Privacy policy

What this policy covers

This policy covers this website, usebobot.app, the boBot app on it (/app, its plans, the token pages, Life files, Recent checks and Discover), and the boBot API that the app talks to.

boBot has no accounts. Nothing in it asks who you are, and nothing in it needs to know.

What boBot reads

boBot reads only what you give it: the token address, link, website or X profile you paste into the app, and the token pages you open.

To find the token behind a link, the boBot API opens that link itself: it reads the website you pasted (and a few of its own scripts), or the X profile or post, through public services. Your browser does not visit those pages for this.

• boBot cannot see your other tabs, your browsing history or the sites you visit.
• It does not read your passwords or anything on your device.
• It only looks for token addresses in what it reads.

Connecting a wallet

Connecting a Solana wallet is optional. It gives you more queries every day, and holding $BOBOT gives you more of every analysis. Later, rewards will go to the connected wallet.

When you connect, your wallet shares its public address with the app and signs one text message that names this site and says it costs nothing. The boBot API checks the signature and opens a session for that wallet for seven days.

• Only the public address and that one signature are used. Your private key and seed phrase never leave your wallet.
• No transaction is sent, nothing is approved, and nothing is spent.
• The API keeps the wallet’s public address with when it first and last signed in.
• To show your balances and plan, the API reads the wallet’s public SOL and $BOBOT balances from a Solana node, and the token’s price. The answer is kept a few minutes and is not stored.
• Disconnecting ends the session on this site.

Daily queries

Opening a token’s analysis is one query; opening the same token again within 24 hours is free. Each plan has a number of queries every 24 hours.

To count them, the API keeps, for each token you open, a salted hash of your device cookie, of your wallet’s public address when one is connected, and, on the free plans or without a device cookie, of your IP network. A hash cannot be turned back into the IP address, the device ID or the wallet. These records are deleted after two days.

What is sent, and where

This is everything the app sends from your browser, and why.

• boBot API (usebobot.app)

  What you paste into the search box: a token address, a link, a website address or an X handle

  To find the tokens it points at.

• Your wallet (in your browser)

  A request to connect, and the sign-in message to sign

  Only if you choose to connect a wallet.

• boBot API

  Your wallet’s public address, the signed message and its signature

  To sign you in.

• This website’s server

  The token page or the list you open (Discover, Life files), and the two cookies

  To show the token’s data and the list, and to count your queries with the boBot API.

• boBot API

  That you opened a token’s page: the token address, the word “app” and your browser ID

  To count how often tokens are checked and to fill Discover.

• This website’s server, then the boBot API

  Sayings you choose to share about a token, with your browser ID and your wallet session

  To check that a wallet is connected, then to show the saying to everyone who checks that token. The wallet is not kept with the saying.

• boBot API

  A saying you report, by its number

  To hide sayings that several people report.

• boBot API

  The addresses of the tokens in your recent checks

  To show their latest price on the Recent checks page.

• boBot API

  Requests for the latest sayings, and for the details of the token you are writing about

  To show the sayings chat beside every page of the app.

• Where a token’s logo or an X profile picture is hosted

  A request for the image, without telling it which page you were on

  To show the picture.

Like any website, these see your IP address when your browser contacts them. The image hosts handle it under their own privacy policies.

Your browser ID

The first time you open a token’s page or share a saying, the app makes a random browser ID and keeps it in your browser. It is not made from anything about you, your browser or your device, and it is not linked to your name or email.

It goes with what your browser shares with the boBot API, to limit abuse and to group what one browser shares. Records of checked tokens keep only a scrambled (hashed) form of it. Sayings keep it so that abuse can be removed, and next to a saying other people only ever see a short scrambled code, never the ID itself.

Clearing this site’s data in your browser deletes the ID. The app then makes a new one.

What the boBot API keeps

The boBot API keeps as little as it can, and nothing that says who you are.

• Token data and findings: public information about tokens, not about you.
• Connected wallets: the public address, and when it first and last signed in.
• Query counts: the hashed device, wallet and IP network, the token and the time. Deleted after two days.
• Checked tokens: the token, “app”, the hashed browser ID and the time. Deleted after 30 days.
• Reports on sayings: the saying and a salted hash of the reporter’s IP network, so one network counts once. A saying reported from three networks is hidden.
• Wallet facts: for wallets that appear in an analysis (creators, top holders, first buyers), their public label, such as an exchange, and who first funded them, when and with how much. This is public chain data, kept so it is not looked up twice.
• Sayings: the text, the browser ID, the time and a salted hash of the wallet that shared it (never its address), so a wallet that breaks the rules can be blocked. Sayings are public and stay up so others can read them. Please never write personal information in one; you can ask for a saying to be removed.
• Searches: the answer for a pasted link is kept in memory for a few minutes, so the next person who pastes it gets it faster. It is not saved in the database.
• Server logs: your IP address, the address that was asked for (which can contain a token address or the page of a list) and the time. They are used to keep the service running, fix errors and stop abuse, and are kept only as long as that needs.
• Rate limits use your IP address (or your IPv6 network) in memory only.
• No names, emails, phone numbers, browser details or locations are stored.

To find tokens and build its findings, the boBot API asks other services: blockchain nodes (Helius, Alchemy and public Solana and EVM nodes), the Helius Wallet API (who a wallet is and who funded it), DEX Screener, GeckoTerminal, CoinGecko, Jupiter, RugCheck, pump.fun, X data services, public Telegram pages, domain records (RDAP, WHOIS and DNS), a token’s metadata file (often on IPFS), and the websites that are pasted or that a token links to. It sends them only token and wallet addresses, links, domains and X handles. It never sends them your IP address, your browser ID or your device.

Cookies and what stays in your browser

The app uses two cookies, both needed for it to work and neither for tracking. Page scripts cannot read them; only this site’s server does. A third one is set only if you pick a language.

• bobot_device: a random ID for this browser, set when you first open the app (the site’s other pages set no cookie), kept for a year, used to count queries per device.
• bobot_session: your wallet session after you connect, kept for seven days or until you disconnect.
• bobot_lang: only when you pick a language at the bottom of a page, so the site opens in it next time; kept for a year. Without it, the site follows your browser’s language.
• In your browser’s storage: your recent checks (the last 12 tokens you opened, with their name, symbol, chain and logo address, and when you opened them), your light or dark theme, the size you chose for the chat, your browser ID, and for the open tab, which tokens it already counted.

You can clear your recent checks in the app at any time. Clearing this site’s cookies and data in your browser deletes all of it.

No trackers

usebobot.app has no analytics, no ads and no trackers.

• Fonts are served from this site. Site icons and chain logos are passed through this site too, so your browser does not contact their hosts.
• Like any website, its hosting keeps short-lived logs, which include IP addresses, to keep it running.

What boBot never does

• It never sells or shares your data with advertisers or data brokers.
• It never tracks the websites you visit; it only sees what you paste into it.
• It never asks for, reads or stores your private keys or seed phrases.
• It never sends a transaction, never asks for an approval, and never trades for you.

Your choices

• Use the app without a wallet: nothing about you is needed to check a token.
• Disconnect your wallet from the app’s menu at any time.
• Clear your recent checks in the app.
• Clear this site’s cookies and data in your browser to delete everything the app stored there.
• Write to us to ask a question or to have a saying removed.

Security, children and advice

The app talks to its services over encrypted connections, keeps the wallet session in a cookie page scripts cannot read, and stops sayings that look like a private key or a seed phrase before they leave your browser. No system is perfectly safe, so keep anything valuable in a wallet you control.

boBot is a tool for crypto traders and is not meant for children.

boBot shares findings about tokens, not financial advice. It can be wrong. Always do your own research.

Changes to this policy

When boBot starts reading or sending something new, this page changes first and shows a new date at the top.