| Record | Contents | Why kept | Retention (proposed) |
|---|---|---|---|
| Worker share records | Timestamp, payout address, worker name, share difficulty, result (valid / stale / rejected), job id, solving block hash if any | The input to every reward calculation. Lets a miner rerun the arithmetic. | 7 years from block date |
| Blocks discovered | Height, hash, coinbase txid, subsidy, fees, found time, matured time, status (pending / mature / orphaned) | The source of every reward. Reconciles to the public chain. | Permanent |
| Mining-reward calculations | Per block, per payout address: window bounds, share weight, gross, pool fee, net allocation; reversal records for orphans | Shows how each block's reward was apportioned. | 7 years |
| Payout transactions | Run time, txid, total, network fee; per output: payout address, amount, fee share, status | Shows that distributions equal mature allocations less network fee and went to the addresses that mined them. | 7 years |
| Payout addresses | Address, first and last seen, worker names used | The miner's identity in the system. No other identifier exists. | 7 years after last share |
| Pool fees taken | Per block: fee amount; per period: total fee income and the transactions moving it to cold storage | Shows the operator's compensation was exactly the published percentage. | 7 years |
| Configuration changes | Diff, author, time, approval; includes fee, threshold, window, maturity, and endpoint changes | Shows when the published parameters were in force. | 7 years |
| Notification registrations | Payout address, email, signed message, confirmation time, change history | Proves the email was registered by the address holder. | Until removed by the miner, then 90 days |
| Security events | Bans, floods, failed logins, certificate changes, admin sessions, signing-host access | Incident reconstruction. | 2 years |
| Compliance events | Gate decisions (country blocks), address-screening results, holds, releases, reason, actor | Shows the sanctions programme operated as written. | 5 years after the event (OFAC-aligned; confirm with counsel) |
01 Purpose
The records exist to answer one question at any later date: was this payment a distribution of a mined reward, calculated by the published method, to the address that did the work? For every payout, the chain of records runs: payout row → payout run → mature allocations → block → shares in the window. Each link is a stored row, and the chain can be walked by an auditor, an attorney, or the miner concerned.
Nothing is recorded to build a profile of a miner. The records describe mining, and the only person-like key in any of them is a payout address.
02 What is deliberately not collected
Never collected
- Names
- Government identification
- Phone numbers
- Postal addresses
- Bank or card details
- Private keys or recovery phrases (no field exists)
- Browsing analytics, fingerprints, or advertising identifiers
- Precise geolocation
Collected only if
- Email — only if a miner registers for notifications, and only the address given.
- IP address — seen at connection for rate limiting and the country-level sanctions gate; stored only as a country code in compliance events, and in short-lived security logs.
- Support correspondence — whatever a miner writes to support, kept for the ticket's life.
If a future feature would require any item in the left column, it goes through regulatory change control first — collecting identity data is a signal that the service is doing something other than mining.
03 Retention principles
- Mining and payout records are kept for as long as a tax or regulatory question about them could plausibly be asked — seven years is the working figure, to be confirmed by counsel.
- Block records are permanent because they are a subset of the public chain and cost nothing to keep.
- Anything that is not a mining record (emails, IP-derived country codes, security logs) is kept for the shortest period that still lets the service do its job, and is deleted on schedule by an automated job whose runs are themselves logged.
- Backups follow the same schedule; an expired record is not resurrected from a backup.
04 Access
| Who | Can read | How |
|---|---|---|
| Anyone | Blocks found, payout-run txids, pool-wide statistics, per-address hashrate and pending mining reward | Public stats API / dashboard, by address |
| The miner | Their own full share log and payout history as CSV | Dashboard export, by address (the data is already public per address; export is a convenience) |
| Operators | Everything above plus configuration, compliance, and security logs | Admin network only; access logged |
| Notification email | Readable only by the operators' notification system; never shown on the public dashboard | — |