Terms of service

what orangecheck does

OrangeCheck is a non-custodial tool that lets you:

• >>Create cryptographic proof-of-stake attestations using Bitcoin message signatures (BIP-322)
• >>Bind handles (Nostr, GitHub, Twitter, DNS) to attestations as self-asserted claims
• >>Publish attestations to decentralized Nostr relays (optional)
• >>Generate shareable badges that demonstrate control of Bitcoin addresses
• >>Discover and verify attestations created by others
• >>Share cryptographic proofs across platforms that choose to consume them

what orangecheck does not

• >>Take custody of your Bitcoin or private keys
• >>Broadcast transactions to the Bitcoin blockchain on your behalf
• >>Provide financial, investment, or legal advice
• >>Guarantee the accuracy of blockchain data from third-party sources
• >>Store your private keys or wallet information

non-custodial nature

You are solely responsible for your wallet, keys, device security, and what you sign. We cannot recover lost keys, reverse transactions, access your funds, or modify/delete badges once created.

what you are making public

• >>The Bitcoin address you sign with — linkable forever to every handle in the attestation
• >>`sats_bonded` — the public sat value of the UTXO(s), a public wealth signal
• >>`days_unspent` — how long the UTXO has been idle, a public cold-storage signal
• >>Every identifier in `identities:` — each becomes publicly and cryptographically linked to the address and to every other identifier in the same attestation
• >>The full history of the address — chain-analysis firms and anyone with a blockchain explorer can cluster and correlate your other holdings

specific risks you accept

• deanonymizationthe attestation binds your address to your handles. chain-analysis can then link your other addresses, counterparties, and spending patterns. you cannot un-bind once published.
• wealth advertisementsats_bonded is public. large bonds combined with real-name handles may make you a target for phishing, social engineering, theft, or physical coercion ("wrench attack"). we strongly recommend pseudonymous handles and modest bonds. you are solely responsible for your personal safety.
• cross-platform correlationbinding multiple handles in a single attestation creates a stronger tracking vector than any single handle alone. third parties may use this to dox or target you.
• fungibility losspublicly labeled utxos may be flagged by chain-analysis firms and treated differently by exchanges or compliance systems. this is a known property of transparent ledgers.
• irrevocabilityattestations published to nostr relays are distributed and replicated across independent third-party operators. orangecheck cannot delete, edit, or revoke nostr events. a soft "revocation event" exists in the protocol but does not remove data from any relay that has already stored it.
• key compromiseanyone with your keys can sign new attestations binding new handles to your address. we cannot revoke signatures. hardware wallets strongly recommended.
• handle spoofingthe identities: field is self-asserted. any user can claim any string. relying parties must verify handle ownership out-of-band. we do not verify handle ownership as part of attestation creation.

your representations

By creating or publishing an attestation, you represent and warrant that:

• >>You control the Bitcoin address being signed for
• >>You have read and understood the Security implications page at /docs/concepts/security
• >>You understand the public, permanent, irrevocable nature of what you are publishing
• >>You have made an independent decision to accept every risk listed above
• >>You are not relying on OrangeCheck for privacy, anonymity, personal safety, or any particular legal, regulatory, or business outcome
• >>You will only bind identities you control and will not impersonate, defame, or misrepresent any person
• >>You accept that relying parties (platforms, relays, integrators, airdrops) make their own independent decisions and OrangeCheck is not liable for those decisions

• >>You must be at least 13 (or the age of digital consent in your jurisdiction)
• >>You must have the legal capacity to enter into a binding contract
• >>You must not be prohibited from using the Service under applicable law
• >>You must comply with all applicable laws and regulations

Most of the Service is accessible without registration. No email, password, or personal information is required to create, publish, discover, or verify an attestation.

optional sign-in-with-bitcoin

An optional signed-challenge login (“Sign in with Bitcoin”) lets you open a session keyed to a Bitcoin address you have proven control of via BIP-322. A session is a server-side row plus an httpOnly + Secure + SameSite=Lax cookie. No password, no email. The session is revoked when you sign out, when the cookie expires (30-day Max-Age), or when we delete the row.

If you use sign-in, you are responsible for the security of the device and wallet you sign with. Anyone with your keys can open a session in your name. We cannot recover lost keys, revoke signatures, or intervene in a wallet-compromise scenario.

permitted

• >>Create attestations for addresses you control
• >>Bind identities you control to your attestations
• >>Publish attestations to Nostr relays (optional)
• >>Discover and verify attestations created by others
• >>Share attestations and badges publicly or privately
• >>Integrate badges into your website or application (subject to these Terms)

prohibited — illegal

• >>Any unlawful purpose
• >>Violating any applicable laws or regulations
• >>Fraud, money laundering, or financial crimes
• >>Infringing intellectual property rights

prohibited — harmful

• >>Harass, threaten, or harm others
• >>Impersonate any person or entity
• >>Create attestations for addresses you do not control
• >>Bind identities you do not control to your attestations
• >>Misrepresent your identity or affiliation

prohibited — technical abuse

• >>Interfere with or disrupt the Service or servers
• >>Attempt unauthorized access
• >>Automated scraping or harvesting without permission
• >>Introduce viruses, malware, or malicious code
• >>Circumvent security features or rate limits

We reserve the right to investigate and take action against anyone who violates these prohibitions — including terminating access and reporting to law enforcement.

orangecheck's rights

The Service and its content (excluding user-generated content) are protected by copyright, trademark, patent, and other IP laws. This includes the OrangeCheck name, logo, branding, website design, software, code, algorithms, and documentation.

your license

Limited, non-exclusive, non-transferable, revocable license to access and use the Service for personal or commercial purposes, subject to these Terms. You may not sell, sublicense, or use the Service to create a competing product.

your content

You retain ownership of content you submit (badges, feedback, support requests). You grant us a worldwide, non-exclusive, royalty-free license to operate and improve the Service using your content. You are responsible for your content.

open source

Portions of OrangeCheck are released under open-source licenses. Those portions are governed by the applicable open-source license terms.

• blockchain dataattestation verification relies on third-party apis (mempool.space, esplora, blockstream.info, or your own node). we do not guarantee accuracy, availability, or completeness. verify critical info independently.
• nostr networkdecentralized relays operated by third parties. published data is replicated outside our control and may persist indefinitely. we cannot delete nostr events. you are solely responsible for what you publish.
• wallet softwarebrowser extensions, mobile, desktop, and hardware wallets are third-party software. we do not audit or endorse any wallet. a malicious wallet could sign something other than what is displayed. use only wallets you trust.
• hosting / analyticswe use vercel, plausible, and others — see the privacy policy for details.
• third-party linkswe provide links for convenience only and do not endorse third-party content.
• relying partiesplatforms, relays, airdrops, forums, and other integrators ("relying parties") independently decide whether and how to trust any orangecheck attestation. orangecheck is not a party to, and accepts no liability for, any decision a relying party makes based on an attestation — including admitting, rejecting, rate-limiting, banning, or paying a user.
• api / sdk consumerscalling /api/check, using @orangecheck/sdk, @orangecheck/gate, or any published package constitutes use of the service and is subject to these terms. the open-source packages are separately licensed under mit; these terms govern the hosted endpoints.

OrangeCheck is currently free to use. No fees for creating or verifying badges.

We reserve the right to introduce fees for certain features in the future with advance notice. Free features will remain free or be clearly grandfathered.

You are responsible for Bitcoin network fees (for any transactions you initiate), wallet-provider fees, and ISP fees.

Our collection and use of personal information is governed by our Privacy Policy. By using OrangeCheck, you consent to it and agree that:

• >>Attestation data is public by design and may be shared
• >>Identity bindings are public and verifiable by anyone
• >>Data published to Nostr is decentralized and may be permanent
• >>We may collect technical information as described
• >>We use privacy-preserving analytics

we make no promises

Without limiting the above, OrangeCheck expressly does NOT warrant or represent, and specifically disclaims any representation, that:

• >>The Service will be available, uninterrupted, timely, secure, or error-free
• >>The Service will meet your requirements or work with any particular setup
• >>Defects will be corrected, or that the Service is free from viruses, worms, trojan horses, or other harmful components
• >>Any attestation, badge, signature, or other output is accurate, valid, current, complete, non-expired, non-revoked, or recognized by any third party
• >>Any identity binding actually belongs to the person claiming it — bindings are self-asserted and platforms MUST verify out-of-band
• >>Nostr relays will accept, persist, replicate, or return your published attestations
• >>Bitcoin blockchain explorers or APIs (mempool.space, Esplora, etc.) will return accurate, current, or complete data
• >>Any wallet (UniSat, Xverse, Leather, Alby, Sparrow, Bitcoin Core, hardware, or otherwise) will sign correctly, handle keys safely, or be available at all
• >>Use of the Service will produce any particular business, legal, financial, or security outcome
• >>The Service, or any information obtained via the Service, will be suitable for any legal, financial, identity-verification, compliance, KYC, AML, or regulatory purpose whatsoever

not financial, legal, or compliance advice

Nothing provided by OrangeCheck — including attestations, metrics, scores, identity bindings, or any other output — is financial, investment, legal, tax, accounting, KYC, AML, sanctions, or regulatory compliance advice. OrangeCheck is not a licensed financial institution, money transmitter, broker-dealer, investment adviser, law firm, or regulated identity provider. You are solely responsible for obtaining independent professional advice before relying on the Service for any decision.

regulatory status · not a money services business

OrangeCheck does not transmit, transfer, exchange, convert, issue, redeem, custody, or take possession of any virtual currency, fiat currency, security, commodity, or other asset. The Service signs and verifies cryptographic messages; it does not move value. Accordingly, OrangeCheck does not consider itself, and does not hold itself out as:

• >>A Money Services Business (MSB), money transmitter, or money transferor under the U.S. Bank Secrecy Act (31 U.S.C. § 5330) or any U.S. state money-transmitter licensing regime
• >>A Virtual Asset Service Provider (VASP) under the FATF Recommendations or any implementing jurisdiction
• >>A Crypto-Asset Service Provider (CASP) under the EU Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114)
• >>A broker-dealer, securities exchange, or investment adviser under U.S. federal or state securities laws
• >>A payment institution, e-money institution, or electronic money issuer under PSD2, the UK Electronic Money Regulations, or equivalent
• >>A bank, trust company, or any other regulated financial institution
• >>A regulated identity provider, qualified trust service provider, or electronic identification scheme under eIDAS / eIDAS 2.0
• >>A KYC, AML, CTF, or sanctions-screening vendor

If your use case requires any of the above, OrangeCheck is not a substitute for a licensed, regulated provider. You must obtain independent licensed services for any legally regulated activity.

no custody, no control of keys or funds

OrangeCheck never takes custody of Bitcoin, private keys, seed phrases, recovery information, passwords, or any wallet credentials. We CANNOT and WILL NOT recover lost keys, reverse signatures, revoke published attestations, delete Nostr events, or retrieve funds sent to any address. Loss of your keys means permanent loss of access to the corresponding Bitcoin — that loss is entirely yours.

you use at your own risk

YOU ASSUME ALL RISK from your use of the Service. You are responsible for evaluating the accuracy, completeness, and usefulness of any output. You MUST verify anything load-bearing independently. Do not rely on a badge, attestation, score, or identity binding for any decision where the cost of being wrong is material to you.

beta, experimental & preview features

Features labeled “beta,” “experimental,” “preview,” or similar are provided for evaluation only with even fewer guarantees than the rest of the Service. They may break, be removed, change shape, or produce incorrect output at any time.

no direct damages

This exclusion covers, without limitation: direct, indirect, incidental, special, consequential, exemplary, punitive, reliance, cover, or any other damages of any kind; and loss of Bitcoin, sats, cryptocurrency, tokens, assets, funds, private keys, seed phrases, passwords, data, profits, revenue, goodwill, reputation, business opportunity, anticipated savings, or use.

hard cap

If, notwithstanding the above, a court of competent jurisdiction finds OrangeCheck liable to you for any reason, our aggregate liability for all claims arising out of or related to the Service or these Terms is capped at the greater of (a) US$50 or (b) the total amount you have actually paid OrangeCheck in the twelve (12) months immediately preceding the event giving rise to the claim — which, because the Service is currently free, is zero.

third parties are not our problem

OrangeCheck is not responsible or liable, directly or indirectly, for any loss, damage, or injury caused by or in connection with: wallet software (browser extensions, mobile wallets, desktop wallets, hardware wallets); Nostr relays and their operators; Bitcoin blockchain explorers and their APIs; internet service providers; any platform that chooses to consume or ignore an attestation; any person or entity impersonating, spoofing, or misusing an identity binding; any bug, fork, reorganization, fee market behaviour, or other characteristic of the Bitcoin blockchain itself.

essential purpose

The limitations in this section form an essential basis of the bargain between you and OrangeCheck. They apply even if any limited remedy is found to have failed of its essential purpose.

jurisdictional floor

Some jurisdictions do not allow the exclusion or limitation of certain warranties or damages. In those jurisdictions, the exclusions and limitations in these Terms apply to the maximum extent permitted by law, and the rest of these Terms remain fully enforceable.

You agree to indemnify, defend, and hold harmless OrangeCheck and its affiliates from any claims, liabilities, damages, losses, costs, and expenses (including reasonable attorneys' fees) arising from:

• >>Your use or misuse of the Service
• >>Your violation of these Terms
• >>Your violation of any law or regulation
• >>Your violation of any third-party rights
• >>Content you submit or share
• >>Your negligence or willful misconduct

Your right: stop using the Service at any time.

Our right: suspend or terminate access with or without cause or notice — including if you violate these Terms, pose a security/legal risk, or we discontinue the Service.

effect of termination

• >>Your right to use the Service immediately ceases
• >>We may delete your account and data (subject to legal requirements)
• >>Attestations you created may remain publicly accessible
• >>Data published to Nostr relays cannot be deleted by OrangeCheck
• >>Surviving sections: IP, disclaimers, liability, indemnification, law, disputes

to the service

We may modify, suspend, or discontinue the Service at any time with or without notice. We are not liable for any modification, suspension, or discontinuation.

to these terms

• >>We will update the "Last Updated" date
• >>For material changes, we will provide website/email notice
• >>Changes become effective when posted
• >>Continued use constitutes acceptance

informal resolution

Before filing a claim, contact us at hello@ochk.io to attempt to resolve the dispute informally.

arbitration · class-action waiver · jury waiver

• >>Administered by the American Arbitration Association under its then-current Commercial Arbitration Rules and Consumer Arbitration Rules (whichever applies)
• >>Seat of arbitration: Wilmington, Delaware, United States — or, at either party's election, conducted remotely by video
• >>Single neutral arbitrator
• >>Arbitrator's decision is final and binding; judgment may be entered in any court of competent jurisdiction
• >>The arbitrator — not any court — has exclusive authority to decide threshold questions of arbitrability, including validity and scope of this clause
• >>Each party bears its own attorneys' fees except where applicable law or the rules provide otherwise

exceptions to arbitration

• >>Small claims court actions (if eligible and filed on an individual basis)
• >>Injunctive or equitable relief to protect intellectual property, confidential information, or enforce these Terms
• >>Any claim that cannot lawfully be arbitrated under applicable law

one-year limit to bring claims

To the fullest extent permitted by law, any claim or cause of action you may have arising out of or relating to the Service or these Terms must be commenced within one (1) year after the claim or cause of action accrues. Otherwise the claim is permanently barred. This contractual limitations period replaces any longer statute of limitations that would otherwise apply, except where a shorter period applies by law.

opt-out of arbitration

You may opt out of this arbitration agreement by sending written notice to hello@ochk.io within 30 days of first using the Service. The notice must include your name, the date you first used the Service, and a clear statement that you wish to opt out. Opting out does not affect the class-action waiver, the jury-trial waiver, or any other provision of these Terms.

governing law

These Terms are governed by the laws of the State of Delaware, United States, without regard to conflict-of-law principles, and, where applicable, the U.S. Federal Arbitration Act (9 U.S.C. §§ 1–16). For users in the EEA, UK, or Switzerland, mandatory consumer-protection laws of your country of residence may apply and nothing in these Terms overrides those rights.

• entire agreementthese terms + privacy policy constitute the entire agreement and supersede any prior agreement on the same subject
• severabilityif any provision is found invalid or unenforceable, it is severed and the remainder of the terms remains in full force and effect
• waiverour failure to enforce any provision is not a waiver of our right to enforce it later
• assignmentyou may not assign these terms without our prior written consent; we may assign freely in connection with a merger, acquisition, or sale of assets
• no agencynothing in these terms creates a partnership, joint venture, employment, agency, or fiduciary relationship
• no third-party beneficiariesexcept as expressly stated, nothing in these terms confers rights on any person or entity other than you and us
• force majeurewe are not liable for delays or failures caused by events beyond our reasonable control, including acts of god, internet/network failures, nostr relay outages, bitcoin network conditions, government action, or pandemic
• noticesto you via email, the service, or the website; to us at hello@ochk.io
• electronic acceptanceyour use of the service constitutes electronic acceptance of these terms under applicable e-signature laws

sanctions, export controls, and prohibited jurisdictions

You represent and warrant that you are not, and are not acting on behalf of any person or entity that is:

• >>Located in, organized under the laws of, or ordinarily resident in any country or territory subject to comprehensive U.S., U.N., E.U., or U.K. sanctions (currently including Cuba, Iran, North Korea, Syria, and the Crimea, so-called Donetsk People's Republic, and so-called Luhansk People's Republic regions of Ukraine)
• >>Identified on the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) Specially Designated Nationals and Blocked Persons List, Consolidated Sanctions List, or any other U.S. government restricted-party list
• >>Identified on any U.K. HMT, E.U., U.N., or other applicable consolidated sanctions list
• >>Otherwise subject to any applicable sanctions, export-control, or anti-terrorism restriction that would prohibit your use of the Service

You agree to comply with all applicable U.S., E.U., U.K., and other export-control laws and regulations, including without limitation the U.S. Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR). You will not export, re-export, or transfer the Service, directly or indirectly, to any prohibited destination or person. A breach of this section is a material breach of these Terms.