We collect almost nothing, and we will tell you exactly what.

No account, no login, no sign-up. We do not set advertising or cross-site tracking cookies.

We use Vercel Web Analytics and Speed Insights for aggregate page-view counts and page-performance timings. Vercel states these do not use cookies and do not track visitors across sites. We see totals and trends, not people.

Some vendor cards fall back to unavatar.io to fetch a profile picture we have not yet snapshotted ourselves. When that happens your browser makes a request to that third party, which will see your IP address as it would for any image on the web. Most avatars are served from our own domain specifically to avoid this.

We store your email address, your alert preferences, and — if you opt into portfolio-change alerts — a snapshot of the allocation inputs those alerts are diffed against. Email is delivered through Resend.

Subscriptions are double-opt-in: we send a confirmation link and store nothing durable until you click it. Every email carries a one-click unsubscribe, and you can change or drop any alert type at /prefs. Unsubscribing removes the contact.

We never sell, rent, or share the list, and we do not use it for anything but the alerts you asked for.

We store the push subscription your browser generates — an endpoint URL issued by your browser vendor and the keys needed to encrypt a message to it. That is what a push notification requires; it is not tied to an email address or a name. Turning the toggle off removes it.

Linking X is entirely optional — every game works anonymously, and the leaderboards accept anonymous entries. If you do link, we store your X user ID, the @handle and profile image URL as they were at link time, and when you linked. Your session is an HttpOnly, signed cookie. We never receive your X password, and we cannot post as you.

Linked players also get cross-device save sync: game progress (records, unlocks, stats) stored against your X user ID so it follows your login.

Unlinking deletes all of it — the stored profile and the saved progress. That is the whole deletion story for the only personally-identifying data the arcade keeps.

We store what you type into the form: the merchant's handle, name, description, category, and any optional details like country, website, or Lightning address — plus any note you add for the reviewer. This is business information intended for publication, and approved entries become part of the public directory.

We do not store your IP address with the submission. Rejected submissions are kept briefly for audit and then expire.

The form may be protected by Cloudflare Turnstile, a privacy-focused captcha, to keep out automated spam.

Some endpoints are rate-limited to keep floods and abuse from running up costs. That works by incrementing a short-lived counter keyed to your IP, which expires on its own within the rate-limit window. We do not log request histories against it, build profiles from it, or use it for analytics.

Game saves, high scores, streaks, dismissed banners, and similar preferences live in your browser's local storage. They stay on your device and are never sent to us — unless you have linked X and enabled save sync, described above. Clearing your browser data clears them.

The full list of processors, and nothing beyond it: Vercel (hosting, analytics), Upstash (the key-value store holding the records above), Resend (email delivery), Cloudflare (captcha), and X (only if you choose to link an account).

Galaxy Mind never handles payments. We do not take orders, hold funds, or process transactions — when you buy from a merchant in the directory, that happens entirely between you and them. We have no payment details to lose.

Email: unsubscribe from any message or at /prefs. Push: turn the toggle off. X identity and game saves: unlink in the arcade.

For anything else, or if you want confirmation that something is gone, message @GalaxyMind on X or on Nostr. It is one person reading them, so it will not be instant, but it will be honest.

Galaxy Mind is not directed at children and we do not knowingly collect data from anyone under 13.

If this policy changes materially, the date below changes with it. There is no version where we quietly start collecting more than this page describes.

Last updated July 29, 2026