Privacy
Last updated:
This notice explains what personal data Mapixa (mapixa.gg and app.mapixa.gg) processes and why. The controller is the operator named in the Impressum. We follow the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
The short version
- The site sets no cookies and keeps nothing in your browser’s storage.
- We measure visits with Cloudflare Web Analytics, which is cookieless and does not track you across sites.
- The app sets one session cookie, and only after you sign in with a wallet.
- We never ask for your name or e-mail address, we sell no data, and we show no ads.
1. Visiting mapixa.gg
The pages are static files delivered by Cloudflare. Like every web server, Cloudflare processes technical data to deliver a page and to protect the site from attacks: your IP address, the time, the requested address, your browser’s user agent and the referring page. We do not combine these with any other data.
Web analytics. We use Cloudflare Web Analytics to count page views. It uses no cookies and no local storage and does not fingerprint visitors; it records the page, the referring site, the browser and operating system type, and the country derived from the IP address, and it shows us aggregated counts only.
Live numbers. The home page and the receipts page load the public numbers from app.mapixa.gg. These requests carry no cookies and no identifier; app.mapixa.gg sees only the technical data described above.
2. Using app.mapixa.gg
Without signing in you can read the public numbers. We process the technical data above. To protect the service, short-lived rate-limit counters use a keyed hash of your IP address; the address itself is not stored.
When you sign in with a Solana wallet we store:
- your public wallet address, a random account id, your role, and the times of your first and last sign-in;
- a session record that holds only a keyed hash of your session token, with its expiry;
- the coins you ask us to check, with the time, to answer you and to enforce rate limits; our engine receives only the coin and the random account id, never your wallet address;
- while Mapixa is invite-only: your wallet address on the waitlist with the time you signed in, or, if you used an invite code, the redemption (a hash of the code, your address, the time and who invited you);
- error reports your browser sends when the app fails (the error text, the time and your browser’s user agent), kept for 14 days;
- if a wallet is blocked for abusing the service: its address with the role «blocked» (also for a wallet that never signed in), so that it cannot sign in again; unblocking removes that record or restores the account.
The session cookie (__Host-mapixa_session) keeps you signed in. It is strictly necessary for the signed-in app, set only after you sign in, marked HttpOnly, Secure and SameSite=Lax, valid for at most 30 days, and removed when you sign out. A sign-in uses a one-time challenge that expires after 5 minutes.
The app may remember your recent coin searches in your browser’s local storage. They stay on your device and are never sent to us.
A wallet address is public on the blockchain, but linked to your use of Mapixa it is personal data, and we treat it that way.
3. Legal bases
We process data to provide the service you use (FADP; GDPR Art. 6(1)(b)), in our legitimate interest in a secure, working and measured service (GDPR Art. 6(1)(f)), and where the law requires it (GDPR Art. 6(1)(c)).
4. Processors and transfers
Mapixa runs on Cloudflare (hosting, the app’s database, analytics, e-mail forwarding for our addresses). Cloudflare processes data on our behalf under its data processing terms, and may process it in countries outside Switzerland and the EEA, including the United States, with the safeguards those terms provide. We do not sell or rent personal data to anyone.
5. How long we keep data
- Session records: until they expire or you sign out.
- Sign-in challenges: about an hour (each one expires after 5 minutes).
- Rate-limit counters: about an hour.
- Error reports: 14 days.
- Your account, or your place on the waitlist: while it exists. Ask us to delete it and we will, together with its sessions and requests.
6. Your rights
You can ask for access to your data, its correction or deletion, and object to processing or ask us to restrict it; where the GDPR applies, you also have the right to data portability. Write to the contact in the Impressum. You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the data protection authority where you live.
7. Changes
We update this notice when what we process changes. The date at the top shows the current version.
The Slovak version of this notice is a translation; if the two differ, the English version applies.