Privacy Notice.
Last updated October 3, 2026. This notice describes the scanner as currently built. Contact the bagrip project through @bagripxyz on X with privacy questions.
1. What you enter
You can submit a token contract address, Pons or DexScreener link, or ticker. The scanner does not ask you to create an account, connect a wallet, or provide a name or email address. Do not paste private keys, passwords, personal details or confidential links into the scan field.
2. How scan inputs are used
The server uses your input to find the relevant contract and retrieve token information. It sends the token address or ticker, as needed, to DexScreener, GoPlus, matching Pons and Flap token pages, and Robinhood Chain's public RPC. Your browser may contact those providers directly to complete a report when server requests are unavailable. Recent Scans displays saved results; opening the home page does not rescan those tokens. Direct providers can receive your IP address and standard browser request information. GMGN receives a browser request when its chart iframe loads or you open its link. Bubblemaps receives one when its map link is opened or when a configured partner iframe loads. Never submit wallet credentials or private keys.
3. Recent scans, link previews and browser history
The application caches full scan results in server memory for up to 60 seconds and resolved inputs for up to 30 seconds. Cloudflare KV stores public server scan summaries for up to seven days: contract address, token name, symbol and image when available, report status, coverage and calculated score, market-cap and liquidity snapshots, trading pair, and scan time. After a completed browser scan, the site can also save a separate share snapshot for up to 30 days. This sends compact token and report readings to bagrip so a link preview can show the score you saw. Its score is recalculated with the same formula; the supplied browser readings are not independently reverified by the server. It is labeled as a shared browser snapshot and does not overwrite the official public Recent Scans feed. A link containing the snapshot ID can be opened by anyone who receives it. Cards display their capture time and do not start a new scan. A social platform may cache the preview under its own policy. Browser-completed Recent Scans summaries are also stored locally in your browser for up to seven days. A hash of the request IP is used temporarily in server memory to rate-limit share creation; it is not stored in the snapshot. The feed and share snapshots do not contain a visitor name, connected wallet or IP address. A scanned contract may appear publicly, so do not scan an address you wish to keep private. The address, ticker and share ID may also appear in your page URL and browser history. Hosting infrastructure may separately retain routine access and security logs.
4. Cookies, analytics and external content
The current application code does not set cookies or run an analytics tracker. Token images use an allowlisted same-origin proxy, which retrieves them from their original source. If you follow an external project, social or source link, that destination may collect data under its own privacy policy.
5. Security and your choices
Use a current browser and check the destination of external links before visiting them. You can choose not to run a scan, clear your browser history, or avoid opening external links. No internet service can promise perfect security or uninterrupted availability.
6. Questions and updates
Contact @bagripxyz about this notice or a data request. Rights and response procedures depend on applicable law and the information actually held. If hosting, analytics or other data practices change, this notice should be updated before those changes go live.
7. Telegram report bot
When enabled, the Telegram bot uses your submitted contract, supported link or ticker to run the same server checks and reply in the chat where you requested the scan. Pending work temporarily stores sanitized input and Telegram chat, user, message and update identifiers; it does not store your profile name, phone number or unrelated chat messages. Completed jobs are deleted. Token-selection records expire after ten minutes; duplicate-delivery and rate-limit records expire within 24 hours of their last use. Cloudflare's database recovery can retain previous storage versions for 30 days. Telegram separately keeps messages under its own policy. A token scanned through the bot may appear in public Recent Scans and share previews under the retention described above; those public records contain no Telegram identifiers. The bot does not send broadcasts. Send only public token information, and never send wallet keys or passwords.