bgcheck is run by the luna9 org (2050.to). This page says plainly what we collect, why, and what we never touch. Questions: bgcheck@luna9.space.

What we store

• What you paste. The facts you enter, your question, and the report we generate, kept so your history works and identical resubmits return the same run instead of charging twice.
• Email — only if you sign in. Magic-link sign-in uses your email address to deliver the link and to own your run history. No password, no profile, nothing else.
• Payment linkage. For card payments: the Stripe Checkout session id. For crypto: the rail and payment reference (transaction hash or balance change) — enough to prove a run was paid.
• Hashed wallet identity (free tier only). If you verify a LUNA9 balance for free runs, we store only HMAC-SHA256(secret, address) — an opaque tag that rate-limits your wallet. Your wallet address is never stored in plaintext, anywhere.

What we never store

• Plaintext wallet addresses (hash-only, see above).
• Payment-method data — cards are handled entirely by Stripe.
• IP addresses. Rate limiting uses hashed identities and short-lived counters.

Who else sees what

• Stripe processes card payments and holds your payment details under its own policy. We never see your card.
• Resend delivers the sign-in email.
• AI providers (search and model services) receive the intake you submit in order to produce the report.
• Blockchain RPC providers see only public chain queries — token balance checks and invoice matches. These reveal nothing about you: the wallet signature happens in your browser and we store only the hash.
• Crypto payments go straight to our org wallet. No third-party payment processor sits in that path, so no email or account is collected from you on those rails.

Deletion

Email bgcheck@luna9.space from your signed-in address and we delete your runs and email. Ask for the whole account and it is gone — there is little to delete by design.

Last changed: 2026-09-17.