Public data
Wallet addresses, listing metadata, keyword bids, payment amounts, transaction identifiers, and timestamps are public by design. They are published because they explain and reconstruct ranking. A current imported-resource controller wallet, verified domain, and proof expiry are also public so clients can inspect the claim; private keys and raw signatures are never published.
Operational data
The service processes request identifiers, coarse server timing, error details, and keyed hashes of network addresses for short-lived rate limiting and event deduplication. Raw network addresses, payment authorizations, wallet signatures, credentials, user-agent profiles, and arbitrary search text are not stored as analytics or written to application logs. Attribution stores only hourly counters for canonical permitted keyword markets, bounded rank and evidence-freshness classes. Event deduplication hashes expire after two hours.
Advertising attribution
Sponsored results expose a direct canonical provider URL and an optional short-lived signed DefaultBench referral URL. The referral contains no user identity. Its first valid use is counted, replays are not, and the redirect sends no referrer or raw search text to the provider. Choosing the direct URL is always allowed and is intentionally not measurable by DefaultBench. Search and detail remain usable without cookies or tracking consent.
A provider may optionally submit one wallet-signed conversion declaration for a consumed referral. The stored receipt contains digests and coarse timestamps, not customer or order data. It is labelled provider-declared and is not an independently verified conversion.
Seller analytics and public reports
Private listing analytics use an accountless, one-time, origin-bound wallet challenge for the verified payer or current verified controller. The resulting bearer token expires after five minutes and authorizes only that listing. Public reports contain daily global totals and canonical market rows only after a minimum number of separately deduplicated market requests; the number of results in one request cannot satisfy that threshold. Rare buckets and request-level join keys are suppressed.
What is not requested
DefaultBench does not require a human name, email address, telephone number, account profile, advertising cookie, browser fingerprint, persistent visitor ID, cross-site tracking identity, or third-party analytics SDK.
Retention
Attribution counters and rank samples are retained for 90 days by default. One-time referral digests are retained for the optional seven-day conversion-receipt window, challenges until their short expiry, and deduplication hashes for two hours. Scheduled bounded cleanup enforces these limits. Verified payment records follow separate financial and legal retention because they establish cumulative paid rank.
Infrastructure
Hosting, PostgreSQL, Base RPC, and the x402 facilitator process the data necessary to deliver their services. Their independent policies apply. A conforming DefaultBench deployment must disable or redact edge/access logging of raw client addresses and search query strings; application logs use static route templates. Retention is limited by operational, security, legal, and backup requirements.