Privacy

Who is responsible

xrplorer ApS, CVR 41348534, runs this site, the indexer behind it and the issuer account, and is the data controller for what is described here. Write to info@xrplorer.com.

What we do not do

• No cookies. The site sets none, and neither does the indexer. The one exception is below, under the network in front of the server.
• No analytics scripts, no tracking pixels, no advertising, no fingerprinting, no third‑party scripts. We count requests on the server, not in your browser.
• No accounts of our own. There is nothing to register for; the only account involved is your Xahau account, and that lives on the ledger, not with us.
• No selling or sharing of data. There is nothing to sell.

What stays in your browser

The site keeps a few things on your device so that it works between visits. None of it is sent to us.

Population cache

A copy of the public population data, in your browser's IndexedDB, so the site need not read the whole ledger every visit.

Your choices

Which data source you picked, and an account address you chose to look at, in localStorage.

Wallet sign‑in

If you sign in with Xaman: your account address and the sign‑in token Xaman issued, in localStorage, and for the duration of the sign‑in itself a one‑time code in sessionStorage.

Signing out removes the sign‑in. Clearing the site's data in your browser removes all of it.

Your wallet

Keeper tools prepare transactions for Xaman, a wallet made by XRPL Labs B.V., the Netherlands. When you sign in, your browser talks to Xaman's servers directly; we receive your account address and a token that lets the site ask Xaman to show you a transaction. When you use a keeper tool, the transaction the site prepared is sent to Xaman's servers so that your app can show it to you and you can sign it there. The signed transaction goes from your wallet to the network; it does not pass through us.

What Xaman does with your data is described in its own privacy statement, linked from xaman.app. You can use the whole site without signing in; only the keeper tools need it.

What the server sees

When your browser fetches a page, a script, a preview card or an answer from the indexer's API, our server handles an ordinary HTTP request. Like any web server it keeps an access log: your IP address, the time, the address requested, and what your browser says about itself. We use the log to keep the service running and to see and stop abuse, and for nothing else. Log lines are deleted after 30 days. The legal basis is our legitimate interest in running a working, secure service (GDPR art. 6(1)(f)).

In front of our server sits Cloudflare, which carries the traffic, caches files and keeps attacks off. It sees every request the same way our server does and processes it on our behalf, under a data processing agreement; we see its aggregate counts of requests, bandwidth and countries, not individual visitors. If it suspects a request comes from a bot it may challenge it, and a challenge can set a cookie of Cloudflare's own for that browser. That is the only cookie anything on this site can set, and it is not one we read. Its privacy policy is at www.cloudflare.com/privacypolicy/.

The site also reads directly from a Xahau node, https://xahau-test.net, and links to an explorer, test.xahauexplorer.com. When it does, your browser talks to whoever runs those, and they see what any web server sees. They are not run by us.

The public ledger

Everything the site shows about moebas is read from Xahau, a public ledger. That includes account addresses: who keeps a moeba, who bred it, who sold or gave it to whom and for how much, and the terms a keeper has published. An address is a pseudonym, but if it can be linked to you it is personal data, and we treat it as such.

The indexer keeps a copy of this public data and serves it to anyone who asks, so the site is quick and so that the population and its lineage can be read as a whole. The legal basis is our legitimate interest in making a public record readable (art. 6(1)(f)); the data is already public on the ledger and on every explorer, and it is the record the species depends on.

What that means for your rights: we can tell you what our index holds about an address, and we will correct anything our index got wrong against the ledger. We cannot change or erase what is on the ledger; nobody can, including us. If you ask us to stop showing an address in our index we will consider it against the interest others have in a complete lineage, and tell you what we decide and why.

Your rights

Under the GDPR you may ask for access to the personal data we hold about you, for it to be corrected or erased, for its processing to be restricted, and you may object to processing based on legitimate interest. Write to info@xrplorer.com. If you think we have handled your data wrongly, you may complain to Datatilsynet, the Danish Data Protection Agency, at datatilsynet.dk, or to the supervisory authority where you live.

Where data goes

Our server and its logs are in the EU. Cloudflare is a US company with servers worldwide; a request is normally handled at the edge nearest you, and its transfers outside the EU are covered by the EU standard contractual clauses in its data processing agreement. Xaman is run from the Netherlands. The Xahau node and the explorer the site links to are run by others, and where they are is theirs to say. We do not otherwise transfer anything anywhere.

Children

The site is not aimed at anyone under 18, and the keeper tools must not be used by anyone under 18.

Changes

If any of this changes, this page changes with it and gets a new effective date. If we ever start doing one of the things listed under "what we do not do", it will not be quietly.