SAFER01 The short version
If you read nothing else:
- We never ask for, receive, or store a private key or seed phrase. There is no field for one anywhere in the product.
- There is no account password. You sign in by signing a message with your wallet — a signature that costs nothing and moves nothing.
- We run no analytics, no advertising trackers, and no third-party marketing cookies.
- Your conversations with the SAFI agent are sent to Google's Gemini API to generate replies, and are stored in your account history.
- Anything written to a blockchain is public and permanent — we cannot delete it, and neither can you.
SaferICO operates this site and its services. Contact details are in section 13. This policy covers the website, the Telegram bot and Mini App, and the API — it does not cover third-party sites, wallets, or protocols you reach through us.
02 What we never collect
This list is a design constraint, not a promise of good behaviour. The product has no way to receive these values:
- Private keys, seed phrases, or recovery phrases. Never — under any circumstance, on any surface, for any reason. Anyone asking you for one while claiming to be SaferICO is attacking you.
- Passwords. There are none to steal; authentication is a wallet signature or an OAuth login.
- Custody of your funds. We never hold, move, or have the ability to move your assets. Every transaction is signed in your own wallet, by you.
- Payment card details. Payments are made on-chain from your wallet, or via Telegram Stars. No card ever reaches us.
- Behavioural analytics or ad profiles. No Google Analytics, no Meta pixel, no session recording, no cross-site tracking.
Because we never need your seed phrase, any message, DM, popup, or "support agent" requesting it is fraudulent — including ones using our name, logo, or a lookalike domain. Verify the domain is exactly saferico.com before signing anything.
03 What we do collect
Identity & account
| Data | When | Notes |
|---|---|---|
| wallet address | You sign in with a wallet | The public address only. Stored lowercase. Already public on-chain. |
| GitHub id, handle, avatar, email | You sign in with GitHub | We request the read:user scope only — no repository access of any kind. |
| Telegram user id & handle | You use the bot or Mini App | Provided by Telegram to identify your session. |
| display name, avatar | From the provider above | Shown in your own dashboard. |
| session records | Each sign-in | We store a hash of the session token, plus browser user-agent and timestamps — never the token itself. |
Subscription & usage
- Payments: transaction hash, chain id, plan tier, USD value, and which surface you paid from (web, Telegram, or Stars).
- Usage events: the type of action (chat, tool, scan, API), the tool name, credits consumed, and a timestamp — this is what meters your plan.
- API keys: stored as a SHA-256 hash with a name and usage counters. The key itself is displayed once, at creation, and is never recoverable from us.
Agent & product activity
- Conversations with SAFI: your messages, the agent's replies, and tool results, kept as your run history so you can return to them.
- Tool calls: the arguments you supplied, the result, chain id, transaction hash and status.
- Assets: contracts you deployed through the platform — address, chain, name, symbol.
- Scan reports: the contract address scanned, chain, score, finding counts, and a summary. Note that the 201-detector audit engine runs inside your browser; the report is sent back to us only so it appears in your history and can be shared if you choose.
- Automations: the rules you configure (price, gas, DCA, scan) and their run results.
- Manual audit requests: the contact you give us (Telegram or email), the repository or contract to review, and scope notes.
Chat content is stored in your run history and sent to Google to generate a reply. Treat it like a public notebook: never paste private keys, seed phrases, API secrets, or personal documents into it.
Technical data
Our application code does not log IP addresses. However, our infrastructure provider (Cloudflare) necessarily processes connection data — including IP address — at the network level in order to deliver the service, block abuse, and mitigate attacks. That processing is governed by Cloudflare's own privacy terms.
04 Why we collect it
| Purpose | What it uses |
|---|---|
| Give you an account that survives across wallet, GitHub and Telegram | Identity records, sessions |
| Honour what you paid for and stop double-crediting the same payment | Payments (keyed by transaction hash) |
| Meter plan limits fairly and prevent abuse | Usage events |
| Show your history — runs, assets, reports, automations | Agent & product activity |
| Answer your questions through the AI agent | Chat messages (sent to Google Gemini) |
| Deliver a manual audit you requested | Audit request details |
| Keep the service up and defend it from attack | Infrastructure-level connection data |
We do not sell personal data, and we do not share it for advertising. We have no advertising business.
05 Cookies & local storage
We use the minimum required to keep you signed in. There are no advertising or analytics cookies.
| Name | Type | Purpose |
|---|---|---|
| sfi_sess | Cookie — HttpOnly, Secure, SameSite=Lax | Strictly necessary. Keeps you signed in. Not readable by scripts. |
| sfi_sub_token | Browser local storage | Your session token, so wallet sign-in persists between visits. |
| preferences | Browser local storage | Interface state — recently used tools, dismissed notices. |
Clearing your browser storage signs you out and removes all of the above. Nothing there is used to track you across other websites.
06 Who else receives data
These are the only third parties involved in running the service. Each receives the minimum needed for its function.
| Service | What reaches them | Why |
|---|---|---|
| Cloudflare | All traffic, plus data stored in their database and cache products | Hosting, CDN, application runtime, database, DDoS protection |
| Google — Gemini API | The contents of your SAFI conversations | Generating the agent's replies |
| Google Fonts | Your IP address and browser type, on page load | Serving the site's typefaces |
| Block explorers Etherscan, BscScan, PolygonScan, Snowtrace, Basescan | Contract addresses you scan or look up | Fetching verified source code and on-chain metadata |
| Public RPC nodes publicnode.com, llamarpc.com | Addresses and chain queries | Reading blockchain state, gas prices, balances |
| CoinGecko, Coinbase, Binance | Nothing personal — asset symbols only | Price data |
| Telegram | Your Telegram identifier, if you use the bot or Mini App | Running the bot, Mini App, and Stars payments |
| GitHub | Your GitHub identity, if you choose that login | OAuth sign-in (read:user only) |
SAFI is powered by Google's Gemini models. To answer you, the text of your conversation is transmitted to Google and processed under Google's terms for that API. If that is not acceptable for a particular piece of information, do not put it in the chat.
We may also disclose data where we are legally required to, or where it is necessary to investigate fraud, abuse, or an attack on the service.
07 Public blockchain data
This deserves its own section because it is the part people most often misunderstand.
- Your wallet address is already public. So is every transaction it has ever made. We did not make it public and we cannot make it private.
- Any contract you deploy, token you create, or transaction you sign is written to a public, permanent, worldwide ledger.
- Deleting your SaferICO account does not remove on-chain data. Nothing can. That is how blockchains work.
- Anyone can link an address to activity. If you need separation between identities, use separate wallets.
08 How your data is protected
- Session tokens are stored hashed. A copy of our database cannot be replayed as a login.
- API keys are stored hashed (SHA-256). We cannot show you a key again after creation because we do not have it.
- Bring-your-own-key credentials are encrypted with AES-GCM before storage, never written in plaintext.
- All traffic is served over HTTPS, with a restrictive content-security policy.
- Signing in requires a wallet signature tied to a specific message — there is no password to guess, phish, or reuse.
No system is unbreachable, and we will not claim otherwise. What we can state is what we hold: no keys, no passwords, no card numbers. The worst case of a breach here is disclosure of account activity — not loss of your funds.
09 Retention & deletion
We keep account data while your account exists, and payment records for as long as needed to honour and evidence subscriptions.
To delete your account, contact us using the details in section 13 from the wallet, GitHub, or Telegram identity connected to it. On deletion, your account and everything linked to it — sessions, runs and messages, tool calls, assets, reports, automations and API keys — are removed.
1. On-chain records — permanent by design, and outside anyone's control. 2. Data already transmitted to a third party, such as a conversation processed by Google, which is governed by that provider's own retention terms.
10 Your choices
- Ask what we hold about you, and request a copy.
- Correct anything inaccurate.
- Delete your account and its data, subject to the limits above.
- Disconnect a login method — unlink GitHub or Telegram at any time from your account settings.
- Use less of it: the free scanner works without an account at all. Sign in only when you want history, plans, or the agent.
Requests are handled through the contact channels below. We may need you to prove control of the connected wallet or account before acting on a request — otherwise anyone could delete someone else's data.
11 Children
SaferICO is a professional security tool and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a minor has created an account, contact us and we will remove it.
12 Changes to this policy
When this policy changes, the "last updated" date at the top changes with it. If a change materially affects what we collect or who receives it, we will say so prominently on the site rather than quietly editing this page. Continuing to use the service after a change means you accept the updated policy.
13 Contact
For privacy questions, data requests, or account deletion:
- Email: support@saferico.com
- Business & legal: business@saferico.com
- Telegram: @SFI_admin
We aim to reply within 24 hours.
This page covers data. The limits of what our tools promise — and the limitation of our liability — are set out in the Terms of Service & Disclaimer.