This is an interim policy. Kanshi Guardian is in beta, and this policy is subject to change before public launch. Our commitment is to adhere to what is written here for as long as it stands, and to announce any change at least 30 days before it takes effect — so you can decide whether the change is acceptable to you before it applies. Announcements appear in the app.
Kanshi Guardian is built so that we hold as little about you as possible.
You do not connect a wallet to use the security tools. We never ask for a seed phrase and we never hold your keys — we could not move your funds if we wanted to.
Your email address and any wallet address you give us are converted at account creation and never stored in readable form. Day to day we work from an account number.
We do not sell your information to anyone, for any purpose.
Two things worth knowing before you read on. Checking an address means sending it to third-party security services — that is how the checks work, and section 5 lists them. And links in the app take you to other companies' websites, where their rules apply and not ours. Section 9 covers that.
Kanshi Guardian Tech, LLC, a Wyoming limited liability company (filing ID 2026-002067139), operating kanshiguardian.com.
Registered address: 30 N Gould St, Suite 66234, Sheridan, Wyoming 82801
Contact for anything in this policy: support@kanshiguardian.com
Both are put through an HMAC — a keyed one-way function — when your account is created. We store the result, never the original. Because the key is held server-side and secret, the stored value cannot be worked backwards into your email or your wallet address, by us or by anyone who obtains the stored data.
Reports and scan records are stored against your account number. Not against your name, your email or your wallet, because we hold no readable copy of any of them.
Kanshi does not use them. You sign in with a one-time code sent to your email, with biometrics, or with an authenticator app — whichever you set up.
We send email for one purpose only: the one-time code that signs you in.
When you sign in, you type your email address. We run it through the HMAC to find your account, and we send the code to the address you just typed. That address exists in memory for the length of that request and is then gone. We never write it down.
This is also why we cannot email you about anything else. Announcements, product news and anything else we need to tell you appear in the app instead.
The one place your email does exist in readable form. We deliver the code through Resend, our email provider. Resend receives your address in plaintext in order to send to it, and keeps delivery logs of its own under restricted access, governed by its policy and its retention rather than ours.
So the accurate statement is this: Kanshi does not store your email address, and Resend holds it in its delivery logs. We would rather say that than let you infer the address exists nowhere at all.
To receive a beta reward you must have a wallet connected to your account. That connection is what keeps a reward attached to you: we hold the HMAC of the address, verify a connecting wallet against it, and pay out to the wallet you connect.
It is also what stops the same person being rewarded twice. Because the stored value derives from the wallet rather than from the account, it survives deleting and re-registering an account — which is the point.
If you never connect a wallet you can still use Kanshi normally. You simply cannot be paid for feedback, because there would be nothing to pay to and no way to tell one contributor from another.
We cannot recover your wallet for you. We never retained it. All we hold is your account number and a value we cannot reverse.
Your IP address is the one other thing that reaches us. It is used in exactly two ways, and nothing else is collected alongside it.
To be unmistakable about the second one: that is our tax obligation, not yours. It tells us where we owe tax on a sale. We do not report you, your account, your transactions or your holdings to any tax authority, and we are not in a position to — we hold no readable copy of your name, your email or your wallet, so there would be nothing to report even if we were asked.
We think the trade is worth making, but it is a trade and you should know both halves.
What you get. A breach of Kanshi does not expose your email or your wallet address, because neither is there to take. We cannot be compelled to hand over what we do not hold, we cannot sell it, and we cannot leak it by accident.
What it costs you. If you lose access to every sign-in method you registered — your email, your biometric device and your authenticator — we may have no way to verify that you are who you say you are, and your account may not be recoverable. We hold nothing that could prove it on your behalf.
Please register more than one sign-in method. This is the single most useful thing you can do to protect your access.
We do not sell your information. We do not share it for advertising. There are no advertising or tracking pixels on the site.
This is the section most privacy policies bury, so we are putting it near the front.
To tell you anything useful about an address, we have to ask services that hold threat data about it. When you submit something for checking, it is sent to the relevant services below. Each has its own privacy policy and its own retention practices, which we do not control.
| Service | What it receives | What it is for |
|---|---|---|
| Etherscan and equivalent explorers | The address or contract | Transaction history, contract verification status |
| GoPlus Security | The contract address | Contract behaviour and token risk analysis |
| Chainabuse | The address | Community-submitted abuse reports |
| De.Fi | The contract address | Contract risk data |
| Alchemy, PublicNode | The address | Chain data and vault webhook alerts |
| Helius, RugCheck | The Solana address | Solana chain data and token risk |
| TronGrid, XRP Ledger | The address | Chain data |
| OpenChain | The function signature | Signature decoding reference |
| ScamSniffer, CryptoScamDB | The address or domain | Known-scam reporting |
| Google Safe Browsing, PhishTank, OpenPhish, URLScan.io | The URL | Phishing and malicious-site checks |
| Cloudflare DNS, Google Public DNS | The domain | Mail record checks |
| Anthropic (Claude) | The text or contract data being analysed | AI explanation of what a contract or message does |
Three things follow that we would rather say plainly.
If you scan your own wallet address, you are revealing that address to those services. Unavoidable for the check to work, but it is your decision and you should make it knowingly.
What those services receive is the address, not you. Your identity is not attached to the lookup, because we hold no readable identity to attach.
Our own mixer and sanctions blocklist is checked without leaving Kanshi. Nothing is sent anywhere for that match.
Some tools — the Contract Simulator, the Scam Text Scanner, the AI advisor — send the content you submit to Anthropic's Claude API for analysis. That means the contract data or message text you paste goes to a third-party AI provider, under Anthropic's privacy policy rather than ours.
Kanshi is built with the Claude API and is not affiliated with or endorsed by Anthropic.
AI output is probabilistic. It can be wrong. Treat it as one input to your own judgement and verify anything that matters at the sources we link.
Security tools: no wallet connection, ever. Nothing to disclose.
Approval management and Guardian Vault: these need to read your wallet to work, so you connect one. We receive your public address. We never receive your keys, and every transaction is signed in your own wallet, by you.
Beta feedback rewards: a connected wallet is required to receive a reward, as described in section 2. This is the only reason a wallet is involved outside the features above.
Hosted on Vercel. Account and usage data in Upstash Redis.
| What | Held for |
|---|---|
| The email address you type at sign-in | Not retained — it exists only for the request that sends your code |
| Your IP address, for our tax reporting | Until 30 March following the end of the calendar year it was collected in — roughly 3 to 15 months, depending on when in the year |
| Country-level analytics (Vercel) | 12 months |
| Reports and incident logs | 36 months, rolling |
| Account record, HMAC values, sign-in credentials | Until you delete your account |
Why 30 March. Sales tax may be owed to a jurisdiction for a full calendar year, so we hold that year's records until the following 30 March. That leaves three months after year end to complete our filings accurately, after which the whole prior year is purged. An address collected in December is held about three months; one collected in January, about fifteen.
On the 36 months. Retaining reports and incident logs is what lets us investigate an incident and help a user who reports one. We keep to the rolling 36-month deletion unless a court order or a lawful preservation request requires otherwise. Where we are legally permitted to tell you that your data has been preserved or disclosed, we will.
Kanshi links out to third-party sources on purpose. Pointing you at the evidence, so you can check our reading against theirs, is part of what the product is for.
Once you follow one of those links you are on someone else's website, governed by their privacy policy and their terms, not ours. We do not control what they collect, what they do with it, how long they keep it, or whether the page is even still there. We take no responsibility and accept no liability for anything outside Kanshi.
The same applies to any wallet, exchange, block explorer or other service you reach from Kanshi.
Beyond the security services in section 5 and the infrastructure providers in section 8, we do not share your data.
We do not sell your information. Not to advertisers, not to data brokers, not to anyone, and not in any form — including hashed or aggregated form.
Much of what a buyer would want, we could not supply even if we wanted to, because we do not hold it in readable form.
We will disclose data if legally compelled to, and will tell you where we are legally permitted to do so.
If you are in a jurisdiction that grants you additional rights over your personal data, contact us at support@kanshiguardian.com and we will honour them to the extent they apply.
Kanshi is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.
This is an interim policy and will change before public launch.
Any change is announced in the app at least 30 days before it takes effect, and the date at the top is updated. Announcements appear in the app rather than your inbox, because we only ever email you a sign-in code.
The 30 days are yours. If a change does not suit you, that is your window to export what you want and close your account before it applies.
support@kanshiguardian.com
Kanshi Guardian Tech, LLC 30 N Gould St, Suite 66234 Sheridan, Wyoming 82801