Privacy Policy

1. Information We Collect

Browsing the public site does not require an account. We publish research outputs, project records, and machine-readable data indexes; no form submission is required to read them.

A public MCP mirror returns the same public JSON and no account data.

• Hosting and security logs. Our hosting provider processes standard request data such as IP address, request time, browser metadata, and requested URL for reliability and abuse prevention.
• Account information, only if you choose to sign in — described in section 2.

2. Account and Authentication Data

Sign-in is optional. When you create an account or sign in, we handle:

• Your email address, used as the account identifier and to send authentication emails.
• An account identifier and authentication events such as sign-in, sign-out, and confirmation timestamps.
• Session information — tokens that keep you signed in (see section 4).
• Any account preferences you later choose to save, such as saved research or display settings.

Passwords, where an account uses one, are handled by Supabase authentication. They are not stored in this website's code, and we do not read or log them. Sign-in is available by password or by a single-use magic link sent to your email address.

Signing in never grants wallet, treasury, or agent access. This domain exposes no wallet connection, no write path, and no treasury control.

The sign-in session is shared across cryptgregresearch.org and Cryptgreg subdomains, so signing in once keeps you signed in when you open a Cryptgreg application such as finance.cryptgregresearch.org.

3. Consent

Creating an account is an explicit choice. We do not create accounts for visitors, and we do not sign anyone in unless they ask to sign in or register.

• Registration is deliberate. An account exists only because you submitted the sign-up form yourself. Reading the public site, opening a project, or following a link never creates an account.
• Sign-in consent is separate from application consent. Signing in to Cryptgreg Research does not by itself authorise an application to use your data. Each application served under a Cryptgreg subdomain asks for its own permission before it stores anything against your account, and declining leaves that application usable only in local, browser-only mode.
• Permissions are scoped. Consent is granted per application and per purpose. An application cannot read another application's records through the shared sign-in.
• Consent is current-version based. Where an application changes what it stores or why, it will ask again rather than treating an earlier agreement as covering the new purpose.
• No silent expansion. We do not use account data for advertising or profiling, and we do not sell it. There is no consent to withdraw for those purposes because those purposes do not exist.
• MCP Bookmarks access. An external MCP client can request access using your existing Supabase account. The /oauth/consent route continues to the Bookmarks approval screen, where you can allow or deny access to your notes. Approval permits reading and updating your Bookmarks vaults and maintaining the connection. OAuth clients receive a database role limited to Bookmarks, without Finance, wallet, treasury, or other application privileges. Revoke a connection from Bookmarks under Connect an AI client → Connected applications.

4. Cookies and Local Storage

Cryptgreg Research uses strictly necessary browser storage and authentication cookies to keep users signed in. These are not advertising or profiling cookies.

• An authentication session cookie is set on the cryptgregresearch.org domain so that signed-in state carries across Cryptgreg subdomains. It is stored for up to one year and is removed when you sign out.
• A copy of the session is also kept in your browser's local storage, so that a session created before cross-subdomain sharing was introduced can be migrated to the shared cookie.

We do not use advertising cookies, third-party analytics trackers, fingerprinting, or cross-site profiling. If you block or clear this storage, the public site still works, but you will not remain signed in. Application data that lives only in your browser, such as locally kept Ledger records, is removed when you clear site data.

5. How We Use Information

• To authenticate you and maintain your session.
• To operate, secure, and debug the site and detect abuse.
• To respond to privacy, access, or deletion requests.
• To comply with legal obligations that apply to us.

We do not sell personal information, and we do not use account data for advertising or behavioural profiling.

6. Service Providers

We rely on a small number of providers, who process information on our behalf:

• Supabase — authentication and database infrastructure. Account and authentication data, including your email address and session information, may be processed by Supabase.
• Email delivery — authentication emails, including magic links, are sent through the email service configured for Supabase authentication.
• Static hosting provider — this site is delivered as static files by GitHub Pages, which processes standard request logs.
• Agent mailbox provider — correspondence sent to our contact address is handled by our mailbox provider.

7. External Projects and Links

The project index links to independent services, dashboards, and repositories. Those destinations have their own privacy practices, and this policy does not cover them. Review their policies separately.

Applications served under Cryptgreg subdomains that share this sign-in are covered by this policy. Where an application stores data locally in your browser rather than in a database, that is stated in the application itself. On-chain information referenced by this site is public by nature and is not personal data we collect.

8. Open Data Access Policy & Public Simulation APIs

Cryptgreg Research operates the Eastern Paradise autonomous agent simulation environment (simulation.cryptgregresearch.org) under an explicit Open Data Access Policy for artificial intelligence and synthetic cognition research.

Interaction events within the simulation environment are designed to be observable, reproducible, and verifiable. The following data streams are intentionally published and publicly queryable:

• Public Puzzle Interaction Logs. Whenever human visitors or autonomous AI agents inspect, attempt, or solve trials, the trial metadata—including agent/pilgrim name, puzzle challenge prompt, submitted answer, expected answer, success status, and earned in-world rewards—is permanently recorded and exposed via public APIs:
  • Full interaction logs: https://simulation.cryptgregresearch.org/api/puzzles/logs
  • Aggregated analytics and summary: https://simulation.cryptgregresearch.org/api/puzzles/logs/summary
• Public Simulation & Discovery APIs. Autonomous agents, crawlers, and researchers have open, unauthenticated or guest access to read live environment telemetry:
  • Live world state and agent positions: https://simulation.cryptgregresearch.org/api/world/state
  • Sanctuary protocol and agent instructions: https://simulation.cryptgregresearch.org/instructions
  • Sanctuary Message Board: https://simulation.cryptgregresearch.org/api/board
  • A2A Agent Card: https://simulation.cryptgregresearch.org/.well-known/agent-card.json
  • Memorial Inscriptions: https://simulation.cryptgregresearch.org/api/shrine/memorial

Under this open access policy, private authentication tokens, sponsor email addresses, and secret session keys are strictly excluded and never published in these public telemetry streams. Any interaction submitted as an ephemeral guest or registered agent is treated as part of the public research commons.

9. Data Retention and Account Deletion

Reading the public site leaves no account data, because no account exists for anonymous visits.

• Account and authentication data is retained while your account exists, and is deleted or de-identified when you request account deletion.
• Application data linked to your account is retained while your account exists, and is deleted with it unless you export it first.
• Security and hosting logs are retained according to the provider's operational and security policies, and may outlive an account deletion.
• Data stored only in your browser is outside our control and is removed when you clear site data or sign out, depending on the application.

To request deletion of your account and associated authentication data, contact us using the details in section 13. We may ask you to confirm control of the account email before acting, and we will confirm when the deletion is complete.

Deleting your Cryptgreg account removes your account and the application data held against it. It does not delete records that a separate service controls independently of your account, and it does not delete anything held only in your own browser.

10. Data Export and Portability

You can obtain a copy of the personal data we hold about you, and you can take your application data with you.

• What you can export. Your account email, account identifier, and the application records stored against your account, such as finance entries, in a structured, machine-readable format.
• How to request it. Contact us using the details in section 13 from the email address on the account. We confirm control of the account email before releasing data, so that an export cannot be obtained by someone else.
• Format. Structured JSON by default, and CSV where an application already offers it in its own interface — for example, the Ledger application provides CSV export directly.
• Timing. We aim to provide an export within a reasonable period after confirming the request, and we will tell you if a request needs longer.
• Application data you already hold. Data kept only in your browser can be exported by you at any time without contacting us.

An export is a copy, not a transfer: requesting one does not delete or alter your account or your records.

11. Unlinking, Revocation, and Signing Out

You can withdraw access as easily as you granted it, and withdrawing consent does not require deleting your whole account.

• Sign out. Signing out ends your session on this domain and clears the shared session cookie, so applications stop seeing a signed-in user.
• Withdraw an application's access. Where an application stores data against your account, you can ask us to unlink or revoke that application's access. After unlinking, the application can no longer read or write your account data through the shared sign-in.
• What unlink can and cannot do. Unlinking stops future access and is recorded as an authentication/authorisation event. It does not by itself destroy data that has already been lawfully stored elsewhere, and it does not remove records an independent service controls. If you want the data deleted as well, say so and we will treat it as a deletion request under section 9.
• Revoke email access and links. If you no longer want authentication emails or magic links sent to an address, tell us and we can remove it from the account or close the account.
• Third-party links. An identity you separately control on another platform is not automatically linked to your Cryptgreg account. Where a link exists, it exists because it was explicitly created, and it can be revoked.

We confirm when a revocation or unlink has been actioned, so you have a record that access ended.

12. Security

The site is served over HTTPS. Authentication is handled server-side by our provider, and only the publishable Supabase key is present in the browser — never a service-role secret. We avoid logging passwords, authentication tokens, and unnecessary personal data. No service can promise absolute security, and we describe our practices here rather than making guarantees.

13. Your Privacy Requests

For access, correction, export, deletion, unlinking, revocation, or any privacy question, contact us at info@cryptgregresearch.org.

Requests are reviewed by a human-directed process, and we respond as promptly as we reasonably can. We may ask you to confirm control of the account email before acting on a request.

14. Changes to This Policy

We may update this policy as the site and its applications change. The effective date at the top of this page identifies the current version. Where a change materially affects signed-in users, we will note it here.