s2ar

Privacy

s2ar sells evidence, not access. It keeps what settles a payment and what proves a record, and nothing that says who you are unless you sign in. This page was written from an inventory of what the running service stores, taken on 2026-10-11.

Who we are

s2ar is operated by Cody Lee Walker, in Canada, who is the person responsible for personal information here: cody@s2ar.dev.

If you call without a key

Some routes answer a few calls a day without a key. To count them we keep today's tally per route under a hash of your address salted for the day. The salt is replaced at midnight UTC and the tally with it, so the book never holds an address. Rate limits count per address in memory and are never written down.

If you pay with x402

Coinbase's facilitator verifies the payment authorization, and we settle it only once the answer exists, so a failed call's authorization is never used. The call log keeps a hash of the paying address salted for the day, the salt discarded at the UTC rollover, so the proceedings can count distinct payers without keeping who they are. The settlement itself is public on the Base chain, as every on-chain payment is. An open episode or audit job keeps what its settlement needs in its file until it ends; sealing it deletes that.

If you sign in

• Your email address, so we can send a sign-in link and code (through Resend; the link works once and expires in 15 minutes), with when the account was made, whether it is verified and when it last asked for a link.
• Your API key, stored as issued so each call can be checked against it. It is shown to you once; rotating it cancels the old key, which stays on file marked canceled.
• Your balance and how many top-ups it has had, and for each month your account's totals: paid calls and what they cost. Totals, not a list of calls.
• A signed session cookie, so the site remembers you for 30 days.

Card top-ups go through Stripe Checkout. Stripe keeps your card and its receipt and tells us the amount, the email the payment came from and the checkout's id, so the credit lands on the right account. We never see a card number. Payments through Stripe's Machine Payments Protocol are verified by Stripe.

If you register a watch

A seller may ask us to inspect its own x402 endpoint daily. We keep the resource and the account that registered it. Registering is consent to be named, on a page of its own, for that resource's results, passing or failing. The page counts views without keeping who looked. One call withdraws the watch and stops it that day; the records it issued stay verifiable.

What every call leaves

• One line in the call log: the time, the route, the price charged, the rail, whether the answer was delivered and how long it took, plus the salted payer hash on x402. No key, account, address or user agent.
• The proceedings: each day's counts from that log, signed and public at /.well-known/proceedings.json.
• Counters: refusals by kind, sign-up steps (sign-ups, keys minted, grants, first paid calls), request and byte totals, and the host's load, kept 34 days.
• The service's log line: the time, the method, the path and the status code, in the host's system journal. No query string, address, key or body. Lines written before 2026-10-11 also carried the query string, which for a GET call can hold the text or the URL it measured, and the proxy's own address (never yours). They age out as the journal rotates; it keeps the newest 4 GB of the host's logs.
• The proxy's error log: when a request fails at the proxy before it reaches the service (a body over the size limit, the service restarting), the proxy writes a line with that request's address, URI and headers, Authorization and cookies redacted, kept by the same rotation. It is the one place this service writes an address: an exception to clause 5 of the charter that we have not yet closed. The proxy keeps no other request log.

What a call's content leaves

• Images (certify_image, diff_images, extract_text) are read in memory and dropped when the answer goes out; none is written to disk. A record keeps their SHA-256 hashes and sizes, never pixels.
• Text (score_text, assert_output) is never stored whole. The record keeps its hash, the checks or the form you asked for, and the evidence a check reports: a quote it did not find, a word outside its dictionary, a rhyme pair.
• Code (the sym tools): public repositories only, cloned into a cache on our server and cloned fresh once a checkout is an hour old. Semantic search (sym_where) embeds your query and the code on machines we run, over our own private network; no third party sees either.
• Environments: an episode keeps its seed, its level and your actions; sealed, it holds nothing that says who played. Its record keeps the actions and every state digest.
• Audits: the job keeps your request (the rows and, for a grader audit, your grader's URL) so its result can be fetched again. The record keeps the findings, which can quote the probes and the rows' gold answers.
• URLs you name (an image, an endpoint to inspect, a grader) are fetched from our server, so the site sees our server, not you. An inspection record keeps what the endpoint declared about itself.

Records are evidence meant to be handed on. Anyone holding a record's sha256 can read it at /v1/verify/{sha}. A paid record never expires; a record issued to a keyless free sample expires 30 days after issue and is deleted. Put nothing in a check you would not hand on.

What we never do

Sell, rent or broker anything about you. Train a model on anything you send. Run analytics, trackers, ads or third-party scripts on s2ar.dev. Join a key to a wallet. Keep a per-payer history or flag a repeat buyer.

Who else handles it, and where

• Hivelocity hosts our server in Orangeburg, South Carolina: everything above is stored there, in the United States.
• Stripe processes card top-ups and Machine Payments Protocol payments.
• Coinbase, through its Developer Platform, verifies and settles x402 payments on Base.
• Resend sends the sign-in email.

Each sees only what its own step needs. Information stored in the United States is subject to its laws.

Your choices

Write to cody@s2ar.dev from your account's address to see what we hold about it, to correct it or to delete it. Deleting an account removes its email, key, balance and monthly totals. The records it paid for stay verifiable, and none of them carries your account. If we don't resolve a privacy complaint, you can take it to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Security

Every connection is TLS; s2ar.dev is HSTS-preloaded. The stores sit in a directory only the service's account can open, the day's salt is written owner-only, and the admin console answers only on our private network. The service is for developers and their agents and is not directed at children.

Changes

We post changes here with a new effective date. The charter and the Assay standard change only by a dated entry printed in the proceedings at least one edition before it takes effect (charter clause 4).