This gateway currently settles on the base-sepolia testnet; the on-chain visibility described in section 2 applies to testnet transactions today and to mainnet transactions when live.

ffpipe Privacy Policy

Last updated: 2026-09-30. This policy covers ffpipe, the machine-payable media-processing API operated by VidDay Media Inc. ("VidDay", "we", "us") of 772 St. Joseph Street, Winnipeg, Manitoba, R2H 3A7, Canada. It is the ffpipe-specific companion to the VidDay Privacy Policy, which governs the vidday.com sites and services; where you use both, each policy governs the service it names. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

ffpipe can be paid for in two ways, and what we know about you depends on which one you use:

x402 (wallet) payments. Each job is paid in USDC by a wallet signature. On this track there are no accounts, no registration and no profiles. We do not ask who you are, and in most cases we could not identify you if we tried.
Prepaid credits (accounts). You sign in with an email address, buy credits by card or claim the free monthly credits, and connect an application such as Claude to spend them. This track has an account, and the account holds an email address and a purchase history.

What follows describes the little we collect on each track, why, and what happens to it.

1. What we collect

Whichever track pays, when you (or software acting for you) call the API, we collect:

Technical information: the IP address a request came from, request timestamps, job parameters (dimensions, presets, source URLs you supply), job identifiers, and error messages.
Your media, transiently: the source file you point us at or upload, and the converted result. We process media solely to perform the job you paid for and to investigate suspected abuse. We do not sell it, mine it, or use it to train models.
Feedback you choose to send: if you use the feedback endpoint (or the equivalent tool) to request a capability, report a bug or tell us anything else, we keep exactly what you submitted — your message, the type, the job id you referenced if any, the contact you supplied if any, and the IP it came from — so we can act on it and see what callers are asking for. Sending it is entirely optional and nothing about it is required to use the service.

On the x402 track, we also collect:

Payment information: the wallet address that signs each payment, the amounts, and the on-chain settlement transaction references. We never see or hold your private keys.

On the x402 track we do not collect names, email addresses, phone numbers or payment-card details — it has nowhere to put them, and the only place you can volunteer a contact is the optional feedback field above.

On the credits track, your account holds:

Your email address, which is your sign-in and the only personal identifier the account stores.
Your purchase and ledger history: every credit pack you buy, every free-credit top-up, every job your credits paid for (with its job id) and every refund, each with its amount and time. Your balance is calculated from this history.
Your Stripe customer id, which links the account to the customer record our payment processor keeps for it.
Whether a card is on file, recorded as the card's Stripe fingerprint (see below).
Connections to applications you authorize (see "Connected applications" below).

Job records for jobs your credits paid for carry your account id where an x402 job would carry a wallet address.

We never see your card number. Card payments and card saving happen on a checkout page hosted by Stripe, our payment processor, which collects and processes your card details under its own privacy policy and legal obligations. We receive from Stripe only what we need to credit your account — the customer id, the amount paid and, when you save a card, the card's fingerprint: an opaque identifier Stripe assigns to a physical card, not a card number, expiry date or any part of one. We use the fingerprint for one purpose only: to enforce one free tier per card. Stripe keeps your email address and saved card with the customer record.

Sign-in emails. We sign you in by emailing you a one-time link. Those emails are delivered by SendGrid, our email delivery provider, which receives your email address and the message for that purpose. We send only sign-in emails; we do not send marketing email.

Connected applications. When you connect an application (for example Claude) to your account, you approve a grant for the access it asked for — reading your balance and buying credits, and/or submitting jobs that spend your credits. We record the grant: which application it is, the access granted, when it was granted, and your account id and email address, stored encrypted with it. An application you connect can see your email address, your balance and whether a card is on file, and — if you granted it job access — spend your credits.

If you email us (for example an abuse report or a billing question), we collect what you send.

2. The blockchain is public — and permanent

This section applies to x402 payments only. Credit purchases are card payments and are not recorded on a blockchain.

Payments are made in USDC on a public blockchain. This has privacy consequences no policy can change, so be aware of them:

Every payment you make to ffpipe is publicly visible, forever, on the blockchain: your wallet address, our address, the amount and the time. Anyone can view it with a block explorer.
We do not control the blockchain and cannot delete, amend or hide anything recorded on it. Deletion rights under privacy law cannot apply to a decentralized public ledger.
Wallet addresses are pseudonymous, not anonymous. If you link your wallet to your identity elsewhere, your ffpipe payment history is linkable too. If that matters to you, use a wallet dedicated to this service.
Payment verification and settlement are performed by a third-party facilitator (Coinbase Developer Platform), which processes the payment authorization your wallet signs — including your wallet address — under its own privacy policy and legal obligations (including sanctions screening).

3. Why we collect it

We use the information above only to: run the job you paid for; deliver the result to whoever holds the job's access token; operate, secure and rate-limit the service (abuse prevention, per-payer limits, settlement-failure containment); investigate suspected abuse or fraud; comply with legal obligations, including mandatory reporting of child sexual abuse and exploitation material; and produce internal, aggregate operational statistics (counts and revenue totals that identify no one); and — for feedback you choose to send — to reply if you left a contact and to decide what to build next. On the credits track we also use your account information to sign you in, keep your balance, sell you credits and grant free credits, enforce one free tier per card, process refunds, answer billing questions, and keep the financial records tax and accounting rules require. We do not use it for marketing, we do not build profiles, and we do not sell personal information.

4. Disclosure

We disclose information only: to our third-party service providers (network and edge services, computing, storage, email delivery and payment processing — including the Coinbase Developer Platform, whose facilitator processes every x402 payment, Stripe, which processes every card payment and saved card, and SendGrid, which delivers sign-in emails), each only what its role requires; to the applications you connect to your account, as section 1 describes; where required by law, including reports under the Act respecting the mandatory reporting of Internet child sexual abuse and exploitation material by persons who provide an Internet service to Cybertip.ca and law enforcement, and preservation of related records for the statutory period; and where you direct or consent to it. Result and status URLs are disclosed to whoever presents the job's access token — guard your tokens.

5. International transfers

ffpipe runs on third-party infrastructure located in Canada and the United States, and on a globally distributed edge network; our payment processor and email delivery provider also process information in the United States. Information stored or processed outside your country of residence is subject to the laws of the country where it is held, and may be accessible to that country's authorities under those laws. Our contracts with these providers include confidentiality and data-protection safeguards, and our practices remain governed by this policy wherever the data sits.

6. Retention — short by design

Source media: deleted at every job's terminal state, with a 7-day automated backstop. Never kept longer than 7 days.
Results: guaranteed available for 24 hours after completion; deleted no later than 7 days after completion.
Job metadata (wallet address or account id, IP, parameters, timestamps, errors): kept up to 30 days for operations, billing forensics and abuse investigation, then expires.
Abuse-control records (rate counters, retry vouchers): expire automatically within 48 hours to 30 days of creation.
Feedback you send us: kept up to 90 days, then expires automatically. We keep it that long so that requests can be counted and compared over a quarter rather than read once and forgotten.
Sign-in links: each link works once and expires 15 minutes after it is sent. Until you click it, the pending sign-in (your email address and the application you were connecting) is held for those 15 minutes and then expires; an account is created only when a link is clicked.
Account-page sessions: clicking a sign-in link for the account page signs that browser in for 12 hours. The session is a signed cookie; we keep no copy of it, and signing out removes it.
Connected applications: an application's access token lasts one hour, and the application can renew it; the connection itself lasts up to 30 days from when you approved it, after which the application must ask you to sign in again. Connecting the same application again replaces its earlier connection.
Your account: kept while it is open. You can close it at any time from the account page (/account). Closing it: erases your email address (it is replaced with a placeholder that identifies no one); revokes every connected application's access; asks Stripe to delete your customer record there, which removes your saved card and the email address Stripe holds for us; and signs you out. Closing it keeps, without your email address: the closed account record (its internal id and closing date); your Stripe customer id, so a later refund can still be traced; your ledger and purchase records, which we keep for tax and refund purposes; and your card's fingerprint, so a card that has had its free tier cannot claim another (one card, one free tier, permanently). Stripe keeps its own records of the payments you made, under its legal obligations. Revoking connections and deleting the Stripe record are completed on a best-effort basis at the time you close; if either does not go through, write to us and we will complete it. You can sign up again later with the same email address; that creates a new account with a zero balance.
Exception: records subject to a legal hold — including statutory preservation for a mandatory report — are kept for the period the law requires, then destroyed.
The blockchain: as section 2 explains, on-chain payment records are permanent and outside our control.

7. Safeguards

We protect the information we hold with technical measures (encryption in transit everywhere; encrypted storage; scoped, revocable credentials between every component; HMAC-gated access tokens; single-use, short-lived sign-in links; signed, secure-only session cookies; secrets management), administrative measures (least-privilege access, documented abuse and legal-hold procedures) and the structural safeguard of simply holding very little for very long — card details never reach our systems at all. No security is absolute; we design so that what a breach could expose is small and short-lived.

8. Children

ffpipe is a developer- and machine-facing service, not directed at minors, and processing media that sexually victimizes children is prohibited, reported and permanently banned wherever we detect it (see the Terms of Service).

9. Your rights: access, correction, deletion, withdrawal

You may ask what personal information we hold about you, ask us to correct it, ask us to delete it, or withdraw consent to further collection. Send access, correction and deletion requests to ffpipe@vidday.com. Requests are answered within a reasonable time and at no cost, subject to the legal exceptions PIPEDA provides (for example where records are part of an investigation or legal hold, where we must keep financial records, or where data has already been irreversibly deleted on schedule). How we confirm the request is yours depends on the track:

x402 (wallet) payments. Withdrawing consent simply means ceasing to use the service — nothing about past on-chain payments can be withdrawn. One honest caveat: because this track is pseudonymous, we usually cannot link data to a person — so for any request concerning a wallet's records, we require proof you control that wallet (signing a message we specify with the wallet's key), which is the same proof the protocol itself uses.
Credits accounts. We confirm a request is yours by having you sign in to the account, or by your writing to us from (or replying to us at) the account's email address. Once signed in, the account page shows your balance and purchase history, and lets you close the account yourself. Deletion means closing the account, with the effects and the retained records section 6 describes.

10. Contact and complaints

VidDay Privacy Officer — Mailing address: 772 St. Joseph Street, Winnipeg MB, R2H 3A7 Canada. Email: ffpipe@vidday.com (privacy matters, access and deletion requests, and billing) or abuse@vidday.com (service abuse and takedowns only — include the job id).

We investigate all complaints about our handling of personal information and will tell you the outcome; justified complaints lead to corrective measures. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

11. Changes

We may update this policy; the current version is always at /privacy, and the "last updated" date above changes with it. Material changes take effect when posted. Continued use of the service after a change means you accept it.