1. Who We Are
Bittensor.ai (“we,” “us,” or “our”) is a blockchain explorer and ecosystem platform for the Bittensor decentralized AI network. This policy describes how we handle your information when you use our website and services.
2. Information We Collect
2.1 Information You Provide
- Account information: When you create an account, we collect your email address, username, and password (hashed — we never store plaintext passwords).
- Third-party sign-in: If you sign in with Google, we receive your name and email address from Google. We do not receive or store your Google password.
- Wallet addresses: If you link a Bittensor wallet, we store the public address (SS58) and a verification signature. We never have access to your private keys.
- API keys: If you generate API keys, we store a hashed version. The plaintext key is shown to you once at creation and is not stored.
- Security credentials: If you enable two-factor authentication (TOTP authenticator app) or register a passkey (WebAuthn), we store the associated credential data needed to verify your identity. TOTP secrets are stored encrypted; passkey public keys are stored but your biometric data never leaves your device.
- Anonymous accounts: You may use certain features without registering. In this case we generate an anonymous account with a unique account key. No personal information is collected until you choose to add an email or upgrade your account.
- Wallet detection: When you visit our swap page, we check for the presence of browser-based cryptocurrency wallets (such as MetaMask, Phantom, or Talisman) to improve your experience. We do not access your wallet balances or accounts without your explicit permission — detection only checks whether wallet software is installed. If you choose to connect a wallet, we may read your public address and native token balance to pre-fill forms. This data is processed locally in your browser and is not sent to our servers.
- EVM wallet connection: On our swap page, you may choose to connect an Ethereum-compatible wallet (e.g. MetaMask, Coinbase Wallet) via Reown AppKit to auto-send transactions. When you connect, your public wallet address and chain ID are shared with Reown's WalletConnect relay servers to facilitate the connection. We do not access or store your private keys. Transaction signing happens entirely in your wallet — Bittensor.ai only receives the transaction hash after you approve. See section 9 for Reown/WalletConnect's data practices.
- Preferences: Dashboard layout, favorite subnets, and display settings you configure.
- Search queries: Queries you enter in the search bar are sent to our backend to return results. We do not persistently log individual search queries.
2.2 Information Collected Automatically
- Security tokens: We set a short-lived, HttpOnly cookie (“__bff_token”) to verify that API requests originate from a genuine page visit. This cookie contains a signed timestamp — no personal data — and expires after one hour.
- Theme preference: A local-storage value records your light/dark/system theme choice. This stays on your device and is not sent to our servers.
- Swap session data: When you create a crypto-to-TAO swap, we store the exchange ID, source currency, destination address, and transaction hash in your browser's local storage so your swap can survive a page refresh. This data stays on your device and is cleared automatically when the swap completes or you start a new one. No private keys or wallet secrets are ever stored.
- Analytics: We use privacy-focused, cookieless analytics services to collect anonymous usage data such as page views, referrers, and custom events (e.g. sign-ups, feature usage). These services do not use cookies, do not track users across sites, and all data is aggregated so that individual visitors cannot be identified.
- Web Vitals: We collect anonymous performance metrics (page load time, interactivity, layout shifts) via our analytics service to improve site performance. These metrics are not linked to individual users.
- Error reports: When something goes wrong on the Site, our error tracking service automatically captures the error message, browser type, operating system, and the page URL where the error occurred. These reports may include your IP address. Error reports are used solely to diagnose and fix bugs.
- Performance traces: In production, our servers collect request timing traces (route, duration, status code) to monitor reliability. Traces are sent to our self-hosted observability platform and do not contain personal data.
- Server logs: Our servers record IP addresses, request timestamps, HTTP methods, and response status codes for security monitoring and rate limiting. Logs are retained for 30 days and then deleted.
3. How We Use Your Information
- Provide, maintain, and improve the explorer and platform features.
- Authenticate your identity and secure your account.
- Enforce rate limits and prevent abuse of our API and website.
- Send transactional emails (password resets, security alerts). We do not send marketing emails without your opt-in consent.
- Monitor site performance and reliability.
4. Information We Do Not Collect
- We do not use advertising-based analytics, tracking pixels, or cross-site tracking of any kind. Our self-hosted analytics (Umami) is cookieless and collects no personal data.
- We do not sell, rent, or trade your personal information to third parties.
- We do not collect or store private keys, seed phrases, or wallet passwords.
- We do not use advertising cookies or marketing cookies.
- We do not initiate blockchain transactions without your explicit approval. When using the auto-send swap feature, your wallet will always prompt you to review and approve the transaction before any funds are moved. On-chain transactions are public and permanent on their respective blockchains.
5. Cookies
We use the following cookies:
| Cookie | Purpose | Duration | Type |
|---|
| __bff_token | API request verification | 1 hour | Strictly necessary |
| session | Authentication session (when logged in) | Session / 30 days | Strictly necessary |
We do not use any optional or marketing cookies. Because all cookies are strictly necessary for site functionality, no cookie consent banner is required under most privacy regulations.
6. Data Security
- All traffic is encrypted in transit via TLS (HTTPS).
- Passwords are hashed using industry-standard algorithms before storage.
- API keys are stored as SHA-256 hashes — the plaintext is never persisted.
- Security cookies are HttpOnly, Secure, and SameSite=Strict.
- We enforce Content-Security-Policy headers to mitigate XSS attacks.
- Rate limiting protects against brute-force and denial-of-service attacks.
7. Data Retention
- Account data: Retained while your account is active. You may request deletion at any time.
- Server logs: Retained for 30 days, then automatically deleted.
- Blockchain data: Blockchain data displayed on the site is publicly available on the Bittensor network and is not subject to deletion.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request deletion of your account and associated data.
- Export your data in a portable format.
- Object to or restrict certain processing of your data.
To exercise any of these rights, contact us at the address below.
9. Third-Party Services
- SimpleSwap (cryptocurrency exchange): Our swap feature allows you to exchange cryptocurrencies for TAO through SimpleSwap, a third-party exchange service. When you initiate a swap, the following information is shared with SimpleSwap: the source and destination cryptocurrency tickers, the exchange amount, and your TAO wallet address. SimpleSwap processes this data under their own privacy policy. Bittensor.ai does not have access to the funds involved in any swap and does not store swap transaction details beyond what is necessary to display status updates during the exchange process.
- Reown / WalletConnect: Our swap feature uses Reown AppKit (formerly WalletConnect Web3Modal) to connect Ethereum-compatible wallets. When you connect a wallet, your public wallet address and chain ID are transmitted through Reown's relay servers to establish the connection. If you use the WalletConnect QR code flow, Reown's relay facilitates the pairing between your mobile wallet and our site. Reown may also load wallet icons and fonts from their CDN. Reown's processing is governed by their privacy policy. Bittensor.ai does not send your private keys, seed phrases, or wallet passwords to Reown or any third party. All transaction signing happens locally in your wallet software.
- Bittensor network: The site reads publicly available blockchain data from the Bittensor Finney network via RPC.
- Error tracking: We use an error tracking service to collect crash and error reports. This service may receive your IP address, browser type, and details about the error. Data is used solely for bug fixes and is not shared with third parties.
- Cloudflare: We may use Cloudflare Turnstile for bot protection on certain forms. Cloudflare's privacy policy applies to their processing.
- Google OAuth: If you choose to sign in with Google, Google's privacy policy governs their handling of your data during the sign-in flow.
- Umami Analytics: We self-host Umami on our own infrastructure. No data is sent to third parties. Umami is open-source and GDPR-compliant by design — it collects no personal data and uses no cookies.
10. Children's Privacy
Our services are not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
11. Changes to This Policy
We may update this policy from time to time. We will post the revised policy on this page with an updated “Last updated” date. Continued use of the site after changes constitutes acceptance of the revised policy.
12. Contact
For privacy-related questions or requests, contact us at [email protected].