded lookup endpoint. Downloaded trace backups contain metadata and source hashes, not raw response bodies; consistency checks do not authenticate the file or its author. Remove a trace in Saved Bitcoin traces, or clear this site's browser storage. Neither action removes downloaded files.

Save EVM trace and Save token trace use two separate browser-only stores: five traces per store, 3 MiB per trace and 10 MiB total per store. They are separate from Save result and Bitcoin traces, and are not encrypted or synced. Each retains its starting result, bounded check history, source hashes and up to four attempts across its starting transfers or events. Trace backups contain metadata, not raw RPC response bodies; checking their consistency does not authenticate the provider or the file's author. Remove native or token traces in Saved EVM traces. Browser clearing or eviction can remove saved traces; downloaded files remain unchanged.

For saved Bitcoin, native EVM and token traces, later checks you explicitly start record an attempt before contacting sources and save their outcome automatically when browser storage succeeds. Attempts remain counted even if interrupted or unsuccessful. Reopening or importing does not start a lookup or retry a pending check. Unsaved trace progress remains temporary; a failed save can leave an outcome only in the open page, with an explicit recovery or backup action. A new EVM check sends the selected public transaction and relevant transfer context to configured EVM providers through the guarded lookup endpoint. Saving or reopening alone does not send trace history to providers or an AI service.

On this public deployment, raw third-party responses are not sent to the browser; only their SHA-256 digests and the derived findings are. On local or investigator-hosted deployments, successful raw responses can be compressed, encrypted with a non-extractable browser key, and stored in that browser for up to 30 days. Session trails and exported files remain on the investigator's device unless the investigator chooses to share them. Clearing site data, changing browsers, or losing the local key can make that material unavailable.

Browser-local encryption is a safeguard, not a promise that source material may be republished. Investigators remain responsible for source terms, minimization, redaction, retention, and lawful disclosure.

• The beta has no user accounts, payment profile, watchlist, bulk upload, or hosted investigation history.
• Query and security data are used to return evidence, enforce limits, diagnose failures, and protect the service—not to assert identity or guilt.
• Requests to access, correct, or delete operator-controlled personal data will be assessed under applicable law after identity and scope are verified.

The operator is OverwatchLabs. Privacy questions, objections to processing, and complaints go to abhimanyu.gupta@overwatchlabs.ai.

Complaints contact: abhimanyu.gupta@overwatchlabs.ai. Complaints are acknowledged within 3 days and resolved within 30 days.

A person who believes an address result concerns them can ask for a review of the operator's wording, leads, or display through the corrections process, without having to prove identity publicly.