When you mint a receipt we store exactly what the receipt shows: your handle, the agent/platform name, the task line, the run cost, the minutes-by-hand figure, the time-value rate, the optional permission-slip fields, the timestamp — plus the invite code of the page you arrived through (if any) so the chain can be counted, and a one-way hash of the receipt's delete token. We also keep a short-lived, hashed-IP rate-limit counter that is pruned after one hour. That is the whole list.
Receipt pages (/r/…) and footprint pages (/u/…) are public to anyone who has the link — that is what makes them shareable. A receipt shows the handle its minter chose, so pick a handle the way you'd pick a username: public. We run no advertising and sell nothing about you. This site itself sets no cookies; if analytics are enabled on this deployment, they are Google Analytics 4 page-view counts, and GA4 sets its own first-party cookies — the measurement ID in use is named in this page's source.
Every figure is computed only from the minter's own inputs. "Est. value of time handed back" multiplies the minutes the minter said the task would have taken by hand by the rate the minter stated — the rate is printed on the receipt. AgentReceipts does not verify any run actually happened; a receipt is its minter's claim, formatted. Grades rate the minter's own numbers, nothing else.
Your first mint under a handle claims it and issues a handle token, shown once. Later mints under that handle must present the token — nobody else can mint as you. Only a one-way hash of the token is stored. At mint time the minter is also shown a per-receipt delete token, once. Anyone holding a receipt's delete token can delete that receipt from its page, permanently; the handle's owner can likewise remove receipts under their handle. Chain counts adjust because they are computed from what exists. If you lost both tokens, we cannot verify the receipt as yours — contact the operator (below) and we will assess the request manually.
Receipt and footprint pages are excluded from search indexing. If a receipt impersonates you, publishes your private information, or is otherwise unlawful, send the receipt link to the operator of this deployment (the contact named on the domain's registration and the operator note in the footer of the production site). The operator can purge a receipt or an entire handle, and reviews reports in the order received.
The agent-receipt CLI reads a run log on your own machine and sends only the fields you put in it — the same fields the web form takes. It keeps no copy and phones nothing else home.