Privacy policy
Last updated 6 October 2026. Applies to watchdog.soladrome.finance, the Watchdog Android app (Solana dApp Store) and the Watchdog x402 APIs.
Watchdog runs security checks on code and on-chain programs. It has no user accounts, sets no advertising or analytics cookies, and sells no data. This page lists everything it does collect.
What we collect, and why
| Data | When | Why |
|---|---|---|
| The repository URL, program or contract address, or lockfile you submit | Every check or scan | It is the thing being checked. Public repositories only. |
| Your email address | Only if you enter one for a scan | To send you the report and a private link to it. Nothing else is sent to it. |
| The scan report | Every paid scan | Kept on our server so the private link in your email keeps working. The link carries a secret token; only its hash is stored. |
| Webhook URL | Only if you create a watch | To notify you of a change during the paid watch period. |
| Your wallet's public address and the payment transaction | When you pay | To confirm the payment. Payments are public on the blockchain by nature; we never see or store a private key or seed phrase. |
| Request log: time, method, path, status, user agent, referring site, and a salted hash of your IP address | Every request to the APIs | To count traffic and debug failures. The IP itself is never written down, query strings and request bodies are not logged, and report tokens are removed from paths. |
In the Android app
The app displays this website. Paying connects to a wallet app on your phone (Seed Vault, Phantom, Solflare…) through the Mobile Wallet Adapter: the wallet shows you the transaction and signs it, and the app never has access to your keys. The app asks for no device permissions beyond internet access, and contains no tracking SDK.
Who processes it
- Fly.io hosts the APIs and stores reports and request logs.
- Vercel hosts this website.
- Resend delivers report emails.
- GitHub serves the public repository we download to scan; OSV.dev answers advisory lookups for the package names and versions found in it.
- Blockchain RPC providers (Solana, Base, Robinhood Chain) and the x402 payment facilitator (PayAI) see the addresses and transactions needed to check a program or settle a payment.
Each of them processes data under its own privacy policy. We share nothing with anyone else, and nothing for advertising.
How long we keep it
Reports and the email they were sent to are kept so your link keeps working, until you ask us to delete them. Watches stop at the end of the period you paid for. On-chain payments cannot be deleted by anyone.
Your choices
You can use every check without giving an email. To get a copy of what we hold about you, or to have a report and its email deleted, write to solanawatchdog@proton.me with the repository or the job reference from your email.
Children
Watchdog is a developer tool and is not directed at children.
Changes
If this policy changes, the date at the top changes with it.