Privacy Policy

01Who we are

TraceByte is an Australia-focused AML/CTF compliance practitioner platform. It publishes regulatory analysis, provides a free on-chain address-risk screening tool, and offers paid advisory engagements. The service is operated as a sole practitioner under the name TraceByte; entity details will be updated when incorporated. For all enquiries: marshall.vip@gmail.com.

02What we collect

Free KYT address check

When you request a wallet screening, we process:

• The wallet address you submitted
• The chain you selected (ETH / BSC / TRON)
• Request metadata such as IP address, time and user-agent may be processed by Cloudflare for service operation and security. Retention depends on provider and account settings; we have not verified a universal 30-day deletion period.

The asynchronous screening service stores the submitted address, selected chain, analysis state and result in Cloudflare KV. Each job-state write sets a 10-minute expiry, refreshed as the job progresses. Derived exchange-deposit address labels may be cached for 30 days after a cache write. Public sanctions snapshots are cached separately for up to seven days. Queries may be sent to applicable upstream providers; their own retention terms apply. This is not a zero-storage service.

Contact form

The homepage contact form sends the name, email, organisation, topic and message you enter to our backend and, when configured, to Resend for email delivery. Contact links on the Advisory page can open your email client. We receive the information you choose to send; avoid including sensitive customer records. Delivery and mailbox retention are separate from the screening-job expiry described above.

Downloads (Data Hub)

Data Hub provides free downloadable files and links to external source datasets. No signup is required. External sites have their own privacy and access conditions.

03What we do not collect

• No accounts, no registration, no email capture for using the tool
• No third-party analytics scripts (Google Analytics, Mixpanel, Segment, Hotjar, etc.)
• No third-party advertising cookies or trackers
• The screening form does not request a customer name or identity document. Do not include customer-identifying information in wallet inputs.
• No commercial PEP database is hosted on this site (use of commercial PEP feeds in production should be licensed directly from Refinitiv, Dow Jones or similar)

04Cookies and local storage

The site uses browser localStorage for two non-essential purposes:

• aml_lang / tracebyte_lang — your selected interface language (zh / en), so the page remembers your choice on return
• tb_editorial — your selected layout (Editorial On/Off toggle), persisted across visits

These keys are scoped to your browser and never sent to any server. You can clear them at any time via your browser's site-data settings.

05Third parties

The site relies on the following infrastructure and data providers. Each handles a narrow function and has its own privacy policy:

• Cloudflare Pages, Functions and KV — hosting, request processing, temporary job storage and address-data caching. Cloudflare privacy policy
• On-chain and risk-data providers — depending on chain and availability, lookups may use Etherscan, Blockscout, Tronscan, GoPlus, Chainalysis screening, ScamSniffer and configured MistTrack services. A queried address or related counterparties may be disclosed to applicable providers.
• OFAC SDN list (US Treasury) — public sanctions data, used to flag addresses
• CoinGecko — public price feed for USD-equivalent calculations
• Google Fonts / jsDelivr CDN — font and icon hosting; subject to their own privacy terms

06Regulatory basis (Australia)

Public availability does not automatically exclude data from privacy protection. A wallet address may be personal information if an individual is identified or reasonably identifiable in the circumstances. See OAIC guidance.

Only submit information you are authorised to process. If you connect a wallet to a customer identity, consider the privacy obligations applying to your organisation and jurisdiction. This page does not determine a legal basis for every user or warrant compliance with the Privacy Act or GDPR.

07Your rights

No account is needed, but temporary analysis data, cached labels and correspondence may still exist. Rights are not automatically satisfied merely because there is no account. For access, correction, deletion or a privacy concern, contact marshall.vip@gmail.com; requests will be assessed against available records and applicable obligations.

• Request deletion of any email correspondence sent through the Advisory channel
• Lodge a privacy concern or complaint about how data was handled
• Request a copy of any data we have on file relating to a paid advisory engagement

Australian users may also escalate complaints to the Office of the Australian Information Commissioner (OAIC).

08Changes to this policy

Material changes are reflected in the date at the top of this page. This update corrects the earlier zero-storage description to reflect temporary KV jobs and address-label caching. The project Git repository is not published.