Plain-language summary of what MentionForge stores in Cloudflare D1, Analytics Engine, and Cache API; how on-chain x402 payments work; and what Stripe collects if you subscribe to an API key plan.
Free trial and pay-per-call use need no account, sign-up, password, or tracking cookies. If you subscribe to an API key plan, Stripe (our payment processor) collects your email address and payment details under Stripe’s privacy policy. MentionForge does not receive card numbers. Stripe emails receipts and invoices to the subscriber.
trial_walletsWhen a caller sends the X-Wallet header to use the 10-call free trial, the Worker stores the lowercased wallet address (wallet), the number of trial calls used (used, up to 10), and the last update timestamp (updated_at).
idempotencyWhen a paid or trial call includes an Idempotency-Key header, the Worker stores the key, a SHA-256 hash of the canonical request body (body_hash), status, the JSON response, billing metadata (amount_usdc, tx_hash, free_trial), and created_at. Entries expire after 24 hours and are deleted on lookup after expiry.
stats_dailyThe Worker records daily aggregate totals (day, calls, paid, usdc_micros, errors, trial). No wallet addresses, IP addresses, or raw query strings are stored in this table.
x_id_usageThe Worker records daily counts (day, ids) of disclosed mention and post IDs over a rolling 30-day window to enforce the global 30-day quota.
In plain words: if you subscribe, we keep a fingerprint (hash) of your API key, your Stripe customer and subscription IDs, billing dates and how many calls you’ve used. We never see your card number.
api_keysIf you subscribe to an API key plan, the Worker stores a SHA-256 hash of your API key (key_hash; the plain key is shown once on the claim page and is not retained after claim), Stripe customer ID (stripe_customer_id), Stripe subscription ID (stripe_subscription_id), plan status (status), billing-period dates (period_start, period_end), row creation time (created_at), Checkout session ID (checkout_session_id), whether the key has been claimed (claimed), and a temporary pending_key that is cleared after claim.
plan_usagePer-key usage counts for quota: API key hash (key_hash), billing period start (period_start), and calls used in that period (calls).
stripe_eventsWebhook event IDs (event_id) and receive timestamps (received_at) so the same Stripe event is not applied twice. This table does not store email addresses or card numbers.
Analytics Engine (METRICS): On completed or errored research calls, the Worker writes an event kind (paid, trial, or error), the UTC date, a SHA-256 hash of the normalized query string (not the raw query text), a count of 1, and usdc_micros.
Cloudflare Cache API: Research responses (excluding billing metadata, request_id, and latency) are cached by a SHA-256 hash of the query parameters for 10 minutes (24h timeframe), 30 minutes (7d timeframe), or 2 hours (30d or custom timeframe).
Rate limiting and logs: Cloudflare rate limiters key on wallet address (for paid and trial requests) or client IP address (cf-connecting-ip for unpaid and discovery requests) over 60-second windows. Structured operational logs record request_id and status codes and never log payment signatures or secrets.
Paid calls settle $0.02 USDC per call on Base (or Base Sepolia on staging) via the configured x402 facilitator. Blockchain transactions, wallet addresses, and transaction hashes (tx_hash) are permanently public on the Base blockchain.
Rows in api_keys and plan_usage are kept while the subscription exists and afterwards until you ask us to delete them via /support. MentionForge does not automatically delete those rows when a subscription ends. Stripe keeps its own payment records under its policy; deleting our rows does not delete Stripe’s.
Data requests (access or deletion): /support or harbor-ops@mail.grokbot.com.
Questions or bug reports: https://github.com/EnkiduHub/MentionForge/issues.