Privacy Policy

Three of those are free text you type: username, display name and memo. Treat them as public writing. Do not put a real name, an email, a phone number or anything sensitive in a memo.

ICPay's user directory is readable without signing in. Anyone can call the canister to search usernames or resolve a username to a principal — that is what makes paying a handle work at all, and it also means your handle, display name and principal are discoverable by strangers.

Balances are not listed in that directory, but ICP balances are readable from the public ledger by anyone who knows an address. This is a property of the blockchain, not a choice ICPay made.

There is no delete button, and building one is not possible. The canister exposes no endpoint that erases a profile, a username or a transaction, and blockchain records are immutable by design. If a privacy law grants you a right to erasure, ICPay cannot honour it for on-chain data.

Usernames in particular are permanent. A claimed handle maps to your principal forever, and buying a new one keeps the old one pointing at you as well. Stopping use of ICPay does not remove anything already written.

The one thing you can change is your display name — but the previous value remains in the chain's history.

• Your Internet Identity session, kept in IndexedDB by the Internet Identity library. This is what keeps you signed in. Signing out clears it.
• A theme preference in localStorage, so the app does not flash the wrong colour scheme on load.
• A small cache of account statistics under keys beginning icpay:stats:, so a profile shows real numbers instead of a skeleton while it reloads.

Clearing your browser storage removes all of it. None of it is sent anywhere.

ICPay counts page views through Vercel Analytics. It records the page, the referrer, the country and the device type, and it sets no cookies and no persistent identifier — a visit cannot be linked to your last one, so no profile of your behaviour is built. It never sees your principal, your username or any amount.

There are no advertising pixels, no session recording and no other third-party trackers.

• Internet Identity (id.ai) — handles sign-in. It sees that you authenticated to ICPay. It is operated by the DFINITY Foundation under its own privacy terms.
• Internet Computer (icp0.io) — the network the canister runs on. Every action you take reaches it, along with your IP address, as with any website.
• CoinGecko — queried for the ICP price shown in the app. The request contains no identifier, no principal and no balance; it asks only what ICP is worth. Your IP address is visible to them, as with any request.
• Vercel Analytics — receives one anonymous event per page view, as described above.

The app also links out to the ICP Dashboard so you can inspect a transaction. Following such a link is a normal visit to their site.

The ICPay backend is a canister on the Internet Computer, and this interface is published to an asset canister too — so it can be loaded entirely from the chain. Most visitors, however, reach a copy hosted on Vercel, which sees your IP address and browser details when the page loads. The Transparency page lists both addresses.

ICPay is not directed at anyone under 18 and no account should be created by one.

Privacy questions and security reports go to GitHub issues. Note that an issue is public.