Privacy Policy

1. Who we are

Xyvelis is an independent platform built on the Pi Network ecosystem. It is not affiliated with, endorsed by, or operated by Pi Network or SocialChain. Xyvelis Technologies is the operator and data controller for the data described in this policy.

You can browse the public Atlas map as a guest without signing in. Guest browsing creates no account record and stores nothing about you beyond the map content you view.

2. What we collect

Account. You sign in with your Pi account. We store your Pi username and account identifiers, your profile data encrypted per user at rest, and a mapping between your Pi uid and secondary wallet uids so that your submissions and purchases resolve to one account. If you choose to link one, we also store the wallet address you enter yourself, which anchors your identity across the ecosystem.

Atlas contributions. A place you submit is stored with its photos, description, category, and GPS location samples. These are public by design: photos are pinned to public IPFS storage, and the place appears on the shared map with your username as the discoverer. Community votes, review decisions, and business claims are also recorded against your account.

Claims proofs. To prove you control a business you are claiming, you provide a selfie holding a paper note with a random code generated for that claim. Proofs are private: they are stored in private blob storage under unguessable URLs and delivered only through a server-side endpoint that checks you are a party to the claim and logs every access. When a claim is approved, rejected, cancelled, or withdrawn, the proofs are deleted, and a daily sweep removes any orphaned copies. What remains is a record that a proof was provided and when it was destroyed — not the proof itself.

POS sales. To pay in myPiPOS you show a customer badge: a rotating anonymous hashed token valid for about 30 seconds. When the merchant scans it, the sale is recorded with a link to your account, but the sale record contains no wallet address, no name, and no phone number or other contact details.

Consent records. For each sale we record whether you accepted or declined the sale consent, which version of the consent text you were shown (currently version 2026-10-29.1), and when. Declining cancels the sale session; the sale cannot proceed.

Audit records. Important actions — consents given or declined, linkage deletion requests, claim decisions — are written to an audit log for integrity and dispute resolution.

3. What we deliberately do not collect

No customer wallet address on sale records. You pay from your Pi wallet; we do not copy the address onto the invoice. The invoice carries an account link, not a wallet address.

No name or contact details on sales. No email address or phone number is attached to a purchase, so we cannot contact you about one — and neither can anyone else through us.

No personal documents at rest. Claim proofs exist only while a claim is open and are deleted when it is decided. We do not retain identity documents.

The badge identifies no one. The customer badge is an anonymous rotating token. On its own it cannot be traced back to you, and it stops working within roughly 30 seconds.

4. What is public by design

Atlas content is public. Places, their photos, descriptions and locations, votes, and claim status are published openly — including to public IPFS, where third parties can read and re-publish this content without our involvement. Do not submit photos or locations that reveal private information: private residences, private property, or identifiable people without their consent.

Payments are public by nature. Pi payments are verified on the Stellar ledger via Horizon, where transaction records are public and outside our control.

Public means permanent. Once data is on a public blockchain or IPFS, it is inherently public and effectively permanent. We cannot reliably retract it, and neither can you.

5. How long we keep it

POS sale linkage: 24 months. The link between a sale and your account is severed 24 months after the sale and replaced with a per-invoice keyed hash that cannot be re-linked to anyone.

You can ask us to sever it sooner. A deletion request on a clean sale is honored immediately. If the sale has an open refund or a verification discrepancy, the request is deferred until it resolves, then completed automatically — this protects both parties while money is unsettled.

Claim proofs: deleted on decision. Proof photos are deleted when a claim is approved, rejected, cancelled, or withdrawn; a daily sweep removes any orphans.

Atlas content: permanent. Public POI photos on IPFS cannot be reliably deleted.

Account data: kept while your account is active, and as needed for licensing attribution and record-keeping.

6. Who can see what

You see your own data: your profile, your submissions, your purchases, and the consent records attached to them.

Claim proofs are visible only to the parties of a claim — the claimant, the discoverer, and the reviewers deciding it — through an access-controlled endpoint that logs every read. No public URL exists.

Merchants see their own sales records, including the pseudonymous per-customer label their till displays. When platform-side linkage is anonymized, the merchant's own accounting copy is unaffected: it is their record of their own sale.

Everyone sees public Atlas content and on-chain payment records.

Platform operators can access stored data for security, fraud investigation, and dispute resolution, under access controls on the database.

7. Your rights

Deletion of sale linkage. You can request that the link between a sale and your account be deleted. Clean requests are honored immediately; requests touching an open refund or discrepancy are queued and completed automatically once it resolves.

Consent is per sale, and declining is a right. You are asked at the point of sale. Declining cancels the sale session: no sale proceeds and nothing is recorded as accepted.

Correction. Contact us to correct inaccurate account data.

What we cannot do. Public Atlas content on IPFS and on-chain payment records cannot be retracted.

What does not exist yet. We do not offer an automated data-export tool. If you need a copy of specific data we hold about you, contact us and we will work with you directly.

8. Changes to this policy

We will update this policy as the platform develops. Where a change affects what you are asked to consent to at the point of sale, the sales consent version is bumped, and the version shown in the app matches the version recorded on each of your consents. The "Last updated" date above reflects the current version.

9. Contact

Privacy questions, deletion requests, or anything else: jpmveneracion@gmail.com or @jpx3m on Pi Network.

This copy is scheduled for review by data-protection counsel before production use. Until that review completes, treat this policy as an accurate description of the system as built, not as finished legal text.