Once Upon a Bit · Legal

Privacy Policy

What we store, who else sees it, and how long we keep it.

Effective 2026-08-08 · Once Upon a Bit, operated by Mauricio Eastmond (California, USA) · mauricio@onceuponabit.com

In summary: Once Upon a Bit has no accounts, no advertising, no analytics, and no cookies. We store the information an adult enters when creating a gift and erase the personal parts of it on a fixed schedule. The claim page designed for children collects nothing beyond the IP address any website receives in order to deliver a page; it is covered by a separate notice.

1 · What we store

When an adult creates a gift, our database stores:

  • the giver’s name and the recipient’s first name, as entered by the giver;
  • the message, if one was written;
  • the storybook chosen and the occasion;
  • the gift’s public bitcoin address, the intended amount, and the dates it was created, funded, and claimed;
  • a record that the giver confirmed saving the claim link, and the version of the terms in force at that moment.

If a storybook unlock is purchased, we store the purchase: the payment address we generated, the amount quoted, the amount received, and the relevant dates. We store no buyer name, email address, or payment details; payment is made in bitcoin, so none exist to collect.

2 · What we never store

  • Private keys and seed phrases. The gift’s key travels in the claim link; the child’s wallet words are generated on their device and written on paper. Neither reaches our servers.
  • The child’s destination address. We do not record where a child’s coins were sent, and a child’s identity is never linked to a bitcoin address in our records.
  • Email addresses, phone numbers, postal addresses, passwords, or payment cards.
  • Quiz answers, reading progress, or any record of how a child used the page.

3 · Data stored in your browser

Some data is kept in your browser’s local storage, on your device. Pages read it there, in your browser; it is never sent to our servers:

  • your own copy of the gifts you created, including their claim links — this is how your gift list works without an account, and why clearing your browser data can lose a link we cannot restore;
  • a draft of an unfinished gift;
  • a note that a gift was already claimed on this device, so the page does not offer it again.

We set no cookies on any page, for any purpose.

4 · Service providers

Three companies process data so that this website can operate:

  • Cloudflare — serves and protects the website. It processes visitor IP addresses and keeps request logs as part of ordinary network operation and security.
  • Supabase — hosts the database described in Section 1.
  • mempool.space — a public bitcoin data service we query for address balances and network fees, and through which claim transactions are relayed to the bitcoin network.
We contact mempool.space from our server, never from your browser, so a visitor’s IP address — including a child’s — is not disclosed to it. There are no third-party scripts, fonts, pixels, embeds, or error reporters on this website; fonts are served from our own domain.

5 · Who can see a gift

A gift page is protected by an unguessable link and nothing else. Anyone holding the link can see the giver’s name, the recipient’s first name, the message, the amount, and the funding status. There are no passwords, because there are no accounts.

This is a deliberate design for a product built around sharing a link. Treat a gift link as private and share it only with the family it is intended for.

6 · How long we keep it

We do not retain personal information indefinitely. An automated job runs nightly and deletes it:

  • 90 days after a gift is claimed, we erase the giver’s name, the recipient’s first name, the message, and the claim transaction identifier.
  • 365 days after a gift is created, if it was never claimed, we erase the same fields.

What remains contains no personal information: the storybook, a public address, and dates. We keep that record so the claim link continues to work. The bitcoin itself is recorded on the public blockchain, which no one can delete, and your link continues to open it.

7 · What we do not do with it

We do not sell, rent, or share personal information, use it for advertising, or use it to build profiles. This website carries no advertising and no analytics of any kind. We send no marketing email; we do not have your email address.

8 · Deletion requests

Email mauricio@onceuponabit.com with the gift’s ID — the short code in the link, before the “#” symbol — and we will erase that gift’s record. You may do this at any time, without giving a reason. Never send us the link itself: everything after the “#” is the key to the bitcoin, and anyone who has it can take the gift.

We cannot delete anything from the bitcoin blockchain. It is a public record that no one controls, and a claimed gift leaves a permanent trace there. What we can delete is our record — including the link between a name and that transaction, which is why we delete it on a schedule.

9 · Children

The claim page is designed for children and is covered by a separate, more detailed notice: the Children’s Privacy notice.

10 · Contact

Mauricio Eastmond — mauricio@onceuponabit.com. If this policy materially changes, the updated version will be posted on this page, with a new effective date, before the change takes effect; because we hold no contact information, we cannot notify you individually.