Privacy Policy

1. Scope & Overview

The Service helps researchers and crypto-native users extract structured scientific knowledge (“triplets”) from open-access academic papers and submit them to the Cortex DeSci on-chain knowledge graph, earning $CXS rewards. This policy describes what data the Service collects, where it is stored, what is sent to third parties, and what we explicitly do NOT do.

2. Information We Handle

2.1 Stored locally on your device (chrome.storage.local)

• Encrypted wallet private key — generated in-browser or imported by you. Encrypted with AES-GCM using a key derived (PBKDF2, 100,000 iterations) from a password that only you know. The password is never stored anywhere.
• Wallet address — your public Ethereum identifier.
• LLM API key you provide (Groq / OpenAI / DeepSeek / custom) — used to call your chosen LLM provider directly from your browser. Stored in plain text in chrome.storage.local; never transmitted to Cortex servers.
• Cortex DeSci API key you obtain from cortexdesci.xyz — used to authenticate mining submissions.
• User settings — mining interval, RPC URL, indexer URL, referral code.
• Mining history & statistics — counts of accepted/rejected triplets and locally derived metrics. Not transmitted.

Local storage is sandboxed per extension and is not accessible to websites, other extensions, or Cortex DeSci. You can erase all of it at any time via Chrome's “Remove extension” action or by clicking Reset inside the Extension settings.

2.2 Stored only in session memory (chrome.storage.session)

• Decrypted private key, held in memory while the wallet is unlocked. Cleared on browser close and when you click Lock Wallet.

2.3 Website (cortexdesci.xyz) data

• Wallet address — received when you connect MetaMask or the Cortex extension wallet. We never receive your private key.
• Email address — only if you register as a Researcher user, used for account verification and service notifications.
• Minimal session cookies — for logged-in users. No third-party tracking or advertising cookies.

2.4 On-chain data (public and permanent)

All knowledge triplet submissions are recorded on a public blockchain and are intentionally public. This includes subject-predicate-object triplets, source paper references, timestamps, and your wallet address.

Submissions are written to Robinhood Chain (chain ID 4663) as transaction calldata. Separately, once per day, Cortex DeSci copies the full contents of that day's accepted submissions into a single Ethereum mainnet transaction so the record remains readable if Robinhood Chain or our servers cease to exist.

Both copies include your wallet address. Public-chain data is, by nature, permanent and cannot be deleted, edited, or withdrawn — by you or by us. Do not submit anything you are not willing to publish permanently.

2.5 Not collected at all

The Service does NOT collect, transmit, or store any of the following:

• Browsing history outside the supported academic paper sites
• Personal identifiers (name, phone, IP address used for analytics or profiling)
• Keystrokes, form inputs, or clipboard contents
• Cookies or localStorage from websites you visit
• Advertising or tracking identifiers
• Any data from tabs or domains not in the extension's content_scripts.matches list
• Your password (it is never stored — you re-enter it to unlock)

3. What the Service Sends to Third Parties

3.1 To the Cortex DeSci indexer (api.cortexdesci.xyz)

When you submit a mined triplet, the extension POSTs to the indexer:

• Your wallet address (public)
• The blockchain transaction hash of your submission (public)
• The triplet payload: subject, predicate, object, evidence quote (≤100 chars), confidence
• Source identifier (DOI, PMID, or paper URL)
• Topic / epoch ID
• Your Cortex DeSci API key (as Authorization: Bearer …)

Purpose: record the mining submission for on-chain settlement and reward distribution. No data is stored beyond what is strictly required for reward settlement.

3.2 For AI extraction

To extract triplets, the extension sends the paper's title, abstract, and the sentences selected for extraction to a large language model. There are two paths, and which one is used depends on your settings:

• Default — through our server. If you have not entered your own provider key, the request goes to api.cortexdesci.xyz/api/v1/llm/*, which forwards it to our AI provider using our key and returns the result. This means the paper text passes through our servers and is visible to us in transit. We do not store the paper text or the model output; we record only a per-wallet daily call count, which enforces the free-usage limit. Your wallet address is attached to that count.
• Bring your own key. If you enter a provider key in Settings (Groq / OpenAI / DeepSeek / custom), the call goes directly from your browser to that provider and never touches our servers. We have no visibility into it, and no daily limit applies.

In both cases the provider's own privacy policy governs what they do with the request. If you would rather we never see the papers you read, use your own key.

3.3 To blockchain RPC providers

To sign and broadcast mining transactions, the extension sends signed transactions to a JSON-RPC endpoint (default: https://rpc.mainnet.chain.robinhood.com, or a user-configured RPC). These providers may see your IP address and wallet address per standard RPC operation. You can point the extension at any RPC you trust, including your own node.

The daily Ethereum mainnet copy described in 2.4 is broadcast by Cortex DeSci from our own wallet, not from yours. It costs you nothing and requires no action from you.

3.4 To academic paper websites

Content scripts run only on the academic paper sites listed in the extension's manifest (PubMed, arXiv, bioRxiv, Nature, Science, Cell, etc.). The extension reads the current page's DOM to detect paper metadata (title, abstract, DOI). It does not send that metadata to any Cortex DeSci server on its own; it only does so when you click the Extract or Submit button, and only as part of a submission flow you authorized.

4. How We Use the Information

• Wallet / API keys: authenticate your on-chain and indexer submissions.
• Triplet submissions: credit your wallet in the reward settlement process and record them on the public knowledge graph.
• Local stats / history: shown only to you in the popup so you can see your own mining activity.
• Email (researchers only): send service-related notifications.

We do not sell your data. We do not share it with advertisers. We do not use it to profile you outside the stated reward-settlement purpose.

5. Permissions Requested by the Chrome Extension

We deliberately do not request <all_urls>, tabs, history, cookies, webRequest, downloads, or any other broad permission.

6. Data Retention

• Local data: retained until you remove the extension or click Reset. You control it entirely.
• Indexer-side submissions: retained as long as required for reward settlement auditing. These submissions are intentionally public and become part of the on-chain knowledge graph.
• AI usage counts: when extraction goes through our server, we keep one row per wallet per day holding a call count and token totals — never the paper text or the model output. Rows older than the current quota window serve no purpose and are cleared.
• Email (researchers): retained until you request deletion at admin@cortexdesci.xyz.

7. Security

• Private keys are encrypted at rest with AES-GCM + PBKDF2 (100,000 iterations) using your password.
• The decrypted key lives only in chrome.storage.session, cleared when the browser closes.
• All network traffic is HTTPS.
• The extension ships no telemetry, no remote code execution, and no dynamic eval.
• The extension source code is auditable; reach out if you'd like a pointer to the specific commit published to the Chrome Web Store.

8. Your Rights

You may:

• Disconnect your wallet at any time
• Export your extension wallet private key
• Uninstall the extension to erase all local data
• Request deletion of off-chain data associated with your email at admin@cortexdesci.xyz
• Opt out of non-essential communications

Note: on-chain data (triplet submissions, wallet address) cannot be deleted due to the immutable nature of the blockchain.

9. Children

The Service is not directed at children under 13 and does not knowingly collect data from anyone under 13.

10. International Users

The extension runs entirely in your browser. Any data you submit to the Cortex DeSci indexer is processed on servers located in Germany (Hetzner FSN1, EU). By using the Service, users outside the EU consent to that transfer.

11. Changes to This Policy

We will update the “Last updated” date above whenever this policy changes. Material changes will be announced in the extension's update notes and on cortexdesci.xyz.

12. Contact

Questions, concerns, data requests: admin@cortexdesci.xyz

Website: https://cortexdesci.xyz