Privacy Policy

Who we are

openx402 is a public, read-only explorer for the x402 payment protocol on the Stellar network, operated by Ithaca Labs. Its source code is published under the Apache License 2.0 at github.com/Ithaca-Labs/openx402, so the behaviour described below can be verified directly against the code.

This policy covers the openx402 website. It does not cover the independent services listed in our catalog, the Stellar network itself, or any other site we link to.

What we collect

We record anonymous, route-level usage events so we can see which parts of the explorer get used. Each event stores exactly five things:

• the event type — either page_view or impression
• the path you visited, for example /discover
• an element key identifying the section that came into view, where applicable
• a timestamp
• a SHA-256 hash of a random identifier generated by your browser

That random identifier is created locally by your browser and is not derived from anything about you or your device. It is sent to our server, which hashes it before writing it to storage — the raw value is never saved. The hash lets us count returning visitors approximately without being able to identify anyone.

These events are only recorded on the explorer pages. The landing page does not run any analytics at all.

What we do not collect

We do not record or store your IP address, user agent, referring page, or location. We do not use cookies, advertising trackers, session replay, fingerprinting, or any cross-site tracking. There are no user accounts and no sign-up, so we hold no names, email addresses, or passwords.

openx402 never connects a wallet, never asks you to sign anything, and never takes custody of funds or keys. We therefore hold no wallet addresses, balances, or payment details of yours. We do not sell or share data with anyone, because we do not have anything to sell or share.

Browser storage

openx402 sets no cookies. It uses two entries in your browser’s local storage, both readable and clearable by you at any time:

• openx402-site-visitor — the random analytics identifier described above
• openx402-theme — whether you chose the light or dark theme

Neither is transmitted to any third party.

Third parties

Some images on the site are loaded from other domains. Requesting an image reveals your IP address and standard request headers to the host serving it, which is an ordinary consequence of loading a web page and is not something we control or receive. The hosts involved are:

• api.dicebear.com — generates the placeholder identicons shown next to catalog listings
• initia.xyz — serves decorative artwork on the landing page

The site also links out to documentation, Stellar, block explorers, and social accounts. Once you follow an outbound link, that destination’s own privacy policy applies.

Our hosting provider may keep its own server request logs, as any web host does. Those logs are outside the scope of this policy and are not used by us for analytics.

Aggregate statistics are public

The usage figures produced from these events are published openly on our analytics page and its underlying API endpoint, neither of which requires a login. Only aggregate numbers are exposed — visitor counts, counts per day, and the most-visited paths. Individual events and hashed identifiers are never shown.

Retention

We do not currently operate an automatic deletion schedule, so analytics events may be retained indefinitely. Because the stored records contain no identifiers we can link back to a person, we cannot locate or delete the events associated with a particular individual on request.

Your choices

You can clear or block local storage for this site, which removes the random identifier and causes a new one to be generated on your next visit. You can block requests to our analytics endpoint, or browse with JavaScript disabled. None of these degrade the site’s content — analytics failures are ignored silently by design.

Children

openx402 is developer tooling and is not directed at children under 13. We do not knowingly collect information from them.

Changes

We may update this policy as the site changes. The revision date at the top of this page always reflects the current version, and the full history is visible in our public repository.

Contact

Questions about this policy can go to labsithaca@gmail.com. Security issues are best reported privately through the GitHub security advisory flow on our repository.