Last updated October 26, 2026
In short
- Reading PikaMd needs no account. When you only read, PikaMd stores nothing about you (its host processes requests like any website host, below).
- When you connect a wallet, PikaMd knows its public address. It never asks for your name, email, phone number or any other personal detail.
- There are no analytics, tracking pixels or advertising scripts, and PikaMd doesn't sell or share data for advertising.
- What you publish is public and permanent on Arc and IPFS. Read the clean-up step before you publish.
What PikaMd stores
| What | When | Why |
|---|---|---|
| Wallet address | You connect a wallet and sign in | Your session, likes, collection, guidelines, tips and connected apps belong to it |
| Likes and collection | You like or save a guideline | To show your likes and give your agent your saved guidelines |
| Published guidelines | You publish | Title, summary, tags and the file, plus the scan result, so the library can show and search it |
| Reports | You report a guideline | The reason and the optional note you write, so a moderator can review it |
| Tips | You send a tip | The public Arc transaction, so authors see the tips they received |
| MCP keys and app tokens | You create a key or allow an app | Only their SHA-256 hashes, the app's name and address, and when it was last used. PikaMd can't read your key or tokens back |
| A coded IP address | Sign-in, uploads, tip records and app sign-in steps | Rate limits against abuse. The IP is stored only as a keyed hash (HMAC), never as it is |
Public and permanent
Some of what you do is recorded outside PikaMd and stays public, on purpose:
- Arc: publishing records your wallet as the author, with the file's IPFS address and fingerprint. Hiding, moderator locks, tips and moderator approvals are Arc transactions too. Blockchain records can't be erased by anyone.
- IPFS: the file you publish is stored on IPFS through Pinata. PikaMd can stop serving a file, but copies others keep aren't under its control.
That's why Publish has a clean-up step that finds personal data and secrets before anything goes out.
Cookies and browser storage
| Name | Kind | Purpose |
|---|---|---|
pikamd_session | Cookie, 7 days | Keeps you signed in after the sign-in signature. HttpOnly, SameSite=Strict |
pikamd:query-cache | Local storage, 7 days | Your own recent data (session, collection, likes, profile) so pages open instantly |
| Wallet connection | Local storage | Which wallet you connected last, so it reconnects. WalletConnect, if you use it, keeps its own session in your browser |
Nothing here is used for tracking. Clearing your browser's site data removes all of it.
AI agents
When you connect an agent such as Claude, it reads the public library and, after you allow it, the list of guidelines in your collection. It can't publish, tip, like, report or change anything. PikaMd doesn't receive your conversations with the agent: it sees only what the agent asks PikaMd for, such as search words and the guideline it wants to read. You can disconnect any app on Connect your agent.
Services PikaMd uses
| Service | For |
|---|---|
| Vercel | Hosting the site and its server. It processes requests, including IP addresses, under its own policy |
| Supabase | The database behind likes, collections, the library index and the records above |
| Pinata (IPFS) | Storing published files |
| Arc Network | Recording authorship, tips and moderation; your browser reads it directly to verify files |
| WalletConnect (Reown) | Connecting phone wallets, only if you choose WalletConnect |
How long data is kept
- Coded IP addresses for rate limits: cleared in routine cleanup once their window is more than a day old.
- Used sign-in codes: until they expire, a few minutes. App sign-in requests, codes and expired tokens: cleared in routine cleanup a day after they expire.
- Likes, collections, reports and connected-app records: while PikaMd runs, or until you remove them.
- Published guidelines: permanently on Arc and IPFS, as described above.
Your choices
- Take back a like, or remove a guideline from your collection, at any time.
- Hide a guideline you published: it leaves the site and agents, though the Arc record remains.
- Revoke your MCP key, or disconnect any app, on Connect your agent.
- Disconnect your wallet to end your session.
- To ask about or remove other data, open an issue on GitHub (opens in a new tab). Don't post private details there: say what you need and we'll reply.
Children
PikaMd is a tool for developers and isn't aimed at children.
Changes and contact
When this policy changes, the date at the top changes with it. Questions go to GitHub Issues (opens in a new tab). The code is public, so anyone can check what PikaMd does.