Privacy
bundled.wtf reads public blockchain data and shows it back. Labels such as “Bundle” or “Sniper bot” describe what an address did on chain, with the transactions linked as evidence. They aren't claims about the person behind it.
The website
No accounts and no ads. To see how the site is used we run PostHog, hosted in the EU: which pages are visited, clicks, the country and kind of device a visit comes from, and session replays with everything you type hidden. Visits stay anonymous, a first-party cookie only tells one visit from the next, we never sell or share this data, and your browser's Do Not Track setting turns it off. Your browser also keeps a few settings, locally: your feed filters, your chart settings (line or candles, USD or SOL), the code language in the API docs and, while you claim an API key, that claim's secret. Those never reach us.
The API
To enforce rate limits we count requests per IP address, or per API key, for a minute at a time. Keys are stored hashed with a name and a request count. We don't keep per-request logs, except briefly while dealing with an attack.
The Telegram bot
When you send @bundledwtfbot a token, we keep which chat asked, your Telegram user id and the token, for 90 days, then delete them. We use them to count usage and stop abuse, nothing else. In groups the bot only sees commands like /check and messages that mention it; it never reads or stores the rest of the conversation.
Disputes
If you think a wallet or token is labelled wrongly, tell us which and why on X (@bundledwtf), and we'll look at the evidence again. A shared bundle can be a coincidence.