Privacy Policy

This policy covers the Arcscan website, and the REST API when it opens to the public. It does not cover the Arc blockchain itself — a public ledger that anyone can read and that no operator controls — nor any third-party site you reach from a link here.

Server access logs. Every request to the site is written to a web server log containing: your IP address, the hostname requested, the HTTP method and path, the response status and size, how long the request took, the referring URL if your browser sent one, and your user-agent string. Not every request is written down: routine responses are sampled one line in ten, refused ones one in a hundred. These are ordinary web server logs; nothing in them is specific to a blockchain.

Rate-limiting state. The API keeps a per-IP request budget in memory to stop a single client from denying the service to everyone else. It is not written to disk and is discarded a few minutes after your last request.

Application error logs. When a request fails or takes more than two seconds, the API records the method, path, status code, duration and an opaque request identifier. It does not record your IP address.

Nothing else. There is no account, no email capture, no wallet connection, no session identifier and no advertising or cross-site tracking technology on this site. We do not attempt to identify you, and we do not build a profile of what you looked at.

Access logs keep a free, unauthenticated service usable: we use them to block abuse, diagnose outages and read the load. That is all they are for. Where a lawful basis is required, it is our legitimate interest in running and securing the service.

We do not sell, rent or share logs with anyone for marketing, and we do not use them for advertising or profiling.

Access logs live in a 1 GB ring on the server that answers your request. Each new line pushes the oldest one out. Nothing is copied anywhere else — no archive, no backup, no off-site log service — so once a line is pushed out it is gone for us too.

That is a limit on size, not on time, so how far back the log reaches depends on traffic: weeks while the site is quiet, hours during a flood. We publish the rule rather than a number of days because the rule is what the software enforces.

Rate-limiting state never reaches a disk at all. It sits in memory and is dropped a few minutes after your last request.

Arcscan sets no cookies. The one thing stored in your browser is your light/dark theme choice, saved in localStorage under the key arcscan.theme. It is read by your browser to avoid a flash of the wrong theme on page load, is never transmitted to the server, and is cleared whenever you clear site data. Nothing on this site requires it.

Analytics is first-party and stays on this server. Page views and interactions are counted by software running on the same machine as the site, posting to this site's own address. No third-party script is loaded, no request is made to any other host, and no data ever leaves our own machines. Google Analytics, Plausible Cloud, Segment and third-party advertising trackers are deliberately not used.

Nothing here stores an identifier on your device or hands data to a third-party processor, so there is no consent banner to show. Its absence is the design, not an oversight.

What is counted, and what is thrown away. The page you are on is recorded as a route pattern — an address page is recorded as the characters [addr], never the address itself — so the addresses, transactions and tokens you look at are not stored anywhere. Your IP address is never written down: it is mixed with a random secret that is destroyed and regenerated every midnight UTC, which means that after one day nobody, us included, can work backwards from an IP address to the previous day's records. Anything you type into the search box is classified by its shape and then discarded; if the shape looks like a seed phrase or a private key, nothing at all is recorded. If your browser sends Do Not Track or Global Privacy Control, nothing is counted.

This is the clause that makes a block explorer different from an ordinary website.

Everything on the pages of this site — addresses, balances, transactions, contract code, token transfers — is public data published by the Arc blockchain itself. It is replicated by everyone running a node, and on Arc it is final and immutable the moment it is committed. Arcscan does not own it, cannot alter it and cannot erase it. Neither can we, the validators, or anyone else.

A request to remove an address or transaction from the chain is therefore impossible for us to satisfy, and any site that promises otherwise is not telling you the truth. We can correct how Arcscan displays something — a wrong label, a decoding bug, a mis-scaled amount — and we want to hear about those: contact routes are here.

A blockchain address is a pseudonymous identifier, not a name. We do not link addresses to people, and we do not hold any information that would let us. If you have published a connection between an address and your identity elsewhere, that connection exists in that other place, not here.

Where you live may give you rights of access, correction, erasure, restriction or objection over personal data. On Arcscan they can only reach the server logs — the one category of data we hold that could relate to you as a person.

To exercise them, write to [email protected]. Tell us the IP address and roughly when: nothing in a log is indexed by anything that identifies you, so without those two there is nothing to look up. Anything the ring in §4 has already pushed out is gone.

Public requests reach this site through Cloudflare, which terminates TLS and passes them to our server. Cloudflare sees what routing a request requires — your IP address, the hostname, the path. Fonts come from this site’s own address, so loading a page contacts no font service.

Analytics runs on the same machine as the site. The counter, its storage and the daily salt all sit on our own server, and no measurement leaves it.

Arcscan is a technical reference tool and is not directed at children. It collects nothing that identifies anyone, of any age.

When this policy changes, the date at the top changes with it. This page describes what the software does, so a release that changes logging or storage changes this page in the same release.

Privacy enquiries: [email protected]. Everything else: Contact Us. The terms of service govern use of the site.