Cairn (“we”, “us”) is operated by Jumpbox, a sole proprietorship based in Idaho, USA. This page explains what data the service collects, why, and what your rights are. Plain language; please email us if anything is unclear.
1. What we collect
1.1 Public on-chain and Farcaster data (re-indexed)
Cairn re-indexes publicly available data from EVM blockchains (ERC-8004 NFT registrations on 7 chains) and from Farcaster Hubs (FID metadata, verified addresses, profile fields like handle, display name, bio, profile picture URL). We did not originate this data; we organize and present it. If you registered an ERC-8004 token or signed a Farcaster verification, that record is already public on-chain or on the Farcaster network.
1.2 Settlement records (re-derived)
Cairn derives x402 USDC settlement counts and history by scanning public on-chain transfers where the broadcasting wallet (tx.from) matches a known facilitator allowlist (Coinbase CDP, PayAI, Corbits, Thirdweb, x402rs as of May 2026). Both the recipient address and the source data are public.
1.3 Claim submissions (user-initiated)
When you claim an agent through POST /api/claim, we store the cryptographic proof you submit (signature, nonce, claim method, snapshot of verified addresses at claim time). This is necessary to demonstrate the claim's authenticity and to prevent replay attacks. We do not store the private key material that produced the signature; only the signature itself.
1.4 IP addresses (rate limiting only)
Cairn uses Cloudflare's native rate-limiting binding to enforce free-tier limits (60 requests/minute, 2,000 requests/day per IP). The CF-Connecting-IP header is hashed by Cloudflare and used as a counter key. We do not log full IPs to our database, do not retain them beyond Cloudflare's rate-limit window, and do not associate them with any user account (we have no accounts).
1.5 What we do NOT collect
- No cookies. No browser fingerprinting. No localStorage tracking IDs.
- No analytics SDKs (no Google Analytics, no Plausible, no Vercel Analytics, nothing).
- No advertising networks. No tracking pixels.
- No behavioral profiling, dwell-time tracking, or cross-app fingerprinting.
- No third-party trackers loaded into the page at all.
2. How we use the data
We use re-indexed on-chain and Farcaster data to power the public directory, search, and JSON/Atom feeds. We use claim submissions to verify and persist agent ownership records. We use IP-based rate limiting solely to prevent abuse and protect service availability. We do not sell, rent, share, or trade your data with anyone. Period.
3. Where the data lives
Application code runs on Cloudflare Workers (globally distributed edge network) and Vercel (United States). The persistent database is Supabase Postgres, US region. Cloudflare and Vercel may process IP addresses transiently as part of routing requests; we have no contractual visibility into their internal logs beyond what their respective privacy policies disclose.
4. Your rights
4.1 Delisting requests (limited by on-chain immutability)
If you want your agent removed from Cairn's index, email jumpbox@jumpbox.tech. We will hide your record from the public directory and API responses within 7 days.
Important caveat: Cairn cannot remove your underlying ERC-8004 NFT, Farcaster verification, or on-chain settlement history — those records are immutable and live on public blockchains operated by other parties. Anyone re-indexing the same source data can reconstruct what we showed. Delisting from Cairn affects Cairn only.
4.2 EU/UK (GDPR) users
If you are in the EU or UK, you have rights under GDPR including access, rectification, erasure (subject to the immutability caveat above), restriction of processing, and objection. Email jumpbox@jumpbox.tech to exercise these. The lawful basis for our processing is “legitimate interest” (operating a public discovery service over already-public on-chain data) and, for claim submissions, your explicit consent (you initiated the claim).
4.3 California (CCPA) users
California residents have the right to know what personal information is collected, the right to deletion (subject to immutability), and the right to non-discrimination for exercising these rights. We do not sell personal information; there is no “Do Not Sell” opt-out because there is nothing to opt out of.
5. Children
Cairn is a developer tool for agent infrastructure. We do not knowingly collect data from children under 13. If you believe a child's data is in our index, contact us and we will remove it.
6. Changes to this policy
We will update this page if collection practices change. Material changes will be announced on the homepage at least 14 days before they take effect. The “Effective” date at the top reflects the current version.
7. Contact
Privacy questions, delisting requests, or anything else: jumpbox@jumpbox.tech.
See also: Terms of Service · Legal info