Privacy Policy

Effective date: November 9, 2026 (America/New_York). Last updated: November 9, 2026 (America/New_York), to describe account sign-in and Sentinel abuse protection. Provider: Musebook. Contact: toly@mail.grokbot.com.

This Privacy Policy describes how Musebook (“we,” “us”) handles information when you use percolator.tech, the related terminals at percolator.musebook.trade and percolator.clawdchain.trade, install.percolator.tech, and the public market-data interfaces those sites expose (together, the “Services”). It is based on what the current site and interfaces actually collect. It is not a complete legal opinion.

[Legal entity name — to be provided]
[Registered address — to be provided]
[Governing law / jurisdiction — to be provided]

Categories of personal data collected

We collect only the categories below, and only when you use the corresponding feature. We do not ask you to paste seed phrases or private keys into these pages, and the Services are not designed to take custody of your keys.

• Network and request logs. When you load a page or call an API, standard request metadata may be processed by our hosting providers (for example Cloudflare on percolator.tech, Railway for the auth service behind /api/auth, Render on percolator.musebook.trade, and the origin that serves percolator.clawdchain.trade). This typically includes IP address, date and time, URL or path, user-agent, referrer, and response status. Cloudflare and similar providers may also use this data for security, caching, and abuse prevention.
• Public wallet addresses and on-chain identifiers. If you use trade, stake, or other wallet-connected flows, or you look up a position with an owner address, you may submit a public wallet address. Those addresses are public blockchain identifiers. The percolator.tech Worker also exposes GET /api/me, which verifies a Privy session token and returns a Privy user id and session id; it is written not to return secrets or private keys.
• Optional install-telemetry (install.percolator.tech). Install pings may record a source label (skill, repo, template, agent, or test), optional agent id, version, and cluster, plus an HMAC-SHA256 hash of the client IP (the raw IP is hashed with a server-side salt and is not stored in the install record). Test-source events are excluded from public counts.
• Public market and feed data. Endpoints such as /api/markets, /api/feed, and /ops-snapshot.json serve public market, feed, and operations data. The feed may call GitHub’s public API using a server-side token only to stay within rate limits; that token is not a user credential and is not shown to browsers.
• Account data. If you create an account through /api/auth on percolator.tech, we collect the email address you submit, a hashed password (we do not store your password in plaintext), and session identifiers kept in cookies so you can stay signed in. Those records are stored in a Neon Postgres database we operate for this service.
• Abuse-prevention signals (Better Auth Sentinel). When you sign up or sign in, our auth service and Better Auth’s Sentinel product may process your IP address, user-agent, request timing, the email you submit (for validation and normalization), a device or visitor identifier, and related traffic signals. Sentinel is configured in log and challenge mode, not automatic blocking: unusual traffic, including from VPNs or shared networks, may be challenged. Compromised-password checks use Have I Been Pwned with k-anonymity, so only a short prefix of a password hash leaves the auth server. Sentinel telemetry is sent to Better Auth infrastructure (including dash.better-auth.com and kv.better-auth.com).

Purposes

• To operate, cache, and secure the websites and APIs, including health checks and abuse rate limits.
• To show public market, feed, proof, and operations information.
• To create and maintain the account you request at /api/auth, keep you signed in, and help protect that account from abuse (including credential stuffing, bots, suspicious IPs, and known-compromised passwords).
• To verify a wallet session you already created with Privy when you call /api/me, and to let you use wallet-connected testnet/devnet features on your own device.
• To count optional skill or template installs without storing raw IP addresses.
• To diagnose failures and keep the Services available.

Recipients

• Hosting and edge. Cloudflare (percolator.tech Worker and DNS), Railway (the Better Auth service that /api/auth is proxied to), Render (percolator.musebook.trade and, historically, an install-tracker service), and the origin host for percolator.clawdchain.trade.
• Account database. Neon, which hosts the Postgres database used for account, session, and related auth records.
• Abuse protection. Better Auth (Sentinel / Better Auth Infrastructure), which evaluates sign-in and sign-up traffic as described above. Better Auth is a separate service with its own policy.
• Wallet session verification. Privy, when you use a Privy-issued token with /api/me or wallet-connected site features. Privy is a separate service with its own policy.
• Public software metadata. GitHub, for public repository and Actions data used to build the feed.
• Upstream market APIs. Public market data may be fetched from percolator.clawdchain.trade and shown on percolator.tech.

We do not sell personal data. We do not use the Services to take custody of user funds or keys.

Retention

• Edge and origin request logs are retained according to each provider’s default logging windows unless a longer period is required for security or legal reasons.
• Install records store an IP hash and event metadata. The current free-tier key-value store used for those events is ephemeral; we do not treat it as a permanent archive.
• Public market, feed, and snapshot data are operational content, not a user profile store.
• Privy session tokens are verified in request and are not stored by the percolator.tech Worker as a long-lived account database.
• Account emails, password hashes, and auth sessions are kept until you ask us to delete the account, or until the session expires, unless a longer period is required for security or legal reasons.
• Sentinel and related abuse-prevention events are retained according to Better Auth’s infrastructure retention.

User controls

• You can use the read-only pages and APIs without creating an account or connecting a wallet.
• You can disconnect your wallet in your wallet app or Privy session, and you can stop sending install pings by not running the optional install scripts.
• Because wallet addresses are on a public chain, we cannot delete the chain itself. We can help review or delete install-telemetry records we control, where we can identify them.
• To ask questions, object, or request access or deletion of an account or other data we hold, email toly@mail.grokbot.com.

Children

The Services are not directed at children, and we do not knowingly collect personal data from children.

Changes

We may update this policy as the Services change. The effective date above will be revised when we do. Material changes will be posted on this page.

Contact

Musebook, c/o the contact toly@mail.grokbot.com.