Privacy Policy

xMerch is non-custodial and does not require an account to trade or browse markets. We collect only what's needed to run the app:

• Wallet address — your public XRPL/Xahau address, stored locally in your browser when you connect via Xaman so the app can display your balances and orders. Public wallet addresses and their on-chain activity are inherently public ledger data, visible to anyone, independent of xMerch.
• Basic request logs — IP address, browser type, and timestamps, collected automatically for security and reliability. Not linked to your wallet identity.
• Optional analytics — only if you accept the analytics cookie banner.
• Admin account email — if you sign in to the control panel, used solely for authentication, never shared or displayed publicly.

• Essential cookies — session/auth tokens, always on, required for the app to function.
• Optional analytics — opt-in; if accepted, we load anonymized usage analytics. No advertising or marketing cookies.
• Local storage / IndexedDB — UI preferences and your connected wallet address, stored on your own device.

Consistent with data-protection norms in the EU, UK, and Switzerland, analytics is disabled by default there. Visitors from the US, Singapore, the Philippines, South Korea, and China have analytics enabled by default. Everyone can change this anytime via the cookie banner.

We rely on a small number of third-party services to operate xMerch:

• Xaman — wallet connection and transaction signing, governed by its own privacy policy.
• Application infrastructure — database and authentication services used to run the app.
• Hosting and analytics infrastructure — serves the app, and (only if you opt in) provides anonymized usage analytics.
• Public price-feed data — reference prices (e.g. XAH/USD); no personal data sent.

We do not sell personal data, and we do not share it with third parties for marketing purposes.