Nothing on you.
Facts on apps.

What we keep about visitors

• No cookies, no tracking. Pages load only our own files. We don't use analytics, ad or social scripts.
• Your free-runs counter. To give everyone a fair daily allowance we store a salted hash of your IP address with the number of runs that day. The address itself is never stored and the hash can't be turned back into it.
• Server logs. Our host keeps short-lived technical request logs, as every web host does.

What we publish

• Every blueprint is public: the address or repository you submitted, what our sandbox recorded and the plain-words explanation. Don't submit private links.
• We never publish a site's or app's code: evidence is a file and line (or a byte offset) plus a short identifier. We never store cookie or storage values, and links in evidence never include query strings.
• Our reports describe what code and traffic show, not anyone's intent, and they are not financial advice.

What we fetch

• When you submit a website, our server opens it once in a sandboxed browser, without logging in or accepting cookie banners.
• When you submit an app, we only accept public GitHub repositories with an open-source licence. We download its source and its official release and read them without ever running them.
• When you submit a contract, we only read public chain data.

Corrections and removal

If a blueprint is about your site, app or contract and something is wrong, use the contact address shown on this page once it is published. We correct factual errors and handle removal requests promptly.

Trenchcoat runs REA (Reverse Engineer Anything, open source, MIT). Not affiliated with REA.