PRIVACY POLICY

Short version: we collect almost nothing. Long version follows.

● PRIVACY AT A GLANCE

NOVRIX does not track you. We do not collect your email, IP address, device fingerprint, location, or browsing behavior. Your account is identified by a 12-digit number you choose. We cannot connect it to you. We designed it this way.

SEC·01

WHAT WE COLLECT

We collect the minimum necessary to operate the platform. That means two things:

▸

SESSION TOKEN — A cryptographic cookie stored in your browser. Required to maintain your authenticated session. Expires after 30 days of inactivity. Contains no personal information — only a session identifier.

▸

HASHED PASSWORD — When you set a password, it is hashed with a secure one-way algorithm (bcrypt) before storage. We never store your password in plaintext. We cannot recover it.

That is everything we store that is associated with your account.

SEC·02

WHAT WE NEVER COLLECT

The following data is never collected, stored, or transmitted by NOVRIX:

EMAIL ADDRESS — Not required to create an account.

IP ADDRESS — Not logged at the application level. Cloudflare handles network-level routing but we have no access to those logs.

DEVICE FINGERPRINT — No browser fingerprinting scripts are loaded.

LOCATION DATA — No geolocation, no timezone inference stored.

BROWSING BEHAVIOR — No page view tracking, no click maps, no scroll depth, no session recording.

THIRD-PARTY ANALYTICS — No Google Analytics, Mixpanel, Segment, Amplitude, Plausible, or equivalent.

ADVERTISING DATA — No ad networks, no conversion pixels, no retargeting.

BIOMETRIC DATA — None whatsoever.

SEC·03

HOW YOUR ACCOUNT WORKS

Account creation requires: a 12-digit numeric ID of your choosing, and a password. Nothing else.

Your 12-digit ID is not linked to your real identity in any way we can determine. We have no mechanism to recover it if lost. There is no "forgot password" email flow — because we have no email.

Your account is stored as: the numeric ID, a bcrypt password hash, a created-at timestamp, and a last-active timestamp. There is no name, email, profile, or linked identity.

Account recovery is not possible. If you lose your 12-digit ID or password, the account cannot be recovered. This is a deliberate design choice that protects your anonymity — there is no recovery mechanism that could also be used to force account disclosure.

SEC·04

DATA RETENTION

▸

SESSION TOKENS — Expire after 30 days of inactivity. Invalidated immediately on logout.

▸

ACCOUNT RECORDS — Retained while the account is active. No automatic deletion schedule.

▸

APPLICATION LOGS — No application-level logs are retained beyond what Cloudflare Workers emit during request processing. These are ephemeral and not stored.

▸

ON-CHAIN DATA CACHE — Public blockchain data (indicator history, price data) is stored in our D1 database. This is public data with no personal association.

We do not run scheduled log retention or deletion jobs because we do not produce application logs that require retention.

SEC·05

THIRD PARTIES

NOVRIX uses one infrastructure provider: Cloudflare. They handle DNS resolution, content delivery, and DDoS protection at the network layer. We have no control over their infrastructure-level logs, which may include IP addresses and request metadata as part of standard CDN operation.

Cloudflare's privacy policy governs what they collect at the network level. We do not receive this data and have no access to it.

Data source APIs (BGeometrics, Alternative.me, Etherscan) are queried server-side by NOVRIX infrastructure. Your browser never contacts these APIs directly. These requests contain no user-identifying information.

SEC·06 · #COOKIES

COOKIES

NOVRIX uses exactly one cookie:

▸

nvrix-session — Session authentication token. HttpOnly, Secure, SameSite=Strict. Set on login. Cleared on logout or after 30 days. Contains a session identifier, not your account ID or any personal data.

There are no analytics cookies, preference cookies, advertising cookies, or tracking cookies.

SEC·07

CONTACT

The operator of NOVRIX is anonymous by design. There is no email address, no support ticket system, no contact form. This is not negligence — it is policy.

For public discussion, the Telegram community at @NOVRIX404 is the only available channel. Platform operators do not identify themselves there.