Privacy
This is a short, accurate description of what VetMyToken does with data. You do not need an account to use it, and there is nothing to log in to.
What we store
- Scan results. When you submit a chain and a contract address, the address and the result of the scan are stored in a SQLite database on our server and published as a public result page. Treat everything you type into the scan box as public.
- Server logs. The Caddy web server in front of the site
records one line per request: the time, the path you asked for, the
status code, your browser's user-agent string, and the page that linked
you here if there was one. Your IP address is shortened before
the line is written to disk. The last block of an IPv4 address
and the last three-quarters of an IPv6 address are replaced with zeros at
the moment of writing, so the file never contains a whole address and
there is no window in which one could be recovered from it. Your
CookieandAuthorizationheaders are dropped before the line is written as well. These files rotate and are kept for at most fourteen days, or less if traffic rotates them out sooner. The application's own request log behind the proxy records the local proxy address, not yours. - Rate limiting. Your IP address is counted in memory for a short rolling window so one visitor cannot exhaust the scanner. It is not written to the database and it is not attached to your scans.
- Anything you type into a form. Contact messages and community notes are stored so they can be read, answered and moderated. A community note is published on the token page you post it to.
Paid plans and payments
If you buy a plan, VetMyToken processes what the payment needs and nothing more. For a Telegram Stars purchase: your Telegram user id and chat id, the plan, the period, and the charge identifier Telegram gives the payment; Telegram processes the payment itself under its own privacy policy and tells us whether a subscription is active. For a USDC payment: the address you paid from, the address you paid to, the transaction hash, the amount, and the plan and period; a blockchain transaction is public by nature and VetMyToken does not add anything to it. VetMyToken never sees or stores a card number, a bank account or a passport, because it does not take cards or bank transfers. If you link your API key to a Telegram chat, the link code is stored only as a hash, never in the clear; it is cleared the moment it is used, it stops working fifteen minutes after it was issued, and asking for a new one replaces it. Payment records are kept for as long as the law on accounts requires, and your plan record for as long as your plan and one year after, so a dispute can be answered; a request to delete your account removes everything except the payment records the law requires us to keep. These records are shared with nobody except Telegram, for a Stars purchase, and the public blockchain, for a USDC payment, and they are never used for advertising.
Cookies and your analytics choice
One cookie, named watch, holds the list of scans you added to
your watchlist. It is set by this site only, it holds scan identifiers and
nothing else, and clearing it empties your watchlist. Signing in to the
admin area sets a second cookie; ordinary visitors never receive it.
On your first visit a banner asks whether you allow Google Analytics.
Your answer, Accept analytics or Decline, is remembered in
your browser's local storage under one key
(vmt_analytics_consent) and nowhere else; it is not sent to us
or to Google, and it is the only thing stored before you choose. If you
accept, Google Analytics sets its own first-party cookies (named
_ga and _ga_ followed by an identifier) so it can
tell a returning visitor from a new one. If you decline, no analytics
cookie is set and nothing from Google is loaded. You can change your
answer at any time with Cookie settings in the footer, which
clears the remembered choice and shows the banner again.
What we do not do
There is no advertising network, no tracking pixel and no cross-site profiling on this service. The one third-party script is Google Analytics, and it is loaded only after you accept it. We do not sell personal data. We do not ask for your name, email address or payment details in order to run a scan.
We count visitors in two ways. The first is the shortened server logs described above, which never leave this server and need no consent. The second is Google Analytics 4, which runs only if you have chosen Accept analytics: from then on, on each page you open, your browser fetches Google's analytics script from Google's servers and sends Google the page you viewed, the page that linked you here, your browser and device type, session details such as when the visit started and how long it lasted, an approximate location derived from your connection, and the identifier held in its cookies. Because your browser makes that request itself, Google sees your IP address; Google states that Google Analytics 4 does not log or store it. Google handles this data under its own privacy policy. Until you accept, none of this happens: no request reaches Google and no analytics cookie exists. Declining, or blocking the script with a content blocker, stops nothing on this site from working.
Data that leaves our server
To complete a scan we send the chain and the contract address — not your IP address — to public blockchain RPC endpoints and to the external market and token-security feeds listed on the data disclosures page. Token pages may embed a price chart served by Dexscreener; that embed loads from their servers, so they will see the request your browser makes for it. Pages also load Google Analytics, but only after you have accepted it, as described above.
Questions and removal requests
Use the contact form. Scan pages describe public on-chain contracts rather than people, so we will not normally remove one, but we will read and answer the request.