Privacy Policy
How Nexus handles user data and privacy.
Effective Date: To be set at publication Last Updated: August 12, 2026 Version: 2.1 (draft)
Key points. This Privacy Policy describes how Nexus Foundation handles personal data in connection with the Services. It is published as honest disclosure of current practice; broader compliance commitments are part of a tracked post-mainnet program, and this Privacy Policy will be updated as that program lands. Capitalized terms used here have the meanings set out in the Terms of Use.
1. Who we are
This Privacy Policy is published by Nexus Foundation, a Cayman Islands foundation company, registered c/o Walkers Corporate Limited, 190 Elgin Avenue, George Town, Grand Cayman KY1-9008, Cayman Islands (the "Foundation"). The Foundation is the data controller of personal data described in this Privacy Policy. This Privacy Policy supersedes any prior privacy policies published in connection with the Services. The purpose of this document is to provide you with information on the Foundation's use of your personal data in accordance with the Cayman Islands Data Protection Act (as amended) (the "DPA").
This Privacy Policy applies to personal data the Foundation processes in connection with the Services, as those terms are defined in the Terms of Use.
This Privacy Policy is supplemental to the Terms of Use. In the event of a conflict between this Privacy Policy and the Terms of Use, this Privacy Policy controls with respect to the handling of personal data; the Terms of Use control otherwise.
2. What we collect
The Foundation collects the following categories of personal data:
Information you provide to us. When you opt in to communications from the Foundation (for example, by signing up for an email list), you provide your email address. If you contact the Foundation, you provide whatever information is in your message.
Wallet addresses. When you transact on the Chain, request a drip from a Faucet, participate in proving activity, or otherwise interact with on-chain or Foundation-mediated functionality, your wallet address is observed. Wallet addresses are public on the Chain by design and may also appear in publicly accessible Foundation-operated interfaces (such as proving-activity leaderboards or Program participation displays). Where a Program or Foundation-operated workflow involves sending tokens or other balances to a user-provided wallet address, the Foundation may use the wallet address you provide for that purpose.
Network metadata. When you access the Site, the RPC, or the Faucets, the Foundation observes network-level information including your IP address, the X-Forwarded-For header value, the HTTP method and path of each request, the response code, geographic country and region as derived by an industry-standard geolocation library, and the outcome of any role-based-access-control or rate-limiting decision applied to the request.
Browser and device metadata via cookies and similar technologies. The Site uses cookies and similar technologies. See the Cookie Policy for details.
Device and SDK identifiers. Pages on the Site load third-party software development kits — including a wallet-authentication SDK and a wallet-connectivity SDK — as part of the page itself. These SDKs run when a page loads, whether or not you use the related feature. They assign and store persistent identifiers on your device using browser local storage — including a device-fingerprint identifier computed by the wallet-authentication provider, anonymous SDK identifiers, and service installation identifiers — and may transmit usage telemetry to their providers at page load. Because these identifiers are stored against the nexus.xyz origin, they are available across Site surfaces served from that origin, including the Exchange Interface. The parties involved are identified in the Cookie Policy and the public sub-processor list.
Exchange interaction data. When you use the Foundation-operated Exchange Interface (including any preview or simulated mode), the Foundation captures interface and trading event data — including order parameters you enter, order and trade history, market-data session metadata, and related interface interactions — together with the wallet address used, where a wallet is connected. This data is routed through Foundation-operated gateway infrastructure. In preview or simulated modes, trading activity is simulated and involves no real assets, but interaction metadata is still collected.
Usage telemetry from compute-contribution clients. When you use the Foundation's compute-contribution clients — including the CLI and any browser-based clients made available by the Foundation — the client reports compute-contribution metrics and network identifiers used to track the client's interactions with the Foundation's testing and benchmarking infrastructure. The client assigns your machine a unique identifier used to recognise the client across sessions; this identifier is stored locally on your machine (in your web browser for browser-based clients, or in a Foundation-specific folder such as ~/.nexus for the CLI).
Account, onboarding, and engagement data. When you sign up, request waitlist access, redeem an access code, refer other users, complete proving activity, receive welcome bonus or similar grants, or interact with Foundation emails, the Foundation captures the related event data — including, where applicable, signup timestamps, wallet addresses, country code, referral relationships, access-code redemption history, proving-activity timestamps, badge or quest completion records, and email-delivery and click metrics.
Some of the categories above are collected through third-party sub-processors operating on the Foundation's behalf. See Section 5 and the public sub-processor list for details.
The list above describes the categories the Foundation can identify today. It is not represented as exhaustive. The Foundation is conducting a more complete inventory of personal data processing as part of its post-mainnet program and will update this Privacy Policy as that inventory completes.
3. How we use the data
The Foundation uses personal data for the following purposes:
to operate, maintain, secure, and improve the Services;
to respond to questions, requests, or other communications from you;
to send you communications you have opted in to receive;
to detect, prevent, and address abuse, fraud, security incidents, and breaches of the Terms of Use;
to enforce sanctions, restricted-jurisdiction, and other access-control requirements applicable to the Services;
to understand how the Services are used (analytics);
to comply with applicable law and respond to lawful requests from regulatory, governmental, tax and law enforcement authorities; and
for other purposes disclosed at the point of collection or otherwise consistent with the purposes above.
Legal bases. The Foundation processes personal data under the processing conditions of the DPA and, where the EU General Data Protection Regulation 2016/679 or the UK General Data Protection Regulation (collectively, the "GDPR") applies to a particular user, on the corresponding legal bases, as follows:
Performance of a contract — operating the Services you access or request, responding to your communications, and delivering functionality you invoke (for example, processing a Faucet request to the wallet address you provide);
Legitimate interests — securing the Services; detecting and preventing abuse, fraud, and breaches of the Terms of Use; operating network-edge logging (Section 8); understanding how the Services are used; and improving the Services — in each case balanced against your interests and rights;
Legal obligation — enforcing sanctions and restricted-jurisdiction requirements, and complying with applicable law and lawful requests from authorities; and
Consent — sending communications you have opted in to receive, and, where applicable law requires consent, the use of non-essential cookies and similar technologies. Where processing relies on consent, you may withdraw it at any time; withdrawal does not affect processing carried out before withdrawal or processing on other legal bases.
Certain access decisions are made automatically, including geo-restriction, rate-limiting, and sanctions screening, in accordance with the Terms of Use and the Restricted Jurisdictions List.
The Foundation does not sell personal data.
4. Cookies and similar tracking technologies
The Site uses cookies and similar tracking technologies for strictly necessary, performance and analytics, functional, and marketing and advertising purposes. Under the Foundation's current Phase 1 posture, analytics cookies and SDK identifiers load by default when a page loads; the Site does not currently present a prior-consent banner. Cookie controls are user-side: they are available through your browser and through the third-party platforms whose cookies are set on the Site.
For details on the cookies in use, the categories, the third parties involved, and how to manage them, see the Cookie Policy.
5. Sub-processors
The Foundation uses third-party service providers ("sub-processors") to operate parts of the Services. Sub-processors include, without limitation, infrastructure providers, content delivery networks, email-marketing platforms, analytics providers, wallet-authentication and wallet-connectivity SDK providers, and geolocation providers.
Certain sub-processor SDKs are loaded as part of Site pages and may set identifiers on your device and transmit telemetry to the sub-processor when a page loads, before and independent of your use of the related feature.
A current list of sub-processors that handle personal data on the Foundation's behalf is published at https://nexus.xyz/data-processors. The Foundation maintains and updates the list as sub-processors are added, removed, or materially changed.
The published list is a transparency disclosure. Under the Foundation's current Phase 1 posture, it is not represented as evidencing formal Article 28 (or equivalent) data-processing contracts with each listed sub-processor. The Foundation is developing a fuller sub-processor governance program post-mainnet (see Section 7).
Third-party platforms. The Foundation operates surfaces hosted on third-party platforms. For example, the Foundation blog at blog.nexus.xyz is hosted on Ghost; Programs are run on partner platforms identified in the relevant program terms; and the Foundation operates community channels on platforms such as Discord, Telegram, and X. Your use of those platforms is governed by the platforms' own terms and privacy practices. The Foundation, as operator of its surfaces on those platforms, processes information visible within those surfaces (such as member lists, public messages, and direct messages sent to Foundation accounts) for the purposes described in Section 3. Where a platform handles personal data on the Foundation's behalf, it is identified in the public sub-processor list.
6. Cross-border data transfers
In the course of operating the Services, personal data may be processed, stored, or transferred between jurisdictions, including jurisdictions outside the Cayman Islands and outside the European Economic Area or the United Kingdom. Different jurisdictions may afford different levels of legal protection to personal data. In such cases, the Foundation will process personal data, or procure that it be processed, in accordance with the requirements of the DPA, which may include having appropriate contractual undertakings in legal agreements with service providers who process personal data on the Foundation's behalf.
The Foundation uses sub-processors selected for their relevance, reliability, and operational fit. The Foundation does not, in this Privacy Policy, represent that any specific data-transfer mechanism — including, without limitation, Standard Contractual Clauses, International Data Transfer Agreements, adequacy decisions, or similar instruments — is in place across all sub-processor relationships. The post-mainnet program (see Section 7) addresses cross-border transfer mechanisms vendor-by-vendor.
7. Your choices and rights
You have certain data protection rights under the DPA, including the right to:
be informed about the purposes for which your personal data are processed;
access your personal data;
stop direct marketing;
restrict the processing of your personal data;
have incomplete or inaccurate personal data corrected;
ask the Foundation to stop processing your personal data;
be informed of a personal data breach (unless the breach is unlikely to be prejudicial to you);
complain to the Cayman Islands Data Protection Ombudsman; and
require the Foundation to delete your personal data in some limited circumstances.
You have practical means to engage with the Foundation about your personal data. The Foundation honours these in good faith.
EEA and UK users. Where the GDPR applies to the processing of your personal data, you may have corresponding rights under those laws — including rights of access, rectification, erasure, restriction, objection, and portability, and the right to withdraw consent (which does not affect processing carried out before withdrawal). In addition to the Cayman Islands Data Protection Ombudsman, you may lodge a complaint with the data protection supervisory authority in the EEA member state where you live or work or where you consider an infringement of data protection law occurred, or with the UK Information Commissioner's Office, as applicable to you.
Access, correction, deletion. You can email the Foundation at the address in Section 15 to request information about, correction of, or deletion of personal data the Foundation holds about you. The Foundation will review such requests, verify your identity to the extent reasonable, and respond as soon as reasonably practicable.
Opting out of communications. You can opt out of marketing communications by following the unsubscribe link in any such communication. Operational communications about the Services may continue.
Cookie preferences. You can manage cookies through your browser and through the third-party platforms whose cookies are set on the Site. See the Cookie Policy.
Wallet addresses on the Chain. Wallet addresses and on-chain activity are public by design on the Chain. The Foundation cannot delete, redact, or otherwise alter on-chain records.
Automated decision-making. The Foundation will not take decisions producing legal effects concerning you, or otherwise significantly affecting you, based solely on automated processing of your personal data, unless the Foundation has considered the proposed processing in a particular case and concluded in writing that it meets the applicable requirements under the DPA.
The Foundation is developing a fuller privacy-compliance program post-mainnet; this Privacy Policy describes current practice and will be updated as that program lands.
8. RPC request logs
When you use the Foundation-operated RPC, the Foundation captures request metadata at the network edge for operational, security, and abuse-prevention purposes.
At the edge (envoy access log). The following fields are captured: IP address; X-Forwarded-For header value; HTTP method; HTTP path; response code; geo-country and geo-region as derived by an industry-standard geolocation library; and the outcome of any role-based access-control decision applied to the request.
Upstream node logging. The upstream node software operates at its default operational logging level, capturing protocol-level operational events; JSON-RPC method parameters (such as wallet addresses, transaction hashes, signed payloads, or eth_call inputs) are not part of the upstream node's container output at this logging level. The Foundation has also confirmed defensive measures at the metrics layer, including label-stripping for block_hash, code_hash, request_id, state_root, tx_hash, and similar high-cardinality identifiers.
Retention. Edge access logs and upstream node operational logs are retained for 30 days in operational log storage, after which they are archived to an industry-standard archival object store and retained indefinitely for security and compliance purposes.
Linkage. RPC request logs are operated at the network layer; in the ordinary course of operating the RPC, user identities are not separately attached to the logs beyond what the network layer already captures.
9. Children's privacy
The Services are not intended for persons under 18 years of age (the eligibility floor set in the Terms of Use). The Foundation does not knowingly collect personal data from persons under 18. If you believe the Foundation has collected personal data from a person under 18, please contact the Foundation at the address in Section 15 and the Foundation will take reasonable steps to delete such data.
10. Security
The Foundation takes reasonable security measures appropriate to the nature of the data processed and the risks involved. No system, however, is perfectly secure, and the Foundation cannot guarantee that personal data will be free from unauthorized access, disclosure, alteration, or loss. In the event of a security incident, the Foundation will respond in good faith and in accordance with applicable law.
11. Retention
The Foundation retains personal data for as long as needed for the purposes described in this Privacy Policy, or as required by applicable law. Specific retention periods vary by data category and operational context. Where specific retention periods are stated elsewhere in this Privacy Policy (such as in Section 8 for RPC request logs), those periods apply. The same network-edge log retention described in Section 8 applies to other Foundation-operated network surfaces (such as nexus.xyz, app.nexus.xyz, and Faucet endpoints).
Foundation-operated databases that hold account, onboarding, referral, proving-activity, and email-engagement data do not currently apply a defined deletion horizon; that data is retained for as long as needed for the purposes described in Section 3. Telemetry data collected from compute-contribution clients is retained in accordance with the applicable client terms; no defined deletion horizon currently applies. Third-party sub-processors apply their own retention policies, as set out in their respective privacy policies (linked from the public sub-processor list).
The Foundation generally retains your personal data throughout the lifecycle of its business relationship with you. Some personal data will be retained after your relationship with the Foundation ends. The Foundation expects to delete your personal data (at the latest) once there is no longer any legal or regulatory requirement or legitimate business purpose for retaining your personal data.
12. Third-party links and integrations
The Services may include links to, or integrations with, third-party websites and services. The Foundation does not control, and is not responsible for, the privacy practices of those third parties. You should review the privacy notices of any third parties whose websites or services you access.
Third-party wallets. Using the Services may involve connecting a third-party self-custodial wallet (such as a browser-extension or mobile wallet). Your relationship with the wallet provider — including its collection and use of your data — is governed by that provider's own terms and privacy policy. The Foundation does not operate or control third-party wallet providers and is not responsible for their data practices. This applies equally to wallet software development kits embedded in Site pages (see Section 2) to the extent data is transmitted to, or processed by, the wallet provider.
13. Sharing your personal data
The Foundation may share your personal data with its affiliates and delegates. In certain circumstances, the Foundation may be legally obliged to share your personal data and other information with relevant regulatory authorities. They, in turn, may exchange this information with foreign authorities, including tax authorities and other applicable regulatory authorities.
The Foundation's affiliates and delegates may process your personal data on the Foundation's behalf, including the Foundation's banks, accountants, auditors and lawyers and other service providers which may be data controllers in their own right. The Foundation's service providers are generally processors acting on the instructions of the Foundation. Additionally, a service provider may use your personal data where this is necessary for compliance with a legal obligation to which it is directly subject. Such service providers, in respect of this specific use of personal data, may be deemed to be acting as a data controller.
In exceptional circumstances, the Foundation will share your personal data with regulatory, prosecuting and other governmental agencies or departments, and parties to litigation (whether pending or threatened) in any country or territory.
Business transfers. The Foundation may share personal data with relevant third parties in connection with, or during negotiation of, any merger, reorganization, restructuring, financing, transfer of some or all of the Foundation's assets or operations, or similar corporate transaction, including in the event of insolvency or dissolution. Any successor's use of personal data remains subject to this Privacy Policy as then in effect.
14. Changes to this Privacy Policy
The Foundation may update this Privacy Policy from time to time. The Foundation will post the updated Privacy Policy at https://docs.nexus.xyz/legal-and-disclaimers/privacy-policy and update the "Last Updated" date in the header. Material changes apply prospectively: an updated Privacy Policy applies to personal data collected after the update takes effect, except where applying the prior version would be inconsistent with applicable law. Continued access to or use of the Services after an update takes effect constitutes acceptance of the updated Privacy Policy.
15. Contact
For questions about this Privacy Policy or about your personal data, you may contact the Foundation at:
Nexus Foundation c/o Walkers Corporate Limited 190 Elgin Avenue George Town, Grand Cayman KY1-9008 Cayman Islands
Email: privacy@nexusfnd.org
Last updated