YOUR ERA. YOUR DISCLOSURE.

Privacy, plainly.

Bagged uses public Base activity to build a private, permission-protected report. Public blockchain records remain public; a report does not prove who owns an address.

Local fixture mode

This build does not send pasted addresses to an indexer. Live scans are disabled. The fictional demo creates a private browser-session report from a synthetic snapshot.

Session and account data

An essential HttpOnly session cookie authorizes private reports for 30 days. The server stores a hash of its secret. Optional accounts store passkey public credentials and hashed, single-use recovery codes. Bagged never asks for a wallet seed phrase or private key.

Retention and deletion

Anonymous sessions, unsaved reports, and share links expire after 30 days. Account-saved reports remain until deletion. Deleting a report revokes its shares. Production backups may retain deleted records until their configured expiry; the deployment runbook requires forwarding revocations after a restore. The operator must publish its actual backup window before public launch.

What leaves the app

Sharing is voluntary. Public snapshots contain only the selected disclosure. Addresses, amounts, token names, and receipts are off by default. Anyone with a share link can view that snapshot. Statistical combinations may identify a wallet. Revocation stops access through Bagged; it cannot recall downloaded files or third-party previews.

Optional ready email

If you request a completion notification, we store your email until delivery, terminal failure, report deletion, or expiry (at most seven days). Resend receives your email address and a private recap link to send that one message. The message does not include your wallet address or report contents. We remove the stored email and message payload after delivery or terminal failure. The link expires after seven days or when the report expires, whichever comes first, and opens the report in one browser session. No mailing-list signup is created.

Providers and telemetry

When live ingestion is validated, public addresses and period bounds will be sent server-side to the configured indexer and Base RPC. No external analytics collector or advertising cookie is configured. The app keeps internal daily event totals with coarse demo/live, chain, stage, and layout labels; these aggregates do not store session IDs, wallet addresses, amounts, or share secrets. Application logs exclude wallet addresses, financial bodies, transaction hints, and secret cookies.

Optional control check

A future enabled check uses a direct 0.10 USDC transfer from the wallet on Base to a unique, account-bound receiving address. It is not needed for a recap. Mainnet challenges are disabled in this build.