Privacy Policy

Last updated 15 September 2026

This covers vulcx.xyz, the Vulcx Portal at portal.vulcx.xyz, and the routing API at api.vulcx.xyz. We collect what running those services needs, keep it for a stated time, and do not sell it, share it for advertising, or run analytics or tracking scripts.

Your Portal account

You sign in to the Portal with Google or GitHub. From that provider we receive:

• your verified email address and name, and the provider's ID for your account, so the same login returns you to the same account;
• nothing else — we request only the openid, email and profile scopes on Google and read:user / user:email on GitHub, and never see your provider password.

If your provider's verified email matches an existing Vulcx account, the login is linked to that account. Accounts created before OAuth sign-in may also hold a password hash.

Signing in sets one session cookie (httpOnly, valid for up to 30 days). With each session we store the IP address and browser user agent it was created from. Account actions — signing in, creating or revoking a key, changing fee settings — are written to an audit log with the same two fields, kept for 90 days.

API keys, usage and fees

• API keys are stored only as a hash; we cannot show a key again after it is created.
• Usage: for each key we count requests per endpoint per day, and the USD value of swaps built with it. These counts are kept for 395 days. The WebSocket quote stream is not metered.
• Fee settings: the default fee, fee ceiling and fee wallet address you set on a key.
• Earnings shown in the Portal are read from public Fogo transactions that paid your fee wallet. That data is public on the blockchain regardless of Vulcx.

Requests to the API

Every request to api.vulcx.xyz is logged with its IP address, path, status and user agent, for abuse prevention and debugging. API key values are redacted before logs are written. Web server logs are kept for 14 days and application logs for 7 days. Requests made without a key are rate limited by IP address, in memory.

The swap panel on vulcx.xyz

To quote and build a swap, the panel sends your wallet address, the token pair and the amount to the API. Your wallet signs the transaction in your browser — Vulcx never receives your private keys — and the signed transaction is sent to a Fogo RPC node. Transactions on Fogo are public and permanent.

The API key request form

If you ask for a key through the form, we store what you enter — email, product name and URL, what you are building, expected volume and a contact handle — to review and answer the request.

Other services involved

• Google or GitHub, when you choose to sign in with them — their own privacy policies apply to that sign-in.
• GitHub Pages hosts vulcx.xyz and may log visitors' IP addresses.
• Google Fonts serves the fonts on vulcx.xyz, so your browser requests them from Google.
• Fogo RPC providers receive the transactions you submit.
• Token logos are loaded from the URLs in each token's metadata, which may be third-party hosts.

Deleting your data

To delete your account, its keys and its usage records, message us at t.me/vulcxsupport from a handle we can tie to the account, or tell us the account's email. Audit and server log entries expire on the schedule above. Anything recorded on the Fogo blockchain cannot be deleted by us or anyone else.

Changes

If this policy changes, the date at the top changes with it. Material changes to what we collect will also be noted in the Portal.