Privacy Policy

Last updated 6 October 2026.

This policy explains what personal data RADIX.wiki (our site) processes, why, who else receives it, how long it is kept and what you can do about it. It covers reading the site, contributing to it, and the machine-readable surfaces: the API, the MCP server, the feeds and the llms.txt files. Read it alongside our Terms of Use and Acceptable Use Policy.

Who we are

Our site is run by the RADIX.wiki DAO (we, us), the controller of the personal data described here for the purposes of the UK GDPR and the Data Protection Act 2018. Every request this policy mentions goes to us by direct message to @RadixWiki on X.

In short

• Reading the site sets no cookies and needs no account.
• Our analytics set no cookie and store no IP address, and we cannot tell who you are from them.
• A contributor account is a Radix account address. We never ask for a name, an email address, a password, a private key or a seed phrase.
• What you publish here (articles, revisions, comments, images) is public and stays on the record. Anything you write to the Radix ledger cannot be removed by anyone, us included.
• We do not sell data, show advertising, or build profiles of readers or contributors.

If you read the site

Hosting

The site is served by Vercel. Each request passes your IP address, browser user agent, the address requested, the referring page and the time through Vercel's infrastructure, which records them in short-lived request logs. We use those logs only to deliver the site, keep it secure and diagnose faults.

Analytics

We count visits ourselves, in our own database. Each page you open sends a report to our own address, and we store the page's path, the site that linked you to it, your country (which Vercel works out from your IP address), whether you are on a phone, a tablet or a computer, and the time. We set no cookie and do not store your IP address. To count unique visitors, we combine your IP address and browser user agent with a random value, called a salt, and store only a hash of the result, a fixed-length code from which neither can be recovered. The salt is replaced every day and the old one deleted, so your visits on one day cannot be linked to your visits on another. No analytics company receives any of this.

Four events are counted the same way:

• Searches. The text you type into the site's search box is recorded, lowercased and cut to 64 characters, with the number of results it returned. We use it to find what readers look for and cannot find. Do not type personal information into the search box.
• AI crawler visits, identified by the crawler's user agent.
• MCP calls: the method, the tool name and the calling client's user agent. Tool arguments are not recorded.
• Links out of the site: the address of a link you follow to another site.

Rate limiting

Requests to the MCP server, and the page-view reports described above, are counted against your IP address to enforce rate limits. The counts are held in the server's memory for a few minutes and are never written to storage.

Embedded and linked content

Articles cite and embed material hosted elsewhere: images, YouTube videos, posts on X, and other frames. When your browser loads one, that provider receives your IP address and browser details and may set its own cookies, under its own privacy policy (for example Google's for YouTube and X's for posts). The same applies to any external site you follow a link to. We do not control those providers.

If you contribute

Signing in

You sign in by proving control of a Radix account with the Radix Wallet (ROLA). We receive the account address you prove and, if your wallet shares them, a persona address and the persona or account label, which becomes your display name. Our server stores a one-time challenge for five minutes and, on success, a session record.

Two items are stored on your device, both strictly necessary for signing in, and neither is used for tracking:

• the radix_wiki_session cookie: httpOnly, secure, expires after seven days or when you sign out;
• the wallet connection state, kept in your browser's local storage by the Radix dApp Toolkit so the wallet stays connected between visits.

To apply the XRD balance thresholds some areas require, our server looks up your account's balances on the public Radix Gateway at mainnet.radixdlt.com (its privacy notice). The request names your account address. The balances themselves are public on the ledger.

What is published

Pages you create, every revision you make, your comments and the images you upload are published with your display name (or, without one, a shortened form of your account address) and their timestamps. So are the points and leaderboard rank derived from them. Uploaded images are re-encoded to WebP, which strips embedded metadata such as camera details and GPS location, and are stored at public addresses on Vercel Blob.

You can change your display name by changing the label of your persona in the Radix Wallet and signing in again.

Notifications, webhooks and Telegram

We store in-site notifications about activity on your pages. If you register a webhook we store its URL and signing secret and send events to it; if you link Telegram we store your Telegram chat ID and send messages through our Telegram bot, under Telegram's privacy policy. You can remove either at any time.

Events describe contributors' activity: the page, the change, the contributor's display name and shortened account address, and the text of new comments. Your own activity is therefore delivered to the webhooks and Telegram chats of other contributors who subscribe to the pages you edit.

Contributor rewards

We may score contributions and send XRD to contributors' account addresses. For each distribution we keep a record of the addresses, points and amounts. The transfer itself is public on the Radix ledger.

The Radix ledger

Backing a page up to the ledger, tipping and any other on-ledger action are transactions you review and sign in your own wallet. A ledger backup writes the page text, including its author's display name, into a public transaction. Once a transaction is committed it is permanent and public: we cannot amend or erase it, and no one else can either.

Why we use it

• Your account and the features you ask for (sign-in, notifications, webhooks, Telegram): to perform our agreement with you under the Terms of Use.
• Publishing and attributing contributions, keeping the revision history, and rewards: our legitimate interest in running an open, accountable wiki that credits its contributors, and the freedom of expression of contributors and readers.
• Hosting logs, rate limiting and security: our legitimate interest in keeping the site available and safe.
• Analytics: our legitimate interest in knowing which pages are read and what readers cannot find. No reader can be followed from one day to the next.
• Disclosure to authorities, where the law requires it: legal obligation.

We make no automated decisions that have legal or similarly significant effects on you.

Who else receives it

• Vercel Inc. (United States): hosting, request logs and image storage. Privacy policy.
• Supabase: our database, hosted in London, which also holds the analytics. Privacy policy.
• The Radix Gateway: account addresses our server looks up.
• Telegram, only if you link it.
• Webhook endpoints registered by other contributors, as described above.
• Law enforcement or a court, where we are legally required to disclose.

Vercel processes data in the United States under the safeguards in its data processing addendum, which incorporates the standard contractual clauses with the UK addendum.

How long we keep it

• Sign-in challenges: five minutes.
• Sessions: seven days, or until you sign out.
• Hosting logs: Vercel's short retention period.
• Rate-limit counts: a few minutes, in memory only.
• Your account record, contributions and reward records: for as long as the site runs, because the revision history is the site's record of who wrote what.
• Webhooks and Telegram links: until you remove them.
• Analytics: 400 days, then deleted. The salt behind the visitor count: one day.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable format. Requests are free and we answer within one month. Send them to @RadixWiki on X. Because accounts are wallet addresses, we may ask you to prove control of the address, for example by signing in.

Erasure has limits, and we would rather state them than promise what we cannot do. On request we delete your display name, persona address, sessions, notifications, webhooks and Telegram links. Your contributions stay, attributed to your shortened account address: they were published under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), and the revision history is the record other contributors and readers rely on, which is the freedom-of-expression exception in Article 17(3) UK GDPR. If a particular contribution exposes personal data that should not be public, about you or anyone else, tell us and we will consider removing it from the page and its history. Nothing can be removed from the Radix ledger.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office. We would appreciate the chance to put it right first.

Children

Our site is not aimed at children. You must be at least 13 to sign in and contribute, and a contributor under 18 needs the consent of a parent or guardian, as the Acceptable Use Policy sets out.

Security

The site is served only over HTTPS, the session cookie cannot be read by scripts, we store no passwords or keys, and pages run under a strict content security policy. No system is perfectly secure, and we cannot guarantee the security of data sent over the internet.

Changes to this policy

We will post any change on this page and update the date at the top. Every earlier version is kept in this page's history.