Skip to content

Privacy policy

Last updated 17 September 2026

How mempoolxch.space handles personal data, under the EU General Data Protection Regulation (GDPR). In short: no accounts, no tracking, no analytics and no advertising. Your settings stay in your browser.

1. Controller

Maxim Edogawa. See also the legal notice.

2. Visiting the website: server logs

When you open the site, your browser sends technical data that the server records in access logs: IP address, date and time, the address requested (which can contain a transaction ID, block, address or coin you looked up), status code, referring page and browser identification.

  • Purpose: delivering the site, keeping it secure and stable, and investigating abuse and errors.
  • Legal basis: Art. 6(1)(f) GDPR; the legitimate interest is operating a secure website.
  • Retention: 14 days, longer only while needed to investigate a specific security incident.
  • Hosting: Hetzner, acting as processor under Art. 28 GDPR.

The server does not fetch chain or asset data on your behalf: it only serves the application itself (HTML, scripts, styles). Every lookup you make is a request from your own browser to Coinset, Dexie, MintGarden, XCHandles, public market data sources or your own node, described in the next sections.

3. Storage in your browser

The site keeps a few entries in your browser's local storage: your settings (network, node address, theme, language, sounds, whether you turned on browser notifications), a cache of the asset list, a short mempool history drawn while the page is open, your watchlist of addresses and transaction ids if you add any, your filters for the dashboard's next-block view, the node counts per country the network map last showed, which Sage permissions you declined, and your cookie choice. They stay on your device and are not sent to the operator. They are strictly necessary to provide what you asked for (§ 25(2) no. 2 TDDDG). You can delete them at any time in your browser settings. Details are in the cookie policy.

If you turn on browser notifications for your watchlist, that permission is granted to this site by your browser and can be withdrawn there at any time; the operator never sees whether you turned it on.

4. Services your browser contacts directly

Every page reads chain and asset data straight from other services, from your own browser, not through this site's server. Like any web server, they receive your IP address, browser identification and the address of the item requested:

  • Dexie (api.dexie.space, icons.dexie.space): the CAT token list, names, tickers and icons.
  • MintGarden (api.mintgarden.io, assets.mainnet.mintgarden.io, ipfs.mintgarden.io): NFT metadata and images.
  • Hosts named in an NFT's own on-chain metadata, when MintGarden has no copy. Which hosts these are is decided by the NFT's creator.
  • XCHandles (api.xchandles.com): only when you look up, watch or search a handle — what that name resolves to and when it expires.
  • Coinset (api.coinset.org): all chain data — the mempool, blocks, transactions, addresses, coins and assets you view, and the live updates — unless you enter a different node below.
  • A full node you enter in Settings: all chain data then comes from there instead of Coinset.
  • Network map page: its node statistics are a snapshot of Chia Network's public Peer Info dashboard (dashboard.chia.net) that ships with this site, so showing them contacts no one. Only when that snapshot is missing, older than 30 days or not for the selected network does the page fall back to a live scan while it is open: Cloudflare DNS (cloudflare-dns.com, with dns.google as a fallback) answers DNS queries for the Chia introducers, and GeoJS (get.geojs.io) estimates the location of the node addresses those answers contain; the addresses learnt are kept in your browser's local storage for a week. If you point Settings at your own node, the addresses of its connected peers are also sent to GeoJS. Only node addresses are sent for lookup, never yours. The page also remembers in local storage the country counts you last saw, to highlight what changed.
  • Only while the Market page is open: the public market data APIs of Gate.io (api.gateio.ws), OKX (www.okx.com) and HTX (api.huobi.pro) for XCH order books and recent trades, every 5 seconds, and Dexie (api.dexie.space) for open XCH offers against the stablecoins BYC, wUSDC.b, wUSDC and wUSDT. The requests carry no account, key or wallet data; the exchanges see them like any visit to their API.
  • XCH price: on the Tokens, Portfolio and address pages and for the Charts page's price history, the XCH/USD price and its 24-hour change come from Gate.io's public market data API (api.gateio.ws), asked at most once a minute. The requests carry no account, key or wallet data.

Legal basis: Art. 6(1)(f) GDPR; the legitimate interest is showing the blockchain content you request. Some of these providers may process data outside the European Economic Area, for example in the United States, where the level of data protection can be lower. Their own privacy policies apply.

Addresses, transaction IDs and coin IDs are public on the blockchain. If you look up your own address, the service answering the lookup may be able to link it to your IP address.

5. Inside the Sage wallet

In the Sage app, wallet information (your receive address, balances, pending and past transactions, coins) is read from Sage only after you allow it, and is processed on your device. It is not sent to the operator. To show your address page, the app looks up your public address at the chain data source (Coinset or your node), just as any address search would.

6. No cookies, analytics or advertising

The site sets no cookies and uses no analytics, tracking or advertising. Should that change, it will only happen with your prior consent through Cookie settings, and this policy will be updated first.

7. Your rights

You have the right to:

  • access the personal data held about you (Art. 15 GDPR);
  • have it corrected (Art. 16) or erased (Art. 17);
  • restrict its processing (Art. 18) and receive it in a portable format (Art. 20);
  • object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21);
  • complain to a data protection supervisory authority (Art. 77), in particular in the EU country where you live or work.

Write to x.com/MaximEdogawa on x.com. Since there are no accounts, server logs can only be matched to you with your IP address and the time of your visit.

8. Other

You are not required to provide personal data. Without the technical data in section 2 the site cannot be delivered. There is no automated decision-making or profiling. This policy is updated when the site changes; the date above shows the current version.