Privacy Policy

1Who we are

MLX (mlx.app, wallet.mlx.app, explorer.mlx.app and distributor.mlx.app) is run by the MLX Network operator, MLX Foundation, Zeughausgasse 7A, 6300 Zug, Switzerland (“we”, “us”). We are the controller of the personal data described here.

Privacy questions and requests: support@mlx.app. [Data protection officer, if appointed]. [EU and UK representative, if required]

2First: the ledger is public

MLX Network is an open ledger. Anyone can see it on the Explorer and through the open data API, and we can’t hide or delete what is on it. That includes:

• your wallet name and public key, and the wallet that invited you, if any;
• your balances, transfers, spot trades, deposits credited and withdrawals, including the Solana address you withdraw to;
• your dedicated seats: tier, seat number, reward, unlock date, the device details you pledged (device class, chip, CPU cores, memory, screen, model) and country;
• the blockchain transaction that paid for a seat or deposit.

Payments you make on Solana, Ethereum, BNB Smart Chain, Tron or Bitcoin are public on those blockchains too, and can be linked to your MLX activity by anyone who compares them.

3What we collect

Visitor analytics (every visit)

We run our own analytics. No third-party analytics, advertising or tracking scripts are loaded. When you visit any MLX site, your browser gets a random visitor ID (cookie mlx_vid, also kept in local storage) and sends events to /api/t. With them we record:

• Network and location: your IP address, and the approximate location our host derives from it (country, region, city, postal code, latitude and longitude, time zone).
• Device and browser: the user agent (browser, operating system, device type and, where the browser reports it, the device model), screen size and pixel ratio, window width, time zone, preferred languages, platform, CPU core count, device memory, connection type, whether the screen is touch and whether MLX is installed as an app, and whether the browser says it is automated.
• How you arrived: the referring site and any campaign tags in the link (utm_*, ref, src), stored with your first visit.
• What you do: pages viewed, links and buttons you tap (their label, with email addresses and long numbers masked), JavaScript errors, and steps such as creating or unlocking a wallet, opening a deposit, paying, buying a dedicated seat, or buying MLX. A heartbeat every 20 seconds while a page is visible shows us who is online now.
• Your wallet name: when you unlock a wallet, we link your visitor ID to your wallet name, and payments and purchases on the server are recorded against it. We may also link visitor IDs that share an IP address or wallet, to understand whether they are the same person and to prevent fraud.

Known search engine and AI crawlers are counted by name and page only. Visits from our own staff are marked and left out of the statistics.

Your wallet

Your wallet secret, passkey and recovery phrase never leave your device; we never receive them. Your passkey is stored and synced by your passkey provider (for example iCloud Keychain or Google Password Manager) under its own privacy terms. We receive your public key, the wallet name you choose, and the transactions you sign, which go on the public ledger.

The wallet’s device list, which shows you where your wallet has been used, is built from the analytics above (device, browser, approximate place and first and last seen). Only you can see it, after your wallet signs the request.

Payments, deposits and withdrawals

For each checkout we keep a quote record: your wallet name, what you are buying (seat tier or deposit), the device details and country you pledge, the network, coin, amount and dollar value, the payment reference, the matching blockchain transaction, and timestamps. For withdrawals we keep the amount, the Solana address and the payout transaction. We don’t collect card or bank details.

If we need to check identity or the source of funds for legal reasons (see the Terms of Use), we will tell you what we collect at that point. [Identity verification provider and data, if any]

Builders

• Grant applications: your name, GitHub username, project, link, what you have built and plan to build, amount requested, wallet name and contact details you give.
• Cluster, API and conversion interest forms: your name, GitHub username, wallet name and the details you write.
• Builder seat claims: your GitHub username, the public gist you link and the wallet named in it. We read your public GitHub profile and repositories through the GitHub API to review the claim.
• MLX Bench results: chip, GPU core count, memory, macOS, MLX and mlx-lm versions, the model and the measured speeds, and the wallet name if you add one. Results are shown on the public leaderboard. The script sends no files, hostname or other personal data.

To limit spam, we count submissions per network using a one-way hash of your IP address; those counters expire within a day.

Distributors

If you apply to be a distributor, we keep your wallet name, your name, contact, website, audience, country and plan, your link code, your status and our notes on the decision, the clicks on your link (as daily counts), and the sales and commissions credited to you.

If you arrive through a distributor’s link, cookies (mlx_d, mlx_dref) remember that distributor for a year, and when you create a wallet or buy, your wallet is tied to them. That distributor sees your purchases credited to them (date, seat or MLX purchase, amount, tier and seat number) with your wallet name partly masked, for example al···x.mlx.

MLX Node for Mac

MLX Node (also when MLX Harness installs it) holds its own device key, which never leaves the Mac. Linked to a wallet, it sends a signed status about once a minute: app and macOS version, chip, memory, CPU cores, whether it is working, paused or waiting and why, temperature level, whether it is on power, the limits you set and its measured speed. For each hour it works we keep which minutes it was available, the jobs it was given and finished, its answers to them and whether they agreed with other Macs’. We use these to send it work and to calculate compute rewards, which are public on the ledger. The hourly records are deleted after three days and answers to everyday jobs after 30 days; the latest status, and answers to the few fixed test jobs, are kept while the Mac stays linked.

MLX World. A linked Mac appears on the public map at world.mlx.app. From each status it sends, we keep the city, region and country our host derives from the Mac’s IP address, with coordinates rounded to about 10 km; we don’t keep the IP address for this. The map shows, for each Mac, only an anonymous identifier, the kind of Mac (from version 0.8.3 the app also sends its hardware model, such as “Mac16,10”), its chip and memory, whether it is working, ready, paused or offline, when it last checked in and that approximate city. It never shows your wallet, the Mac’s name, its IP address, speed, jobs or earnings; those appear only to you, after you sign in with your wallet. The network’s totals (Macs working, tokens a second, AI tokens today) are sums over all Macs. The location is kept for seven days after the Mac last checks in, and the Mac leaves the map at its next check-in after it is unlinked, or once it has not checked in for seven days. A VPN or mobile network may place a Mac somewhere else.

The MLX.app iPhone and iPad app

The app signs in with your wallet’s passkey or recovery phrase on your device; the key it derives never leaves the device, and we only receive requests it has signed with your wallet name. We use them to show your Macs, their status and what they mined, and to pass your pause, resume and limit changes to your Macs. If you turn on notifications, we keep the push token Apple gives the app (it holds no personal details) with your wallet name and language, to tell you when a Mac stops or comes back and what your Macs mined each day. Turn notifications off, or sign out, and the token is deleted.

Mac beta and notifications

If you join the Mac beta, we keep your email, the chip, memory and number of Macs you tell us, your wallet name if your browser has one, your country and language, and when you joined. We use them only to invite you to early builds and tell you about releases, and delete them when the beta ends unless you ask us to keep you on the list.

If you turn on notifications, we keep the push address your browser gives us (it holds no personal details) with your wallet name, so we can tell you when a seat is recorded, a commission is paid, a withdrawal is sent or the halving is near. Turn them off in the wallet and the address is deleted.

Email from Wombat Rewards

Where the address comes from. Wombat, a play-to-earn gaming platform, partners with MLX. Emails about MLX go out as “Wombat Rewards” from wombat.im to people with a Wombat account, using the address and username Wombat shared with us under that partnership, and to people who joined the Wombat Rewards list themselves at wombat.im or wombat.my (confirmed by a link we email them).

What we keep. For each email we send: a one-way hash of the address (not the address itself), the Wombat username if we have it, the country, the language, which email and subject line it was, when it was sent, and whether it was delivered, opened (through a tracking pixel), clicked (through tracked links), or led to a download of MLX Node, a wallet, a linked Mac or a dedicated seat (through the cookie mlx_wb, set for 180 days when you click). For the Wombat Rewards list we also keep the address, the consent text you agreed to and when you confirmed. Our email provider is Resend.

Why, and on what basis. To tell Wombat players about MLX and measure which emails are useful. For the Wombat account list, our and Wombat’s legitimate interests, in the countries where the law allows this kind of email without prior consent; for the Wombat Rewards list, your consent. We don’t send these emails to anyone under 18.

How to stop. Every email has a one-tap unsubscribe link; wombat.im/unsubscribe works for any address. Once you unsubscribe, bounce or complain, we keep only the hash and the reason, so we never email you again. Wombat never gets your clicks or what you do on MLX.

When you contact us

If you email us or fill in a contact field, we keep what you send and our reply.

4Why we use it

We don’t sell your personal data, we don’t use it for advertising, and we don’t make decisions about you by automated means that have legal effects.

5Cookies and local storage

We set only first-party cookies. Cookies on .mlx.app are shared by all MLX subdomains so your theme and wallet name follow you between them.

The browser’s own storage on your device also holds:

You can block or delete cookies and site data in your browser. The site still works without mlx_vid, mlx_d and mlx_dref; clearing storage while your wallet is unlocked locks it. [Cookie consent mechanism for visitors in the EU, UK and other places that require one]

6Who else sees it

We use these service providers. They process data for us under contract and only to provide their service:

Others who may see your data:

• Everyone, for what is on the public ledger and the Bench leaderboard (see above).
• A distributor, for your purchases credited to them, with your wallet name masked.
• Outside grant reviewers, for a Builders grant application you send: what you wrote in it and the links you gave, not your wallet balances or visits.
• Wallet apps you choose at checkout (such as Phantom, MetaMask or Trust Wallet). Opening one hands you over to that app under its own terms.
• Authorities, courts and advisers, when the law requires it or to protect our rights, users or the network.
• A successor, if MLX Network is reorganised, merged or sold, under this policy.

7International transfers

Our providers run servers in several countries, and Vercel serves pages from locations near you. Our database is hosted in [Upstash database region]. Where data leaves the EU, UK or another place with transfer rules, we rely on [Transfer mechanism, e.g. Standard Contractual Clauses].

8How long we keep it

Daily, hourly and breakdown counts are aggregated and don’t identify you.

9Your rights and choices

Depending on where you live, you can ask us to:

• tell you what we hold about you and give you a copy;
• correct it, or delete it;
• limit or object to how we use it, including analytics;
• send it to you or to someone else in a portable format; and
• withdraw consent where we rely on it.

We can’t change or delete what is on the public ledger, and we may need to keep some records to meet legal obligations. To prove a wallet is yours, we may ask you to sign a message with it. We will reply within the time the law sets, usually one month.

Write to support@mlx.app. You can also complain to your local data protection authority. [Lead supervisory authority, if any]

California and other US states: we don’t sell or share personal information for cross-context behavioural advertising. [State-law notices as advised by counsel]

10Security

Traffic to MLX is encrypted (HTTPS). Wallet keys never reach our servers, staff access to the admin is password-protected, and wallet-only views such as the device list require a signature from your wallet. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires.

11Children

MLX is not for anyone under 18, and we don’t knowingly collect data about children. If you think a child has used MLX, contact us and we will delete what we can.

12Changes to this policy

We will update this policy when what we collect or how we use it changes. The date at the top shows the latest version, and we will give notice on the site of material changes.

13Contact

MLX Foundation, Zeughausgasse 7A, 6300 Zug, Switzerland. Privacy: support@mlx.app. General: contact@mlx.app. See also the Terms of Use and the Risk Disclosure.