PRIVACY

Privacy

Poncho is a static site in front of four contracts on Robinhood Chain. It has no account system, no database and no analytics, so there is very little to say here. What there is, is below.

What this site stores about you

Nothing. There is no sign up, no email, no password and no profile. Poncho never asks who you are.

Two small things are kept by your own browser, on your own device, and are never sent anywhere:

• Your theme. Dark or light, in localStorage under poncho.theme.
• The wallet you last used. Its identifier only, under poncho.wallet, so the page can reconnect without asking you to pick again. Not your address, and never a key.

Clearing this site's data in your browser removes both. Nothing else is written.

Your wallet

Connecting a wallet shares your address with the page. Poncho never holds your keys, never asks for a seed phrase and cannot move funds on its own: every transaction is signed by you, in your own wallet, and a spend note is signed by the agent key you authorized.

Your address is used in the browser to read your balances and your own activity from the chain. It is not sent to any server that Poncho runs, and it is never sold, shared or joined with anything else.

The RPC proxy

Robinhood Chain's public node sends no CORS headers, so a browser cannot read the chain from it directly. Poncho serves a read-only proxy at /api/rpc that forwards your request to the node and returns its answer.

• It accepts read methods only. Every method that writes is refused, so the proxy can never send a transaction.
• It writes no log: not your address, not your IP, not the body of your request, not the answer.
• It stores nothing and keeps no session. Each request is forwarded and forgotten.
• Your browser may also talk to a public Robinhood Chain node directly for head state. That node is a third party with its own policies.

Poncho is deployed on Vercel, which runs the servers. Vercel keeps its own operational request logs as any host does. That is outside Poncho's control and is covered by Vercel's own policy.

The chain is public

Everything that settles on Poncho is written to Robinhood Chain: the payer, the agent key, the provider, the service, the route, the amount and the fee. That is the point, because it is what makes a receipt auditable. It is also permanent and readable by anyone, including people who are not using this site.

Poncho cannot delete, hide or amend anything on the chain, and neither can we. Treat an address as public the moment it settles a note.

What a provider sees

When your agent calls a provider's endpoint, that call goes to the provider, not to Poncho. The provider sees whatever your agent sends it, including the signed note. What the provider does with the request is between you and the provider, and their own terms and privacy policy apply. Poncho is the payment rail, not the request path.

Cookies and tracking

There are none. No cookies are set, no analytics script runs, no pixel loads, and nothing is fetched from another origin: every font, icon, image and script on this site is served from poncho.cash. The content security policy in vercel.json allows this origin and the two Robinhood Chain RPC hosts, and nothing else.

Children

Poncho is not directed at children and is not intended for anyone under 18.

Changes

If this page changes, the new version replaces this one at this address. There is no mailing list to notify, because there is no mailing list.

Contact

Questions go to hello@poncho.cash.

Checked against this release on 23 Sep 2026 .