OXUS TRAIL
Oxus Trail
Privacy Notice
What we keep about you, why, and for how long. The list is complete: if it is not here, we do not keep it.
In short
- Your account is your wallet address. We never ask for your name, email, phone or ID.
- We never store your network (IP) address.
- No advertising trackers. The only cookies are the three that Connect X sets, named below. We count visits anonymously: pages and steps, never your wallet or network address, deleted after 30 days. We sell nothing about you.
Who is responsible
The team behind Oxus Trail ("we", as in the Terms of Use).
In the game
| What | Why · how long |
|---|---|
| Your wallet address | It is your account. Kept while the game runs. |
| Your game records: caravans, trips, balance lines, purchases and their transaction hashes, withdrawals, standing orders | To run the game, show your history and put mistakes right. Kept while the game runs. The balance ledger can be added to but never changed or deleted. |
| Sign-in sessions (a one-way hash of the session key) | To keep you signed in. A session stops working when it expires. |
| A coarse print at each sign-in and withdrawal: your browser string (its first 200 characters), the browser family and the country our network edge names | To spot groups of wallets that harm the reward vault. Never your network address. Deleted after 90 days. |
| Your caravan name, banner and caravan house | Shown to other players. Kept until you change them or leave the house. |
| Notifications, if you turn them on: the push address and keys your browser gives, and your UTC offset in minutes (for quiet hours; never a time zone name) | To send them. At most 5 per wallet. Deleted when you turn them off or your browser drops the address. |
| Your support messages and our answers | To answer you. Kept while the game runs; ask us and we delete them. |
| Bug reports, from the game or this site: what you wrote, the device and browser line, your wallet if you were signed in, and the X name for the Hall of hunters if you asked to be named | To fix the bug and reward the first reporter. Kept while the game runs; ask us and we delete them. |
| A screenshot sent with a bug report, with its hidden data (place, camera, author) removed before it is stored | Seen by the team only. Deleted after 90 days. |
| A title you earned (Bug Hunter) | Shown on your caravans to other players. Kept while the game runs. |
| Review notes and abuse signals about a wallet, and wallets we find linked to it | To protect the reward fund and apply limits fairly. Kept while the game runs. |
On this site
| What | Why · how long |
|---|---|
| The wallet address you type or paste for your Pass (nothing is signed and no wallet is connected; if you change it, the old one is kept in a log), the Pass code, invite code, road, join time and who invited you | Your Caravan Pass and the hand review of the Charter list. Kept while the game runs; ask us and we delete them. |
| Anonymous visit counts: the page, the step of the pass reached, a device class (phone, tablet or desktop), where you came from (X, direct or other) and an id made for the open tab, once an hour each | To count visits and see where the steps lose people. No wallet, no network address, no cookie. Deleted after 30 days. |
| The X account you connect: its id and name, read once from X when you sign in there (nothing else; we store no key of X's). Or the X handle you typed, if any | Shown on your Pass and seen in the review, with the account's creation date that its id shows. One account, one Pass. Same as above. |
| Cookies, only while you connect X: oxus_xs (which browser started the sign-in, 10 minutes), oxus_xc (a sign-in X finished in another browser, until you confirm its code there, 10 minutes) and oxus_x (your X sign-in, 24 hours) | To connect the right X account to the right browser. Each holds a one-off key, sent only to our server; we store only its one-way hash. The X sign-in is deleted after 24 hours. |
| A salted one-way fingerprint of the first three parts of your network address, made when you join | To see a burst of invites from one network. Wiped after 7 days. The address itself is never stored. |
| Public chain history of your wallet (on Robinhood Chain, Ethereum, Arbitrum and Base): how many transactions it sent and which wallet first funded it | Shown to the team in the hand review, as information only. Kept while the review and the list need it. |
| A collab application: the name, X link, chain, size and its proof, holders' contract, offer, day, places asked your contact on X and, if you give one, an address for your own place (typed, not signed) | To review it and answer you. Kept while the game runs; ask us and we delete it. |
| A creator entry: your X handle and the links to your posts, with the level and note the team sets | To read your posts and choose Charter list places. We open the links ourselves; our server never fetches them. Kept while the game runs; ask us and we delete it. |
Everywhere
- Server logs hold the method and path of each request and our own error notes: never your network address or your request headers.
- Backups of the database are kept for up to 90 days, so deleted data leaves them within 90 days.
- Your browser keeps your session for the open tab, your settings and a payment still in progress. Nothing of it is a cookie; the only cookies are the Connect X ones above.
The public chain
Payments, withdrawals, Charter mints and transfers on Robinhood Chain are public and permanent. Nobody, us included, can change or delete them.
Who else sees data
- The hosting and network edge in front of our sites, to deliver them (it sees your network address while it serves you).
- Blockchain node providers, which see our server's requests. Your wallet uses its own.
- WalletConnect, if you connect a wallet through it. X and OpenSea, when you follow a link to them.
- An AI service provider, used under its data terms, for support and review drafts: it reads support messages, bug reports, applications and names and writes suggestions for our team. It does not decide anything; a person does. We send only the text it needs, without network, e-mail or wallet addresses, and delete its suggestions after 90 days.
- Authorities, only when the law requires it.
Your choices
- Ask to see what we keep about your wallet, or to delete it, through the support form in the game, signed in with that wallet (until the game opens, through @oxustrail on X). We delete what we can; we cannot delete the public chain, the balance ledger or records we need to protect the reward fund.
- You can turn notifications off and change your caravan name or banner at any time.
Age
Oxus Trail is for people aged 18 and over.
Changes
If what we keep changes, this page changes first, and the change goes on the public change log.