Privacy policy

Effective 23 October 2026. Operated by Georgi Kalchev. Contact: abuse@402cron.com.

1. Who this covers

402cron has no accounts, no sign-up form and no card payments. A customer is a wallet that paid for credits. This page says what the service stores about that wallet and its tasks, for how long, and who else sees it. What we promise and bill for is in the terms.

2. What we store

Your wallet and your payments. The wallet address that paid, a SHA-256 hash of your management token (never the token itself), your credit balance, and one record per payment (payer address, pack, amount, state, reference). Settled payments and the credit ledger are our accounting and are kept indefinitely. Failed payment attempts are deleted after 30 days. Debit entries in the ledger are folded into one row per client per day after 90 days.
Your tasks. Name, destination URL, HTTP method, schedule, the request body and the headers you attached. The signing secret for your destination and your task headers are encrypted at rest; the request body is not, so do not put a credential in it. A deleted task stays recoverable for 30 days, then is deleted permanently; an expired task is deleted 30 days after it expires. A destination you never verified is deleted after 7 days.
A log of delivery attempts. Time, outcome, HTTP status of your server's reply, latency and an error code. We do not store the reply body. Kept 90 days. Per-destination daily counters are kept 90 days, per-client daily usage counters 400 days.
Payment-attempt counters. When someone attempts a payment we count it per hour against the network address it came from (an IPv4 address in full, an IPv6 address by its /64 prefix) and, where we can verify the signature ourselves, the paying wallet. Used only to rate-limit and block abuse; kept 7 days. The address your other API calls come from is not recorded.
One diagnostic note. Of the requests refused for a malformed token we keep only the latest one: its path and the first 64 characters of its User-Agent. A newer note replaces the older one.

3. Cookies and tracking

402cron sets no cookies. The public pages load the Cloudflare Web Analytics script, which measures page visits for us; we do not run any other analytics or advertising code.

4. Who else sees data

Cloudflare hosts the service (Workers, D1 database, Durable Objects) and delivers its traffic, so it handles every request and keeps its own operational logs under its own terms. Worker logging is enabled at a 10% sample.
Your destination. Each delivery is an HTTPS request from us to the URL you registered, carrying the body and headers you set and our signature. What that server does with it is outside our control.
Coinbase (CDP x402 facilitator). To verify and settle a payment we send it the payment authorization you signed (payer and receiving addresses, amount, signature).
The Base blockchain. Settled payments are public and permanent on-chain; we cannot delete them. We may also send the signed authorization to public Base RPC nodes (by default base-rpc.publicnode.com and base.drpc.org) to check it.
Email. The service sends operational alerts by email to the operator only. It sends no email to customers.

We do not sell any of this.

5. Deleting and asking

You can delete your tasks yourself through the API. For anything else we store about you, write to abuse@402cron.com. Data on a blockchain is outside our power to erase.

6. Changes

Changes are published on this page with a new effective date.