Privacy Policy
Last updated: 26 August 2026
The short version. The scanner needs no account and keeps nothing. Addresses you paste are looked up from your own browser and are never sent to us. If you create an account, we hold your email address and — for Pro — the list of addresses you asked us to watch. We do not sell or share any of it.
1. Who we are
ShorWatch is operated by Gerard Sala, Spain. For anything in this policy, write to hello@shorwatch.com.
2. The free scanner collects nothing
When you paste a Bitcoin address — or an extended public key — into the scanner, the analysis runs inside your browser. Your browser queries the public mempool.space API directly for the same data anyone can look up about any address. Nothing reaches a ShorWatch server, because for the scanner there is no ShorWatch server: the page is a static file.
Extended public keys are used to derive addresses locally and are never transmitted. We have no way to see which addresses you scanned.
Note that mempool.space is an independent third party and will see the requests your browser makes to it, including your IP address, as it would for any website you visit.
3. What we hold if you create an account
| Data | Why | Kept for |
|---|---|---|
| Email address | To identify your account and send the alerts you asked for | Until you delete the account |
| Subscription status | To know whether Pro features are active | Until you delete the account |
| Watched addresses (Pro only) | So we can monitor them and alert you | Until you remove them or delete the account |
| Alert history (Pro only) | So you can see what we already told you | Until you delete the account |
Signing in with Google gives us your email address, name and profile picture. We use the email address; we do not receive or request access to anything else in your Google account.
4. What we deliberately do not do
- No analytics, no tracking scripts, no advertising cookies, no third-party pixels.
- No selling, renting or sharing of personal data. Ever.
- No logging of scans. We keep no record of what you looked up.
- No access to private keys. Nothing in ShorWatch can sign a transaction or move funds, by design.
5. Who processes data on our behalf
- Supabase — accounts and database, hosted in the EU.
- Vercel — serves the website.
- Cloudflare — DNS and email forwarding for our contact address.
- Lemon Squeezy — payments. They are the merchant of record and handle billing details; we never see your card.
6. Your rights
Under the GDPR you may request access to your data, correction, deletion, a portable copy, or object to processing. Write to hello@shorwatch.com and we will act within 30 days. You may also complain to the Spanish data protection authority (AEPD).
Deleting your account removes your profile, watched addresses and alert history.
7. Cookies
We use no cookies for analytics or advertising. Your browser stores your login session locally so you stay signed in; clearing site data signs you out.
8. Changes
If this policy changes materially we will say so on this page and, for account holders, by email.