Privacy

MorScan is built to need almost nothing from you. No account is required to use the explorer.

Why we collect any of this

One reason: to understand how MorScan is actually used so we can improve the experience and the product. Which pages people find useful, what they search for, what breaks, whether anyone is here at all. That is the entire purpose. We do not sell your data, we do not share it with data brokers, we do not run advertising, and we do not build advertising profiles.

What we collect

• Standard server logs (IP address, user agent, requested URL) used for security, abuse prevention, and per-IP rate limiting. Logs are short-lived.
• If you mint an API key: your wallet address is the key's identity. We store it in the key record, in the signer attestation that links a derived signer to its staking wallet, and in per-wallet usage stats, together with per-key usage counts for rate limiting. Capacity follows your live on-chain MOR stake.
• If you pay with x402: we store the record needed to verify and settle the payment - your payer wallet address, the signed transfer authorization, the amount, and the on-chain settlement transaction hash.
• Retention: key identity and payment records are kept for as long as needed to operate the service, settle payments, and meet our accounting obligations. Settled transactions are public and permanent on the Base blockchain; we cannot remove those. We never handle card data.
• If you sign in to the API console: one HttpOnly session cookie. It exists only to keep you signed in and expires in 24 hours.
• Aggregate traffic analytics come from Cloudflare's server-side zone analytics (request counts and network metadata measured at Cloudflare's edge). These are measured at the edge and set no cookies.

Analytics (optional, consent-gated)

We use Google Analytics 4, a web analytics service provided by Google LLC (and, for visitors in the EEA and the UK, Google Ireland Limited), to understand how visitors use morscan.io. It runs only if you accept it in the cookie banner. If you decline, or ignore the banner, no analytics code loads and nothing is sent to Google.

If you accept, the following is collected: the pages you view and how you arrived; approximate city-level location derived from your IP address (Google Analytics 4 does not log or store the IP itself); device information such as browser, operating system, screen size, and language; and a random identifier stored in first-party cookies (named _ga and _ga_ plus a container id) so repeat visits count as one visitor. We do not send Google your wallet address, your name, or your email, we do not use analytics data for advertising, and we do not sell it. Google processes this data on our behalf as a data processor under Google's data processing terms, which include the EU Standard Contractual Clauses where they apply; data may be processed in the United States, and Google LLC participates in the EU-U.S. Data Privacy Framework.

If you signed in with a DRM3 account and accepted analytics, we also send Google a pseudonymous account identifier, so that a person who uses several DRM3 apps is counted as one person instead of several. Because those apps live on separate domains, this identifier is what links your activity across them into a single view. It is an opaque internal id: not your name, your email, your username, or your wallet address, and Google cannot identify you from it on its own. We never combine it with advertising data and it is never sold. If you signed in with a wallet or an API key instead, no identifier is sent, because that is not a DRM3 account. Signed out, or analytics declined, nothing is sent.

Retention: Google Analytics keeps this data for up to 14 months, then deletes it automatically; the _ga cookies expire after at most two years. Your consent choice stays in your browser until you change it: use the Cookie settings link in the footer at any time. Switching analytics off deletes the Google Analytics cookies for this site and stops any further collection.

Connecting a wallet

If you choose to connect a wallet through WalletConnect, your browser talks directly to the WalletConnect/Reown relay and related endpoints (the wss relay, the wallet registry, and the verify service) to establish the session; those services see your IP address and connection metadata under their own privacy policies. This happens only when you connect a wallet - simply browsing MorScan never contacts them.

What we do not do

• No advertising, no advertising profiles, and no fingerprinting. Analytics cookies are set only if you accept them, and you can withdraw that at any time from Cookie settings in the footer.
• We do not sell your data or share it with data brokers.
• We do not link your IP address to blockchain addresses you look up.

Blockchain data

Wallet and provider addresses shown on MorScan are public information already recorded on the Base blockchain. We index it; we do not collect it from you, and we cannot remove it from the chain.

Infrastructure

MorScan runs on Cloudflare, which processes requests to serve the site (including standard network metadata). Price data is fetched from third-party market APIs server-side; your requests are not forwarded to them.

Contact

Questions: morscan@drm3.io.

Mailing address: