Privacy

Nothing about you is stored. You can read every public page, run the verification checks and open the instrument without identifying yourself in any way.

One key is written to your browser's local storage: receipts.lastVisit, an ISO timestamp of when you last looked, so the feed can show you what changed since then. It stays in your browser, is never sent to the server, and the feature degrades to the last 24 hours if storage is unavailable.

apps/web/src/lib/lastVisit.ts

Signing in proves you control an address. Three things are then stored on the server:

your address

The checksummed EVM address you signed with. That is the whole of the personal data this product holds.

a single-use nonce

Random, valid for ten minutes, consumed the moment it is used, together with the exact message you were asked to sign.

a session record

Valid for seven days. The session token itself is not stored: only its SHA-256 hash is, so a copy of the database does not yield a working session.

The token is kept in your browser under ambang.authToken, in local storage, so a page reload keeps you signed in. Clearing site data removes it and the session then simply expires on the server.

No email address, name, password, phone number or profile is asked for or stored, because none is used for anything. Signing in exists to claim authorship of a strategy, and nothing else.

apps/server/app/auth.py, apps/web/src/lib/session.ts

No cookies are set. The two values described above are in local storage, not cookies, and neither is sent to any third party. There is no analytics package, no tag manager, no session recorder, no advertising pixel and no third-party script of any kind in this site.

The three typefaces are stored with the application and served from this same origin as ordinary font files, so opening a page makes no request to Google or to any other font host.

One thing that is true of any website, stated rather than omitted: the web server that serves these pages writes ordinary request logs, which by their nature can include your IP address, the URL you asked for and the time. Nothing is added to those logs by this product, and they are not used to build a profile, but they exist.

Most of this database is market evidence: the RYO tool responses captured each cycle, the saved snapshot sets built from them, the decisions evaluated against those snapshots, and the hash-chained receipts. That data describes markets, not people, and it is kept precisely so that any decision can be re-executed and disagreed with later.

If you author a strategy and claim it with your wallet, your address is recorded as its owner and is visible alongside it. That is the one place your address appears in something readable by others, and it happens only because you signed a message asking for it.

Every call to RYO is made by the server. The credential lives in a server-side environment variable, and there is no code path that sends it to the browser or embeds it in the exported site. The only value this front end is given at build time is the base URL of the API it should talk to.

Your browser therefore only ever talks to this origin. It does not connect to RYO, and it could not authenticate to RYO if it tried.

apps/server/app/settings.py, RYO_MCP_KEY, apps/web/src/lib/api.ts

Clearing this site's data in your browser removes both stored keys. A session expires by itself after seven days. If you want the address associated with a claimed strategy removed before then, ask through the project's contact route in the repository; this is a hackathon entry with a small database and no automated deletion flow, and saying so is more honest than promising a button that does not exist.

Terms, Limitations