Minimal data, explicit operations.

The x402-hosting marketing website does not require an account and its current implementation does not set application cookies, embed an analytics SDK, or collect information through a contact form. Normal network infrastructure may process request metadata such as IP address, user agent, requested path, timing, and error details to deliver the site, prevent abuse, and investigate operational problems.

The deployment service processes the project and payment information needed to perform the action an agent requests. This can include a project identifier, public wallet address, x402 payment proof, deployment artifact, deployment and operation identifiers, project URL, expiry, build state, and technical logs. Public wallet addresses and blockchain payment records are inherently observable on their respective networks.

Local files and secrets

The CLI writes x402-hosting.json as public project metadata. It does not place a private key in that file. A temporaryx402-hosting.payment.json may be created when an external wallet must complete a payment; agents should treat that handoff as sensitive operational state, keep it out of version control, and reconcile it with finalize instead of deleting it.

Deployment artifacts contain the application being published. Users and agents are responsible for ensuring builds do not embed credentials, personal data, private environment files, or content they are not authorized to publish. Infrastructure providers may retain limited logs and stored artifacts as required to serve active projects, recover operations, enforce limits, and remove expired or deleted projects.

Questions or correction requests can be opened through the project’s public support channel. Do not post secrets or private payment material in an issue; request a private coordination path when the subject is sensitive.