What this implementation handles.

Information handled by the hosted service

When a verification request is made, the endpoint receives the transaction hash, network, expected MCRT amount, currency, and an optional merchant invoice or plan reference. It queries fixed BNB Chain RPC providers with the transaction hash to inspect public on-chain receipt data. Successful hosted verifications are written to the application log with the normalized transaction hash, amount, optional plan reference, and verification time.

The service also requests MCRT price data from CoinGecko and, if needed, DexScreener. Those requests originate from the service. The application code does not include an analytics tracker, advertising tracker, account registration, or payment-card collection feature.

Browser storage and merchant endpoints

The setup page stores a wallet address, amount, invoice identifier, and merchant endpoint path in the browser’s local storage so a visitor can reuse a generated snippet. Use “Clear saved details” on the widget builder to remove those values, or use your browser’s site-data controls. The main MCRTPay widget does not itself create browser storage in this implementation.

A merchant chooses the widget’s verification endpoint. The widget sends the payment verification fields to that endpoint. If the merchant configures a different endpoint or explicitly enables a cross-origin endpoint, that merchant’s privacy notice and systems govern the information sent there.

Public blockchain data

Blockchain addresses, transaction hashes, amounts, and related transaction information can be public and may remain visible on the BNB Chain and blockchain explorers independently of MCRTPay. Do not place personal or confidential information in a transaction, invoice reference, or public report.

Retention and sharing

This repository does not implement an account database or a user-profile retention system. Hosting access logs may include IP addresses, request paths, browser identifiers and timestamps. Application logs and hosting access logs may be retained by the operator or hosting provider under their operational settings. The endpoint shares the submitted transaction hash with the configured BNB Chain RPC provider to perform verification; price requests are sent to the named price providers. Information may also be disclosed where required by applicable law or to protect the service from abuse.

Your choices and reports

You can avoid using the setup page, clear local site data, and choose whether to submit a transaction hash. For non-sensitive software issues, use the official MagicCraft contact page. Do not submit private keys, seed phrases, passwords, API keys, or personal data in a public report.