Legal · version 1.0.0 · effective 2 October 2026

Privacy Policy

Effective date: 2 October 2026
Version: 1.0.0

1. Who we are

Txpass (the service at https://txpass.app/) is operated by Adam David McCartney trading as Perpetual Data Platforms (ABN 37 924 741 238), an Australian sole trader based in New South Wales.

The business name Perpetual Data Platforms is registered with ASIC against ABN 37 924 741 238. Txpass is the product brand for the service at txpass.app. ImprintAI is a separate product brand of the same operator.

Contact (general): hello@perpetualdataplatforms.com.au
Contact (privacy): privacy@perpetualdataplatforms.com.au
Contact (support): support@perpetualdataplatforms.com.au
Location: New South Wales, Australia
Business site: https://perpetualdataplatforms.com.au/ (content may be added over time)

This Privacy Policy explains how we collect, use, disclose, and store personal information in connection with Txpass, in a manner intended to align with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) where they apply.

2. Scope

This policy covers:

• the Txpass website and documentation (including /, /about, /pricing, /privacy, /terms, /docs);
• the account page (/account) and publisher dashboard (/publisher);
• the facilitator API at https://txpass.app (session minting, JWKS, policies, connect, entitlements);
• the open-source @txpass/* packages published to npm, to the extent they talk to our hosted facilitator;
• related operational logs needed to run the service.

It does not govern:

• third-party wallets (for example Yours / BRC-100 wallets);
• publisher APIs that accept Txpass session tokens (for example ImprintAI) — those have their own policies;
• public blockchain networks and indexers we do not control;
• agent software running on your own machine (the agent key stays on that machine).

3. What we collect

3.1 Account and identity

Txpass accounts are keyed by a wallet identity public key (a compressed secp256k1 pubkey). We do not require a name, email address, password, or phone number to use the core service. A public key can become linkable to a real-world person if you reuse a known identity elsewhere (for example a published address, Paymail, or profile). We treat the public key as personal information.

Depending on how you use Txpass, we may collect:

• your wallet identity public key (presented via BRC-103 / AuthFetch signed requests);
• agent public keys you enrol under a policy or one-off delegation;
• publisher-owner public keys associated with a product;
• labels you choose for agents, products, or route groups (free text you supply);
• optional contact details if you email us for support or privacy requests.

We do not receive or store wallet private keys, WIFs, seed phrases, or agent private keys. Session JWTs are signed by Txpass’s facilitator signing key; that key is held by us as operator (see section 5.1).

3.2 Entitlements and receipts

• entitlement records linking an identity public key to a product and plan, with validity window and status;
• optional on-chain BSV receipt metadata we verify (txid, paid amount in sats, block height, verification time), when the paid-receipt feature is enabled for a product;
• auto-enrolment records for free plans where a publisher has configured that behaviour.

Paid end-user payments, when used, are settled on-chain to the publisher’s pay-to address. Txpass does not take custody of end-user payment funds and does not process card payments for end users today.

3.3 Agent policies, delegations, and connect

• agent policy records (owner identity, agent public key, product, scopes, daily caps, expiry, revocation time);
• one-off delegation certificates and revocation records;
• short-lived connect / pairing requests (pairing code, agent key, requested product and scopes, expiry); pending rows expire and are deleted in the ordinary course;
• policy usage counters (daily aggregates per policy) and issuer-only policy event logs used for abuse prevention and support.

3.4 Publisher configuration

• publisher and product metadata (slug, display labels, route patterns, scope groups, recommended scopes);
• product approval state and owner public keys;
• aggregate product totals shown on the publisher dashboard (for example session counts). We do not expose other users’ identity keys to a publisher through that dashboard.

3.5 Technical and operational data

• request metadata reasonably needed for security and operations (timestamps, status codes, rate-limit counters, error diagnostics);
• IP addresses and user-agent strings as processed by our hosting provider’s edge / reverse proxy and application logs;
• public protocol metadata we publish (JWKS, /v1/protocol, product catalogue fields that are intentionally public).

3.6 Cookies and analytics

We do not use analytics, advertising, or tracking cookies or third-party tracking scripts on txpass.app.

• The marketing site, docs, /account, and /publisher are designed to load no third-party scripts and to set no cookies.
• Theme or UI preferences, if any, stay in your browser (for example localStorage) and are not used for tracking.
• Wallet extensions you install (for example Yours) are third-party software on your device; their storage is outside this policy.

3.7 Information we do not intentionally collect

We do not require sensitive information (as defined in the Privacy Act) to use the core service. Please do not put personal information you are not entitled to process into agent labels, product labels, or other free-text fields.

4. How we use personal information

We use personal information to:

• provide, operate, secure, and improve Txpass;
• authenticate wallet-signed requests and mint short-lived session JWTs for entitled identities and enrolled agents;
• enforce policies, scopes, daily caps, revocation, and rate limits;
• verify optional on-chain entitlement receipts when that feature is enabled;
• operate the publisher dashboard and product catalogue;
• prevent abuse, fraud, and security incidents;
• respond to support and privacy requests;
• meet legal obligations.

We do not sell personal information.

5. Sessions, keys, and on-chain data

5.1 Who signs session tokens

Txpass’s facilitator holds a signing key used to issue short-lived session JWTs (typically 15–60 minutes). Publishers verify those JWTs locally using our public JWKS. We disclose this trust model on the site: we never see your wallet private key; we do sign the session tokens agents present to publishers.

Revoking an agent or policy stops new sessions immediately. JWTs already issued remain valid until they expire (at most the configured session lifetime).

5.2 Public blockchain

Optional entitlement receipts may reference a public blockchain transaction (BSV). Blockchain data is typically public, independently replicated, and not editable or deletable by Txpass once confirmed. Deleting application records does not remove information already included in a blockchain transaction.

Txpass does not intentionally place names, email addresses, or other direct contact details on-chain. On-chain receipts may include amounts, pay-to addresses, and OP_RETURN fields that name an identity public key, product, plan, and validity window, depending on the receipt format in use.

5.3 Publisher APIs

When an agent calls a publisher API with a Txpass session JWT, that publisher processes the request under its own privacy policy. Txpass is not a proxy and does not see the body of those API calls.

6. Disclosure and subprocessors

We may disclose personal information to:

• service providers who help us run Txpass (hosting, database, email, domain);
• professional advisers or auditors where reasonably necessary;
• authorities where required or authorised by law;
• a successor operator if the service is transferred (with notice where practicable).

Current categories / providers (to be kept updated):

Those providers process information under their own terms and policies.

Publishers that accept Txpass sessions receive whatever claims appear in a session JWT (typically subject identity and/or agent key, product, plan or entitlement hints, scopes, policy or delegation identifiers, issuer, and expiry). That disclosure is necessary to provide the Service you request.

7. Overseas disclosure (APP 8)

Personal information may be processed or stored in Australia and in other countries where our service providers operate, including (without limitation) the United States, in connection with providers such as Railway, npm, Squarespace, and Mailgun. Exact data-centre locations are determined by those providers. Where we disclose personal information overseas, we take steps that are reasonable in the circumstances to ensure the recipient does not breach the APPs in relation to that information, or we rely on another permitted basis under the Privacy Act.

8. Retention

Self-serve account deletion is limited today because the account identifier is a wallet public key with no password reset flow. You may revoke agents and policies in /account. To request deletion of residual application records linked to your identity public key, contact privacy@perpetualdataplatforms.com.au or support@perpetualdataplatforms.com.au. We may add self-serve deletion later; until then, email is the path. We will delete or de-identify records where practicable, except where we must retain them for security, dispute, or legal reasons (for example revocation history needed to keep revoked agents out), and except for on-chain data we cannot alter.

9. Security

Report suspected security incidents affecting Txpass to privacy@perpetualdataplatforms.com.au (or support@ if privacy@ is unavailable).

We use reasonable technical and organisational measures appropriate to the nature of the information, including TLS in transit, Content Security Policy and related browser hardening on our pages, signed request authentication (BRC-103), short-lived session tokens, and separation of wallet private keys from our servers. No method of transmission or storage is completely secure.

A compromised agent machine can still mint sessions until the policy or delegation is revoked and existing JWTs expire. Protect agent keys on the machines that hold them. See also Terms of Service §7 (sessions, revocation, and trust model).

10. Access, correction, and deletion

You may request access to, or correction of, personal information we hold about you, and you may request deletion where practicable, by contacting privacy@perpetualdataplatforms.com.au.

Because the primary identifier is a public key you control, “correction” of the key itself means using a different key and revoking the old associations rather than editing the key string.

We cannot delete or alter data already published on a public blockchain.

11. Direct marketing

We do not currently send marketing emails unrelated to service notices. If that changes, we will provide a clear opt-out.

12. Children

Txpass is intended for people aged 18 or older. We do not knowingly collect personal information from people under 18.

13. Complaints

If you have a privacy concern, contact us at privacy@perpetualdataplatforms.com.au. We will aim to respond within a reasonable time. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/.

14. Changes

We may update this policy from time to time. The effective date above will change when we do. Continued use of Txpass after an update constitutes acceptance of the revised policy where permitted by law.

15. Contact

Adam David McCartney trading as Perpetual Data Platforms (ABN 37 924 741 238)
Operating Txpass — https://txpass.app/
General: hello@perpetualdataplatforms.com.au
Privacy: privacy@perpetualdataplatforms.com.au
Support: support@perpetualdataplatforms.com.au
New South Wales, Australia