Privacy Policy

1. What we collect

• Account data — your email address and a hashed password (scrypt; we never store the password itself).
• Verification codes — one-time codes for sign-up and password reset, stored until used or expired.
• Submitted material — Solidity source you paste or upload, or the contract address and network you enter.
• Audit reports — the findings, risk score and metadata generated from your submission.
• Payment records — package purchased, amount, network, and the transaction hash you provide. We never see or hold your private keys, and we do not take custody of funds beyond the payment itself.
• Technical data — IP address and timestamps, used for rate limiting and abuse prevention.
• Support messages — anything you send through the contact form.

2. How we use it

To operate your account, run the analysis you request, deliver and store your reports, verify payments, send transactional email (verification codes, password resets, support replies), prevent abuse, and improve the Service. We do not sell your data, and we do not send marketing email.

3. Third parties who process data for us

• Anthropic (Claude) — when AI deep analysis is enabled, your contract source is sent for security review. If you prefer not to share source with an AI provider, run a static-only scan.
• Block explorers (Etherscan V2 and equivalents) — to fetch verified source for an address you submit, and to confirm a payment transaction. Only the address or transaction hash is sent.
• Hostinger — email delivery for verification codes and support replies.
• Our hosting provider — the server that runs the Service and stores its database.

4. Cookies and local storage

• al_session — an httpOnly, signed session cookie that keeps you signed in. Strictly necessary.
• Local storage — a sign-in hint and your chosen colour theme, kept in your browser only.

We do not use advertising or third-party analytics cookies.

5. Sharing your reports

A report is private to your account unless you create a share link. Anyone holding that link can view the report without signing in, so share it only with people you trust. You can revoke a link at any time, which cuts off access immediately.

The public scan history lists contract names and scores of past scans. Opening a report still requires ownership or a valid share link.

6. Retention

Account and report data is kept while your account is active so you can access past audits. Verification codes expire within minutes. Support messages are retained for as long as needed to handle your enquiry. Ask us to delete your account and we will remove your account data and reports.

7. Security

Passwords are hashed with scrypt and a per-user salt. Sessions use signed httpOnly cookies. Traffic is served over HTTPS, one-time codes are attempt-limited, and sensitive endpoints are rate limited. No system is perfectly secure, so please use a strong, unique password.

8. Your rights

You may request access to, correction of, or deletion of your personal data, and you can change your password at any time from your account page. To make a request, email admin@evmsmart.com.

9. Changes

We may update this policy; the revised date above shows when. Material changes will be reflected on this page.

10. Contact

Privacy questions: contact us or email admin@evmsmart.com.