Privacy Policy

RandScan (randscan.org) is the block explorer for Rand Protocol, run by the Rand Protocol team (“we”). It indexes the public ledger of the Rand Protocol network and shows it as web pages, a JSON API and a WebSocket feed. This policy covers the website, the API at randscan.org/api and the accounts you can create to get an API key.

The explorer’s source code is published under the MIT licence, so everything described here can be checked against what the software actually does.

RandScan runs no analytics, no advertising and no tracking scripts. Fonts are served from our own server. No third-party JavaScript is loaded on any page. There is no cookie banner because there is nothing to consent to: the only cookies are the language you choose from the menu, if you choose one, and the sign-in session described below, which is set only after you sign in.

We do not sell, rent or share personal data with anyone for their own purposes.

Almost everything RandScan shows is a copy of the Rand Protocol ledger: blocks, transactions, notes, validators, programs, tokens and bridge activity. That ledger is public by design and replicated by every node on the network. We did not collect it from you, we cannot alter it, and we cannot remove entries from it.

Rand Protocol is a shielded chain. Transaction amounts, senders and recipients are hidden on the ledger itself, and the explorer shows only what the chain makes public: the commitments, nullifiers and proofs of each transaction, plus the public opening of notes the chain computes itself, such as fees and bridge mints.

The History page and the note opener let you paste a viewing key, a transaction key or a wallet key file to read your own shielded activity. The decryption runs inside the page, in a WebAssembly module compiled from the explorer’s own code. A pasted key is held in the page’s memory only. It is never included in any request to our servers, never written to a cookie or to local storage, and is gone when you close or reload the page.

The page does fetch the encrypted envelopes it needs from our API, in the same way any visitor can. We therefore see which transactions a browser asked for, but not which of them opened or what they contained.

Like any web server, ours receives your IP address, the page or endpoint you asked for and the headers your browser sends. We use the IP address for two things:

• Rate limiting. Anonymous traffic is limited per IP address. The counter is held in the server’s memory for a window of one minute and is not written to a database.
• Operating the service. Server and process logs may record requests while we diagnose problems. They stay on the server and are rotated away after a short time.

When you open the home page by typing the address, from a bookmark or from another site, and have not chosen a language, the country of your address is looked up in a copy of DB-IP’s country database held on our own server, to choose the language the site opens in. Following a link within the site never switches the language. The result is not stored and nothing is sent to anyone. A language you choose from the menu is kept in a cookie named lang for a year and wins over the country from then on. IP Geolocation by DB-IP, licensed under CC BY 4.0.

Your theme choice (dark or light) is kept in your browser’s local storage under the key randscan-theme. It never leaves your device.

The Nodes and Provers pages draw a world map. The base map tiles are loaded by your browser directly from Esri’s ArcGIS Online tile service, so Esri receives your IP address and the tile coordinates in the same way it would for any map. No other page loads anything from a third party.

The markers on that map locate the network’s peers and the delegated provers’ hosts. Those are server addresses the network itself publishes, not visitors. Our indexer looks them up through the ipwho.is geolocation service and caches the city, country and provider it returns. Visitors’ addresses are never sent to a geolocation service.

You can use everything on RandScan without an account. An account exists only to issue API keys with a higher request quota. If you create one, we store:

• your email address and the time the account was created;
• an Argon2id hash of your password. We cannot read the password itself, and we never send it anywhere;
• for each API key, its name, the first characters of the key for you to recognise it, a SHA-256 hash of the secret, when it was created and when it was last used. The secret is shown once and is not stored;
• a sign-in session: a random token in the randscan_session cookie, HttpOnly and SameSite, with a hash of it in our database. A session lasts 30 days from its last use and is deleted when you sign out.

Requests made with an API key are counted against that key for rate limiting, in the same one-minute memory window as anonymous traffic. We do not record which endpoints a key called or what it asked for.

We send exactly one kind of email: a password-reset link, and only when you ask for one. It is delivered through Resend (resend.com), which processes your email address and the message to deliver it. The reset link expires after one hour. We do not send newsletters or notifications, and we do not use your address for anything else.

RandScan runs on servers rented from DigitalOcean, in Singapore. The database holding accounts, hashed credentials and sessions lives on that server. Backups, where taken, hold the same data for the same purposes. By using the service you accept that your data is processed there, wherever you are.

• Rate-limit counters: one minute, in memory.
• Server logs: a short period, then rotated away.
• Sessions: 30 days from last use, or until you sign out.
• The lang cookie, the language you chose from the menu: one year, in your browser.
• Password-reset tokens: one hour.
• Accounts and API keys: until you ask us to delete them.
• Public chain data: for as long as the explorer runs. It is the ledger.

You can revoke any API key and sign out of any session from your dashboard. To see the data held about your account, to correct it, or to have the account and its keys deleted, contact us from the email address on the account. We will act within 30 days. There is not yet a self-service delete button; we will add one.

Depending on where you live you may have further rights under laws such as the GDPR or the CCPA, including the right to complain to a supervisory authority. Nothing here limits them.

Questions about this policy or requests about your account go to the Rand Protocol team through the explorer’s repository at github.com/randprotocol/randscan.org.

When this policy changes, the new text appears here with a new effective date. Changes that reduce your privacy will be announced on the explorer before they take effect. This version took effect on 2 October 2026.