Privacy

Last updated: 13 Nov 2026

This notice explains what personal data Mapixa (mapixa.gg and app.mapixa.gg) collects, why, who receives it, how long we keep it and what you can ask of us. Mapixa is run by Skibidushi Degemoto LLC (in formation), a limited liability company being formed under the laws of the State of Wyoming (we, us). Our contact e-mail addresses are on the company page; our postal address will be added there once the company is formed. Requests about your data go to support@mapixa.gg.

The short version

• We set no cookies on the website ourselves. Cloudflare, which delivers the website and the app, may set its own security cookies (such as cf_clearance and __cf_bm) when its bot protection runs (section 1.8). The website counts visits with Cloudflare Web Analytics, which by Cloudflare’s description uses no cookies and does not track you across sites.
• The app sets its own cookies only to sign you in; Cloudflare’s security cookies may be there as well. A wallet sign-in reaches nobody but Cloudflare and your own wallet; your browser connects to Privy only if you choose an account sign-in.
• We use the country of your connection and your wallet address to keep sanctioned persons and blocked places out.
• Your model key and your messages to the Quant go from your browser straight to the model provider you chose. We see neither.
• We do not sell your personal data and show no ads.

1. What we collect

1.1 Visiting mapixa.gg. Cloudflare delivers the pages and processes the technical data of each request: your IP address, the time, the page, your browser’s user agent and the referring page. Cloudflare Web Analytics counts page views; it records the page, the referring site, the browser and operating-system type and the country derived from the IP address, and shows us totals only. Your theme choice stays in your browser (mapixa.theme). Cloudflare’s bot protection also adds a short script to our pages; it runs a check in your browser and sends the result to Cloudflare.

1.2 Your account. Your public wallet address (with an account sign-in, the built-in wallet’s), a random account id, your role, the times of your first and last sign-in, which of your wallets your live trades use, and which version of the terms you accepted and when. While an account needs an invite: your address on the waitlist with the time, or the redemption of your code (a hash of the code, your address, the time and who invited you), and, if we admit you from the waitlist, your address on our list of approved wallets with our label. We also keep two registers under the random account id only, never your wallet address: a yearly list of member accounts (the year and when the account was added) and a list of live trades with their SOL amount and their value in Swiss francs at the time. They are not deleted with your account (section 5.2). If you came through a partner’s referral link: which partner (while you wait, kept with your wallet address and when you came, on the waitlist). If your account was created through a partner’s link: the link to that partner (its time, its rebate rate and whether it was set at sign-in or from the waitlist), the rebate recorded for you on each instant trade (the trade, its time and day, the fee, the amount and when it was recorded; terms, section 7.6), and the share of our fee on those trades that we record for the partner (it is part of the partner’s record and is not in your export, section 5.2). A rebate is recorded only once we have confirmed the trade and read on-chain the Mapixa fee our fee account received; a trade without that fee records none. If you are a referral partner: your code, our label for you, your rates with their dates and their ceiling, your status history, and the amounts recorded for you.

1.3 Sign-in identifiers through our wallet vendor. If you sign in through an account, Privy runs the sign-in (Google, X, e-mail or a passkey) and creates your built-in wallet. From Privy’s record we store Privy’s id for you; for each sign-in its id at the provider, with an e-mail address only as a hash made with a secret key and in masked form («a***@gmail.com»), an X handle and its picture, the name on your Google account when Privy’s record has no e-mail address for it, or a passkey’s name; and the built-in wallet’s address with Privy’s id for it. We never receive the wallet’s key. So we hold your e-mail address in usable form only if you write to us. Privy keeps the address; our server reads it from Privy when you sign in or link a sign-in and does not store it.

1.4 Device and session data. For each signed-in device: a hash of its session token and of its device cookie (each made with a secret key), its name, when it signed in and was last seen, what it may do, through which sign-in it came in, and a coarse description from your browser’s user agent (phone, desktop or TV, browser family, operating system), never the user agent itself and never your IP address. For a QR sign-in: hashes of the code, the screen’s type, the first 120 characters of its user agent, the country, city, region and network that Cloudflare derives from its IP address, and a keyed hash of that IP address. Rate-limit counters use a keyed hash of your IP address, never the address itself. To keep partners from linking their own accounts, we compare the hashed device cookie of a new sign-up with the partner’s signed-in devices; nothing new is stored for it.

1.5 The country of your connection. Cloudflare derives a country, and where it can a region, from your IP address. We use it to refuse a new account and every buy from blocked places (terms, section 4). From Cuba, Iran, North Korea and the regions of Ukraine listed here (Crimea, Sevastopol, Donetsk, Luhansk, Kherson, Zaporizhzhia) — places under a comprehensive U.S. embargo, or that we treat the same way — we build and send no transaction at all, including sells and withdrawals; reading and the export of your own key remain available.

1.6 Trading and use. Your live trades (coin, side, quoted and booked amounts, the Mapixa fee and network fees, the signature and status, the device); moves of SOL between your own wallets (both addresses, amount, fees, signature, status, balances afterwards, device); resting orders (wallet, coin, amounts, prices, state, device); your paper book, watchlist, watched wallets with your labels, trade profiles, risk limits, achievements and workspaces; the coins you ask us to check (our engine receives only the coin and the random account id); the outside apps you connect, with hashes of their tokens and a log of their calls.

1.7 Logs and error reports. A log of account events under your account’s main wallet address or its random account id: devices and sign-ins that replace one, permissions, linked or removed sign-ins and wallets, trades built and sent, orders, moves and your risk limits. When we approve, block or unblock your wallet, the entry is logged under our own account and names your wallet address; it is not part of your export, and when your account is deleted it stays with your address removed. When the app fails, your browser sends an error report: the error and where it occurred, the page, the app version, the time, your user agent (at most 200 characters), your account id and a short session reference. Our server’s logs at Cloudflare hold each request’s address and the lines our code writes about it.

1.8 Cookies and browser storage. __Host-mapixa_session keeps you signed in (at most 30 days, removed at sign-out). __Host-mapixa_device holds a random value so that a new sign-in in the same browser replaces its old session (at most a year). __Host-mapixa_qr_… ties a QR sign-in to its screen (150 seconds). All three are HttpOnly and Secure. The app keeps your settings, layout and drafts in your browser’s storage; they stay there, except an invite code (kept for this tab only) and a partner’s referral code (used for at most 30 days, and removed the next time the app opens after that), which go with your sign-in, with the check when you tap a sign-in method and with the link that opens the app in Phantom’s browser, and the referral code may also go to our server when the sign-in screen opens; a move of SOL our server has not yet recorded, sent until it does; the X handles you list, sent with the request that reads their posts; and your workspaces, watched coins and trade profiles, which are also saved to your account. The Quant’s key stays in the tab’s memory, or in this browser’s IndexedDB if you tick «Remember it on this device», until you sign out. Privy’s code keeps its own keys and, depending on how Privy works at the time, cookies; our server does not read them. Cloudflare’s bot protection may set its own cookies on mapixa.gg and app.mapixa.gg, also when you are not signed in: cf_clearance (HttpOnly and Secure, up to one year; it holds the result of the check that ran in your browser) and __cf_bm (it expires after 30 minutes of continuous inactivity), and further ones when it shows a challenge. We do not read them.

1.9 E-mails you send us, with your address and what you write. E-mail to support@mapixa.gg, contact@mapixa.gg or takedown@mapixa.gg is forwarded to the mailboxes we read (section 3 names their provider). A language model reads these e-mails to sort them by topic and urgency (section 3 names its provider). Our server also keeps its own record of each of these e-mails for up to 30 days: the sender’s name and e-mail addresses, the addresses it was sent to (up to five “To” and five “Cc” addresses), the subject, the date, its message id and the ids of the messages it answers, its size, the sender-check line our e-mail provider adds (it can include the sending server’s IP address), whether it is marked as automatic or list mail, at most the first 16 KB of its text, and the number of attachments with the names, types and sizes of up to ten of them, never their content. We also keep parts of these e-mails on a computer we run. A shorter record of the same kinds of data is kept for up to 24 hours of e-mail to takedown@mapixa.gg (in addition to the fuller record above) and to any other @mapixa.gg address that accepts mail: it holds at most the first 4 KB of the text, one six- to eight-digit number found in the subject or the text of the message and whether the message had a Bcc line.

A wallet address is public on the blockchain. Linked to your use of Mapixa, it is personal data, and we treat it that way. Your live trades are public on the Solana blockchain for anyone to read.

2. Why we use it

To run Mapixa and your account; to build, check and send the transactions you ask for and show your balances and the amounts of your trades; to keep sanctioned persons and blocked places out and meet our legal duties, including tax records; to keep Mapixa secure and stop abuse; to find and fix errors; to answer you; and to count visits to the website in totals.

3. Who receives it

Service providers acting for us: Cloudflare (hosting of the site and the app, the database, our server’s logs, web analytics, bot protection on every page and the bot check at account sign-in, e-mail routing for our @mapixa.gg addresses and the records of e-mail described in section 1.9); Privy (account sign-ins and the built-in wallet); Sentry (error tracking: an error’s text, stack, route, time and app version, with wallet addresses, signatures and ids replaced, never your account id, session, cookie, user agent or IP address); Slack (one line per new error for our own alerts); Google (the Gmail mailbox our @mapixa.gg addresses forward to); and the servers that run our engine (they receive the coin and the random account id). We screen against OFAC’s own published list; no wallet address leaves us for that.

A language model run by Anthropic reads e-mails sent to support@mapixa.gg, contact@mapixa.gg and takedown@mapixa.gg to sort them by topic and urgency.

RPC providers, which read the blockchain and send transactions for our server: Shyft, PublicNode and the public Solana endpoint (api.mainnet-beta.solana.com). They receive wallet addresses, watched addresses, signatures, the unsigned transactions we check before you sign, and the signed transactions of the built-in wallet that we send; never your name, e-mail or account id.

Services you use through Mapixa, under their own terms and privacy notices: Jupiter (it builds swaps from your address, the coin and the amount, and runs resting orders); Google or X when you sign in with them; the model provider of your own key; DexScreener and X when their charts or posts are on your screen; the Solflare web wallet if you choose it. Your browser connects to these directly, except Jupiter, which our server calls.

Authorities, when the law requires it, and sanctions reports under our internal policy.

A buyer or successor of Mapixa, under this notice.

Referral partners. A referral partner sees the total of the share recorded for them on the days that have ended (Central European Time) and the amount recorded on each of the last 30 of those days, each rounded down to 0.001 SOL, and the number of accounts created through their link up to the last of those days, not counting blocked or deleted accounts — never your wallet address, account or individual trades. A partner with only a few trading members can still estimate those members’ trading volume from a daily total.

We do not sell or rent personal data, we do not share it for advertising across other sites, and we show no ads.

4. How long we keep it

5. Your choices and rights

5.1 Ask us. Write to support@mapixa.gg to see, correct, export or delete your data. To check that the account is yours, we ask for one thing, never an identity document: a short text message signed with a wallet of your account (a message signature, never a transaction: it moves no funds and costs nothing). If you are not able to sign such a message, write to us anyway: without it we do not export or delete any data on request. We answer within 30 days.

5.2 Export and deletion. An export is a machine-readable file (JSON) of the data stored under your account, which we prepare for you. It leaves out the hashes and other security values that protect your sign-ins and the outside apps you connect (sections 1.3, 1.4 and 1.6), and which login opened each session. It also leaves out the keyed hash of your e-mail address (section 1.3); its masked form stays in the export. For referrals (terms, section 7.6), the export holds your own link and the rebate rows recorded from your own instant trades (not the share recorded for the partner, section 1.2), with the partner shown only as «partner»; if you are a referral partner, also your partner record, your rates and your status history, and of your share only the amount recorded on each day that has ended (Central European Time) and after whose end a recording run has written, each rounded down to 0.001 SOL, and their total — never a row of another member’s trade. On deletion we remove your account and the data stored under it, except what we keep: the records of your live trades and their fees for at least 10 years (each record keeps the transaction’s signature, which is public on the blockchain) and the two registers in 1.2, under ids that the app no longer connects to you; and the screening records written when a wallet on the sanctions list was refused (the wallet address, the time and what was attempted), for 10 years. We also keep the referral amounts recorded from the fees of your trades, or for you as a partner (terms, section 7.6), like the records of live trades, under an id that the app no longer connects to you. We do not delete your record at Privy: the built-in wallet and its key live there and would be lost; Privy’s own policy applies to it. Nobody, including us, can delete or change what is on the blockchain. Before you ask, export the built-in wallet’s key or move your SOL out (terms, section 21).

5.3 California. This section is our notice under California law. The categories of data we collect and the parties that receive it are in sections 1 and 3; you can review and correct your data as section 5.1 says; section 9 says how this notice changes. We do not track you across other sites, so a «Do Not Track» signal changes nothing. The services your browser connects to directly (section 3) may collect data about your activity under their own privacy notices. We do not disclose personal data to third parties for their own direct marketing.

6. People in the EU, the UK and Switzerland

If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to our processing of your data: we process it to perform our contract with you; in our legitimate interests in a secure, working service, in keeping the tax records US law requires, and in counting visits in totals; and with your consent where we ask for it. You have the right to access, correct and delete your data, to restrict or object to its processing, to receive it in a portable format, and to withdraw a consent at any time. Write to support@mapixa.gg. You may also complain to the data protection authority where you live or work. We are in the United States, and your data is processed there and in the other countries where our providers work.

7. Children

Mapixa is only for people aged 18 or over. We do not knowingly collect data from anyone younger. If you believe a child has given us data, write to support@mapixa.gg and we will delete it.

8. Security

We store tokens, codes and IP addresses only as keyed hashes where we can, we never store a signed transaction or a private key, and access to our systems is limited. No system is fully secure; keep your own wallet, sign-ins and devices safe.

9. Changes

We update this notice when what we process changes, and change the date shown as Last updated above.

10. Contact

Requests about your data: support@mapixa.gg. Anything else: contact@mapixa.gg. Until our postal address is published on the company page, legal notices to us are validly delivered by e-mail to contact@mapixa.gg (takedown requests to takedown@mapixa.gg); the postal address will be added once the company is formed.