What this server stores.

SpendGate does not phone home. The operator of this deployment is the party that holds the database. The software itself has no analytics account and no third-party tracker on the site.

Scores

v1 does not keep the spend body. A score is computed and returned. Quota is a counter: how many free scores and how many paid scores ran today for a subject. The anonymous subject is a hash of the UTC date and the client IP, so the raw IP is not written down and the hash changes the next day. When the Toolweather suite proxies a call with its bundle secret, the subject is a hash of the UTC date and that client id instead. The raw client id is not stored.

API keys

A free key is shown once. The database stores a SHA-256 hash, a short prefix, an optional label, the daily limit, and the time it was minted. Losing the secret means minting another key.

Payments

If you pay for an overage score, the server sends the signed x402 payload to the PayAI facilitator at https://facilitator.payai.network so it can verify and settle. SpendGate then stores the payment nonce, payer address, transaction hash, amount, and the score JSON so the same nonce can be replayed without paying twice.

What we do not want

Do not send secrets, credentials, or full customer records in the purpose field. The purpose is only a label for the risk band when you omit category.