Privacy Notice
Effective date: 10 November 2026
Data controller: Histodex
Privacy contact: contact@histodex.xyz
This global privacy notice explains how Histodex processes personal data under applicable data protection laws, including the GDPR for EU/EEA/UK visitors. It is an information notice, not consent by itself. Cookie choices are described in the Cookie Notice.
1. Who we are
Histodex operates https://histodex.xyz, a Solana world-history NFT archive (Bitcoin Genesis chapter). The controller is Histodex. Contact us only by email at the address above.
2. What we collect (site scan baseline — 10 Nov 2026; aligned with dashboard ownership)
Observed / planned for the Site:
| Category | Examples | Notes |
|---|---|---|
| Technical (hosting / CDN) | IP address, user-agent, and similar connection data processed by the hosting or CDN provider (for example Cloudflare) | Used for page delivery, DDoS/security, and abuse prevention. Histodex does not keep its own wallet-address or IP access logs for the ownership API; see §6. |
| Wallet (in browser) | Public Solana address when you click CONNECT (Phantom, Solflare, Backpack, etc.) | Used in the browser to request a public ownership/album check. The album / holdings view is read from public on-chain data through our server proxy — no wallet signature is required for that album view. |
| Signatures (future features only) | The Site does not request any wallet signature in v1. If a future feature (for example a Sign-In with Solana session for personal off-chain activity) needs one, we will describe it here before enabling it. | Not used in v1, including the album / Genesis badge ownership check. You initiate any signature in your wallet. |
| Client storage | Browser sessionStorage used for scroll restoration (app framework); wallet adapters may store their own “last wallet” preference |
Strictly functional. Histodex does not write your wallet address into localStorage. |
| Third-party loads | Google Fonts (fonts.googleapis.com); Grok App Builder extensions.js on grok.com host paths |
May process connection data under their policies |
| External links | Magic Eden marketplace links | Their sites have separate policies |
Not observed as first-party analytics in the scanned build: Google Analytics, Meta Pixel, Mixpanel, Hotjar, Plausible, PostHog, or similar trackers. If we add any later, we will update this notice and require opt-in where required.
Planned / future features (when enabled): email for account/magic-link login; forum posts; event-chat messages; puzzle answers; curation points ledger; SIWS session (signature required only then); gift-claim allowlists (wallet on Merkle leaf — no email on-chain).
We do not intentionally collect special-category data (health, politics, religion, biometrics, etc.).
3. Purposes and legal bases
| Purpose | Typical legal bases (GDPR Art. 6 / equivalent local bases) |
|---|---|
| Operate and secure the Site | Contract; legitimate interests; legal obligation |
| Wallet connect & on-chain UX | Contract; legitimate interests |
| Accounts, forum, chat, puzzles | Contract; consent where required |
| Curation points & gift eligibility | Contract; legitimate interests; anti-abuse |
| Email event reminders (opt-in only) | Consent |
| Non-essential cookies / analytics | Consent; applicable cookie / ePrivacy rules |
| Sanctions / age / ToS enforcement | Legal obligation; legitimate interests |
| Defend legal claims | Legitimate interests; establishment, exercise, or defence of legal claims |
Children: no accounts under 13; wallet/claim 18+. See Terms.
4. Recipients
- Hosting, CDN, email, and community-tool processors under contracts, solely to run the Site (a hosting / CDN provider may process IP addresses and related technical data for delivery and security).
- A blockchain RPC / data indexing provider (DAS or equivalent): when you check album / ownership, our server may query that provider with the public wallet address you connected. At the provider’s end, the query may also involve technical request data such as IP addresses of the systems that call the provider (typically our server/proxy). The provider is an unnamed processor/recipient category until a specific vendor is chosen; we do not send seed phrases or private keys.
- Solana validators / public blockchain (wallet address and tx data become public and immutable).
- Marketplaces you choose to use (independent controllers).
- Competent authorities where required by applicable law.
5. Collection method
Data is collected directly from you (forms, wallet connect, posts you submit) and, where needed, through necessary client storage and our server-side ownership proxy. Hosting / CDN infrastructure may process connection metadata automatically to deliver the Site.
6. Retention
| Data | Default retention |
|---|---|
| Ownership / API operational metrics | Aggregate counters only (request counts, state distribution, error types). Histodex does not retain wallet-address or IP pairings in application logs for /api/ownership (per dashboard). |
| Hosting / CDN edge logs | Controlled by the hosting or CDN provider under its own settings (delivery and security). Not the same as Histodex application logs. |
| Event-chat messages | 90 days (when that feature exists) |
| Moderation action logs | 1 year (when that feature exists) |
| Forum posts | Until you delete / account closure, subject to legal holds |
| Email for reminders | Until you unsubscribe + short suppression period |
| Points ledger & claim eligibility records | For the relevant season and up to 2 years afterward for dispute/anti-fraud review |
| On-chain data | Cannot be deleted by Histodex; we disclose this in UI where relevant |
We keep personal data only as long as needed for the purposes above (storage limitation under GDPR Art. 5(1)(e) and equivalent local rules).
7. Cross-border transfers
If personal data is transferred to another country, we use appropriate safeguards required by applicable law. These may include an adequacy decision, standard contractual clauses (or equivalent standard contracts), binding corporate rules, or other lawful transfer tools.
8. Wallet addresses as personal data
A Solana public key linked to you (via CONNECT, SIWS, or email) is treated as personal data. Public chain records remain visible forever even if we delete off-chain links.
9. Your rights
Depending on applicable law, you may have the right to: access; rectification; erasure; restriction; portability; object to processing; withdraw consent; and lodge a complaint with your local data protection authority.
Under the GDPR (where it applies): access, rectification, erasure, restriction, portability, objection, withdraw consent, and complaint to an EU/EEA supervisory authority (see the EDPB member list).
How to exercise: email contact@histodex.xyz. We may need to verify you. We aim to respond within the timelines required by applicable law (often within one month under the GDPR).
10. Security
We apply technical and organisational measures under GDPR Art. 32 and equivalent local rules, appropriate to risk (access control, least privilege, TLS in transit where configured by host). No method is 100% secure.
11. Children
We do not knowingly collect personal data from children under 13. Contact us to delete if you believe we have.
12. Cookies
See Cookie Notice. Non-essential cookies require opt-in under applicable cookie / ePrivacy rules.
13. Changes
We will post updates with a new effective date. Material changes affecting consent-based processing will seek fresh consent where required.