Privacy Policy

When your application calls a Prism RPC endpoint, we receive the JSON-RPC request in order to forward it to a Robinhood Chain provider. That request may contain addresses, contract calls and signed transaction payloads.

We forward it, return the response, and record only the metadata described below. Request and response bodies are held in memory for the life of the request and are not written to durable storage.

For each request we retain, associated with your API key:

• The JSON-RPC method name (for example eth_call)
• Timestamp, total latency and upstream latency
• The provider selected and the response status
• Whether the response was cached, deduplicated or retried
• Coarse region of origin, derived from the edge that served you

We do not record method parameters, addresses, calldata, transaction contents or response results.

• Private keys, seed phrases or any signing material - we never hold or request them
• Wallet addresses as an identity, or any attempt to link them to a person
• Behavioural advertising identifiers or cross-site tracking data
• Full IP addresses beyond the transient period needed for abuse prevention

If you create an API key we store the email address used to create it, the key itself in hashed form, and its configuration. This is what lets us contact you about incidents and enforce your plan limits. Nothing more.

Per-request metadata is retained for 30 days for debugging and abuse prevention, then deleted. Aggregate counts - requests per method per day - are retained for 13 months for capacity planning and carry no per-request detail.

Account data is retained while your account is open, and deleted within 30 days of closure.

Your requests are forwarded to independent RPC providers. Those providers see the request content and operate under their own privacy policies. We do not tell them who you are: upstream calls are made under our credentials, not yours.

We use infrastructure and error-reporting vendors under contracts that prohibit using your data for their own purposes.

The marketing site and documentation collect no analytics cookies. Fonts are served from the same origin. Nothing on this site profiles you.

You may request a copy of the account data we hold, ask for corrections, or ask for deletion. Write to hello@prismrpc.co and we will respond within 30 days. Where the GDPR or CCPA applies to you, those statutory rights apply in full.

Traffic is encrypted in transit. API keys are stored hashed. Access to production systems is limited, logged and reviewed. Report a vulnerability to security@prismrpc.co.

Material changes to this policy will be announced by email to account holders before they take effect. Questions go to hello@prismrpc.co.