Privacy
Privacy
TOLLA stores little: an email if you join the waitlist, a wallet address if you sign in, and a record of each paid attempt through Booth. The site loads no analytics or advertising scripts, and Pass never sends us your key.
In force from 8 Nov 2026. The rules for using the service are on the Terms page.
What we store
Waitlist
Your email address, the role you picked (building agents or selling an API), the time you joined, your browser's user agent text and a salted hash of your IP address. We keep the hash, not the address, and use it to limit abuse. We send one confirmation email through Resend when you join.
Wallet sign-in and Booth
When you sign in with your wallet we store the address you signed with and a session. The session lives in an httpOnly cookie for 7 days, or until you sign out. For a booth we store its name, description, the HTTPS address of your API, the method and the price.
Tolls and receipts
For each paid attempt through Booth we store the booth, the payer and merchant addresses, the amount, the outcome, the API's response status, how long it took, the transaction hash and which facilitator handled it. We do not store request or response bodies.
Security and operations
To rate-limit requests we keep short-lived counters keyed by the salted IP hash. The Status page keeps its own checks for 8 days. Cloudflare, which hosts the site, processes every request and keeps its own operational logs.
What the site does not do
No analytics, no advertising, no tracking pixels. The only cookie is the sign-in session. The waitlist form loads Cloudflare Turnstile to check that you are not a bot.
Pass
Pass runs on your computer. Your signing key and spend caps stay in a folder there, and the key is encrypted. Pass sends a payment signature to the merchant API you call, reads your balance from a Robinhood Chain RPC (the public one unless you set another) and reads the public Lanes index from this site. It sends us nothing else.
What is public
Receipts are public by design. Anyone with a receipt link can see the payer and merchant addresses, the amount, the outcome and the transaction. Totals appear on Scan. The transfers themselves are on Robinhood Chain and visible to everyone.
Plates shows public data from the ERC-8004 registries and the cards agents publish. Agent pictures are fetched and served by TOLLA, so your browser does not contact the agent's host.
Who else sees it
- Cloudflare hosts the site and the database, and runs Turnstile.
- Resend sends the waitlist confirmation, so it sees your email address.
- The payment facilitators (Elsa and Ultravioleta DAO) receive the signed payment, including the payer address, when a toll is verified and settled.
- RPC providers answer our reads of Robinhood Chain. Those reads contain public addresses and block numbers, not your email.
- A merchant receives the payer's wallet address and a receipt id with each paid call.
We do not sell personal data.
How long we keep it
- Waitlist rows: until you ask us to delete them.
- Sessions: 7 days, or until you sign out.
- Rate-limit counters: until their window ends, then they are swept.
- Status checks: 8 days.
- Booths: until we remove them. Merchants can pause a booth but not delete it yet. Receipts for paid attempts stay as a public record, and on-chain transfers cannot be removed.
Your choices
To have your waitlist email deleted, message @useTOLLA on X and tell us the address. Signing out ends your session right away. You can pause a booth at any time from the Booth page.
Changes and contact
When what we store changes, we will update this page and its date. Questions about your data: message @useTOLLA on X.