Privacy Policy

1. The short version

You can read the public console without an account. While you only browse, this website stores nothing in your browser.
Cloudflare hosts and delivers this website, and Cloudflare Web Analytics measures its page views.
Signing in sends your wallet address and a signed message to Gao ID, a separate service.
When you bind a node, the node registry links the node to your Gao ID. It does not store your wallet address, email or IP address with the node.
The network's directory, leases and usage summaries are public by design.
Not all relay traffic is end-to-end encrypted. Relays see IP addresses, timing and routing identifiers, and some records are kept permanently. Sections 7 and 10 explain exactly what.

2. Who is responsible

Toii Labs LLC ("Toii Labs") is responsible for this website.

Gao operates the node registry, which records who owns each node, and the relay control plane. In this policy, "we" means Toii Labs and, for the node registry and the relay control plane, the entity that operates them.

Other parties handle information independently, under their own policies:

Gao ID, the identity service you sign in with.
Node operators, who run nodes on their own infrastructure.
Cloudflare, which hosts this website and the node registry.

Write to privacy@gao.global about anything in this policy.

3. When you browse

Cloudflare processes your IP address and the details of each request, such as the page address and your browser's user agent, to deliver this website and protect it from abuse.

This website loads Cloudflare Web Analytics, a script from Cloudflare that sends page-load and performance measurements for each page you view to Cloudflare. We use it only to understand traffic in aggregate.

The console reads public network information from our servers and shows it to you. While you only browse, the website sets no cookie and writes nothing to your browser's storage.

Signing in asks your wallet to sign a short message. This website passes the following to Gao ID through its own server: your wallet address, the network's chain identifier, the signed message, and your browser's user agent. Gao ID returns your session.

Cookies. Gao ID sets its session cookies on this website's address through that same server. They cannot be read by the page's scripts.
Memory. Your short-lived access token is kept in the page's memory and never written to storage.
Local storage. The website keeps two items in your browser: gao-wallet (your connected wallet address) and gao-wallet-rdns (which wallet you used), so it can reconnect. Disconnecting removes them.

5. When you bind a node

The node registry keeps one record per node:

its NodeID;
the identifier of the Gao ID that owns it;
its status, platform, node class and capabilities;
when it was bound, and a digest of the binding proof;
its ownership history: each owner and the period they owned it.

It does not keep your wallet address, email address or IP address with the node record.

Anyone can look up a node's public view: its status, whether it is bound, its platform, class and capabilities. That view never shows your Gao ID or your wallet. Your own list of nodes is shown only to you, after you sign in.

6. Network information that is public by design

Gao DePIN publishes information so that anyone can check the network. Anyone can read and copy it, and we cannot recall copies once published.

The signed directory. For each serving node: its NodeID, provider key, node class, public endpoint address, profiles, self-declared region, conformance and admission expiry.
Usage summaries. Each serving node publishes counts and byte totals per application, profile, shard and hour. They contain no message content, routes or recipients. On a shard that few devices use, a total can approximate the activity of those few devices.
Contribution checks (probe.v1). The contributors that verify serving nodes, and their rounds and results.

7. Traffic that relays carry

Applications send data through serving nodes using one of three profiles. Only two of them are end-to-end encrypted.

What a relay can read, and how long it keeps a delivery
Profile	Can the node read the content?	Longest a delivery is kept
`mailbox.v2`	No. The application encrypts it end to end; lengths are rounded up to hide exact sizes	7 days
`group-object.v1`	No. The application encrypts it end to end	7 days
`queue.v1`	Yes. It is protected only in transit to the node; the node operator can read, keep until deletion, and measure every payload	3 days

On the production network today, the only registered application uses the two end-to-end encrypted profiles.

For every profile, a serving node sees each client's IP address, the timing of each send, fetch and acknowledgement, an opaque recipient route, an opaque sender identifier and a delivery identifier. The protocol never gives it encryption keys, contacts or group membership; for queue.v1, anything an application puts inside a payload is readable.

A delivery is deleted when it is acknowledged, revoked or purged, or when it expires. The node's database deletes securely, but we cannot guarantee erasure below the file system of a computer we do not run.

The relay control plane sees lease requests and node descriptors, and nothing about individual messages. No owner identity is stored in it.

Node operators are independent. Logs on their own computers, and how long they keep them, are outside our control.

8. Why we use information

to provide the website, the console and sign-in;
to record who owns which node, and to admit and operate the network;
to keep the website and network secure, including limiting request rates by IP address;
to understand traffic in aggregate;
to meet legal obligations and enforce our terms.

We do not sell personal information, and we do not use it for advertising.

9. Who receives information

Cloudflare, which hosts this website and the node registry, delivers its pages and runs Web Analytics.
Gao ID, for sign-in.
Node operators, who see the network information described in section 7.
The public, for the information described in section 6 and the public view of a node.
Authorities, when the law requires it.

10. How long we keep it

Retention
Information	How long
Request-rate counters (keyed by IP address, wallet or node)	Until their time window ends
Node records and ownership history	Kept. Releasing or retiring a node changes its status; it does not delete the record
Records of the retired wallet-based binding	An unbinding left a permanent record holding the wallet address, chain and the signed messages
Hourly usage on each serving node	32 days; lifetime totals are kept
Relay deliveries	Until acknowledged, revoked or purged, and never longer than the profile's limit (section 7)
Logs of the website and the node registry at Cloudflare	Kept by Cloudflare under its own retention practices

Some records cannot be deleted on request: the signed public directory and copies others made of it, and node ownership history. Section 13 explains what you can still ask for.

11. Security

Connections use TLS. The network's directory and releases are signed. Node keys are made on the node and never leave it. No system is perfectly secure. Report a vulnerability to security@gao.global.

12. Where information is processed

Cloudflare runs this website and the node registry on its global network. Recovery backups of the relay control plane are stored with Amazon Web Services in the United States (us-east-2). Node operators may be anywhere in the world.

13. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to restrict or object to how we use it, to withdraw consent, and to complain to a data-protection authority.

To use these rights, write to privacy@gao.global. We may ask you to sign in with your Gao ID to confirm the request is yours. Where we cannot delete something, such as public signed data or ownership history, we will tell you why and what we can do instead. We will not treat you differently for using your rights.