axmc Privacy policy
What this deployment keeps about the people who use it, where, and for how long. Written for the venues, curators and operators who use axmc.xyz, app.axmc.xyz, admin.axmc.xyz and api.axmc.xyz, and kept short because the honest answer is short: almost everything you do here is on a public blockchain, and almost everything that is not is an email address you chose to give.
Last revised 12 October 2026. The operator of this deployment is named on the contact page.
What is public by design
Everything the protocol does happens on Solana. A market, a question, an answer, a bond, a vote, a ruling and a payout are transactions signed by a wallet, and they are visible to anyone with a node, forever. The app and the indexer only read and display them. If you connect a wallet and act, that wallet's history is public, and nothing here can make it otherwise.
Evidence posted to the indexer (POST /evidence) is public by the same design: it is content-addressed, it is what a dispute cites, and anyone holding the hash can read it. Do not post anything you would not put on chain.
What the services keep that is not on chain
| What | Where | Why | How long |
|---|---|---|---|
| The email, market name, website, contact handle and note you type when registering a market | The indexer's creator queue, on the VM's volume | So an operator can read your registration, mail you the confirmation, and send you sign-in codes | Until the operator removes the row. A rejected row is kept, with the reason, so the same venue writing back is recognised |
| A wallet bound under the sign-in links used before October 2026, and the venue account registered when you were approved | The same row | So the app knows which venue is yours | As above |
| An operator's email address | ADMIN_EMAILS on the VM, and the dashboard's session file |
The operator dashboard is behind a code mailed to that address | Sessions expire after twelve hours; the list is the operator's own configuration |
| A message you send from the contact form | A file on the VM, the operator's alert channel, and their inbox when mail is configured | So the operator can answer you | Until the operator deletes it |
| A browser error report | A file on the VM, and one line in the alert channel | So a broken page is fixed before the next person hits it | Rotated when the file passes eight megabytes |
| Webhook and notification URLs you register | The indexer's and notifier's files | To call them when something happens | Until you delete the registration with its token |
| The email, topics and markets you give the desk to hear about questions | The notifier's file, and the mail provider when one is sent | To mail you a code, then one mail per question that opens in what you follow | Until you stop it from the link in any mail, or delete it with its token |
The services never store your IP address or your user agent. Rate limiting uses the address while the process runs and forgets it when it restarts.
Analytics, and how to opt out
The app sends one small beacon per page and per named step (filed a registration, bound a wallet, signed in, sent a transaction) to the indexer, which counts them per day. The beacon carries the page path without its query string, the hostname, and the step's name. It never carries a wallet address, an email, or anything typed into a form.
"Distinct visitors" on the operator's dashboard is a count of salted hashes that are minted when the service starts and cannot be reversed or joined across days. No cookie is set and no third party receives anything.
If your browser sends Do Not Track or Global Privacy Control, the app sends no beacons at all.
Who else sees anything
- Your RPC provider. The app reads the chain through the endpoint configured in the build or the one you set yourself; that provider sees the requests your browser makes, as any website's host does.
- The mail provider, when the operator has configured one, sees the addresses the services mail: the operator's own, and the address on a registration. The operator can run SMTP against a mailbox they control instead; the choice is theirs and is documented in Deploying.
- The wallet you connect is software you chose, and what it shares is governed by its own policy.
- Google Fonts serves the two typefaces the pages use, and sees the request for them.
Nothing is sold, shared for advertising, or joined with any other dataset.
Your choices
- Register with an address you are happy for an operator to see, or contact the operator and ask them to remove the row. They can delete it from the dashboard.
- Delete a webhook or a notification subscription with the token it returned, at any time. An email subscription also stops from the link at the foot of every mail.
- Clear the app's remembered endpoint and the reveal secrets it holds for your committed ballots by clearing this site's storage in your browser. The reveal secret for a ballot lives only in the browser that committed it; clearing it before you reveal forfeits that ballot's reveal, so read Participating first.
- Use a wallet you created for this purpose. The chain does not forget.
Changes
This page is in the repository and every change to it is a commit. The date at the top is the last one.
Source: docs/PRIVACY.md in the axmc repo. Edit the file; the next deploy rebuilds this page.