There is no account here. We never ask for your name, your email address, or a payment card, and we never learn them. This policy is about the little we do hold, and when it goes.
One thing is outside it entirely, and no policy of ours can change it: your message, once broadcast, is on the Bitcoin blockchain permanently and publicly. We cannot delete it there. Everything below is about our own copies.
Erased 30 days after your broadcast finishes — confirmed, abandoned, or expired unpaid.
The blockchain is the copy of record. Once your transaction is on it, our copy buys you nothing and is one more place your words can be read from.
Where it lives: opreturn.db · opreturn_invoices.message; opreturn.db · opreturn_invoices.message_hex.
Erased 30 days after your broadcast finishes — confirmed, abandoned, or expired unpaid.
The queue is how the message reaches the machine that signs the transaction. After that it is a second copy of something already erased elsewhere.
Where it lives: opreturn_jobs.jsonl · message; opreturn_jobs.jsonl · message_hex.
Erased 30 days after your broadcast finishes — confirmed, abandoned, or expired unpaid.
A signed transaction holds the message in full, so retaining it retains the message. The transaction id, the fee, and the block are kept; the bytes are not.
Where it lives: opreturn_signer.db · attempts.raw_hex; opreturn_signer.db · jobs.message_hex.
Erased 30 days after the refusal.
A refusal we cannot read is a refusal nobody can review or appeal, so we keep the text briefly. But a message refused for containing a card number or a government identification number is the single most sensitive thing we ever hold, and holding it indefinitely to protect you from publishing it is its own harm. The record that a refusal happened — when, which rule, and a one-way hash of the text — is kept, so we can always show that a screen existed and ran.
Where it lives: opreturn_refusals.jsonl · text.
Erased 90 days after the refund is settled, or the broadcast ends with no refund owed.
This is the only thing we ever hold that could be traced back to a person — a custodial Lightning address belongs to a provider who knows who you are. We keep it long enough to prove we paid you what we owed, and then it goes.
Minimum retention required by law: NY Tax Law §1135(g) — business records preserved three years.
Where it lives: opreturn.db · opreturn_invoices.refund_to; opreturn.db · opreturn_invoices.refund_claim_bolt11.
Kept.
These are accounting records and they contain no message text and nothing that identifies you. We are required to keep them for at least three years, and the record of which terms you agreed to is worth nothing if it outlives neither the sale nor a dispute.
Minimum retention required by law: NY Tax Law §1135(g) — business records preserved three years.
Where it lives: opreturn.db · opreturn_invoices (money and status columns); opreturn_receipts.jsonl.
Kept.
This is the evidence that the geographic control we published actually ran, which is the only thing that distinguishes a real sanctions control from a paragraph. It holds no message, no payment and no full address — the last octet of the network address is discarded before the row is written, so it records a refusal without building an identity for someone we deliberately never identified. Kept INDEFINITELY, which is longer than the ten years below and deliberately so: the ten-year figure is a MINIMUM we may not delete sooner than, not a deadline we must delete at, and what is left after ten years — a country code and the first three octets of a network address — identifies nobody, so there is no privacy interest that expiring it would serve.
Minimum retention required by law: 31 C.F.R. §501.601 — sanctions compliance records kept ten years.
Where it lives: opreturn_sanctions_blocks.jsonl.
Kept.
These are readings of the public blockchain, not a private copy. Anyone with a Bitcoin node has the same data, and deleting our reading of it would remove nothing from the world.
Where it lives: opreturn_overlay.jsonl; opreturn_messages.jsonl.
Kept.
Rotated and deleted on a schedule set in /etc/logrotate.d/bitcoinradar: fourteen days for ordinary operational logs, ninety days for payment-provider notifications, and one year for consent and administrative-access records, which are evidence we may have to produce rather than telemetry. Message text is stripped from these logs before they are written.
Where it lives: nginx access.log / error.log; pro_gating.log; apple_webhooks.log; consent.log; admin-access.log.
If we receive a preservation request, a subpoena, a court order, or any other valid legal process concerning a particular broadcast, we place that broadcast under a hold and the schedule above stops for it until the hold is lifted. We do this because we are required to: a preservation request under 18 U.S.C. §2703(f) obliges us to keep the records for ninety days and, if renewed, one hundred and eighty; and under 18 U.S.C. §2258A(h)(1), a report of child sexual abuse material is itself a request to preserve for one year.
A hold suspends deletion. It does not create new collection: nothing is recorded because of a hold that would not have been recorded anyway.
Where to send a preservation request, what we hold, and what we cannot produce however the request is worded, are set out in our Law Enforcement Guidelines at /legal.
Write to support@bitcoinradar.app. My Virtual Shop LLC, 34 Ogden Ave, Cortlandt Manor, NY 10567. This policy is part of the Broadcast Terms.
Version 6fbaf244fb82944c0174e63289bd5da61ca93a4595a252261915973c1f682271
This is the SHA-256 of the text of this policy. The same rules drive the program
that performs the deletions.