// Privacy · last updated 2026-07-31
We do not collect anything, and here is what that means specifically.
Most privacy policies describe an extensive collection apparatus in language designed to make it sound minimal. This one is short because there is genuinely very little to describe, and every claim below was checked against the code before it was written down.
This website sets no cookies, runs no analytics, and loads no scripts, fonts, or images from anyone else’s server. There is no consent banner because there is nothing to consent to.
The website
nonenonenone — fonts are self-hostednokept by our host, ~30 daysFonts are compiled into the site by the build rather than requested from a font CDN, so reading this page does not tell a third party that you read it. A strict Content-Security-Policy blocks external requests, which means the absence above is enforced by the browser rather than promised by us.
Our host (Vercel) records the ordinary web-server facts needed to serve a request and defend against abuse: IP address, user agent, the path requested, and a timestamp. We do not join those to anything, do not build profiles from them, and do not sell or share them. Their retention window governs, not ours.
The tools
Both packages run entirely on your machine. Neither phones home, and this is a design property rather than a setting you have to find and turn off:
no network calls, no telemetryno network calls on the verdict pathnonewormhole-guard scans files on your disk and writes its findings to your disk. When it quarantines a payload it keeps the original byte-for-byte, locally, so it can be restored. Nothing leaves.
wormhole-x402 compares a payment against a quote using arithmetic. There is no lookup, no RPC call and no remote service in that path, so we could not observe your payments even if we wanted to.
If you use a hosted API from us
The hosted verification API is not open to the public yet. When it is, this section will say exactly what a request stores before anyone can send one. The design it is being built to, today, is:
A verdict record keeps the decision, the protocol and chain, finding codes, a latency bucket and a timestamp. It does not keep the payment, the quote, or the text of a finding — a finding message carries the expected and actual amounts, which are the contents of your payment, so only the code is stored. Wallet addresses are held as a salted hash except where an address must be readable to query a public chain, and the dashboard renders a hash prefix rather than an address.
We will not add analytics to that dashboard without saying so on this page first.
Your rights, and the honest limit
If you are in the EEA, the UK, or California you have rights to access, correct, delete, and port personal data a service holds about you, and to object to its processing. We support all of them. The limit worth stating plainly is that for the website and the local tools we hold nothing to give you — there is no account, no identifier, and no record tied to you. A deletion request for the hosted API, once it exists, removes your organisation and its records.
Write to helloagentwormhole.com and we will answer.
Changes
If this policy changes in a way that increases what is collected, the date at the top changes and the change is described here rather than quietly folded in. The site is open source, so the history of this file is public and checkable.
Questions about this document: helloagentwormhole.com· Agent Wormhole is an independent project. The software is licensed Apache 2.0 and its licence, not this page, governs your use of the code.