Privacy Policy

Information pursuant to Art. 13 GDPR. Last updated: 2 September 2026.

1. Controller

The controller responsible for data processing is:

2. What this application is

WEN (wen.nocturne-standards.org) is a prediction-market application operated by Nocturne Standards and running against a public Dusk test network. Positions are settled in test tokens that have no real-world monetary value. This is not a financial product and no real funds are at stake. Using it still involves processing personal data (for example your test-network account address and your IP address), so this policy applies regardless of the testnet character.

The hosted UI is a public testnet demo. On-chain identity verification (Citadel / contract KYC) is off in this deployment. Soft onboarding (participant id plus a self-transfer memo proof) is not that KYC gate.

3. Hosting and server log files

Frontend. The portal (wen.nocturne-standards.org) is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany). The hostname is proxied through Cloudflare.

Whenever you visit this site, the hosting provider automatically processes information that your browser transmits, in particular IP address, date and time of the request, the file or URL requested, amount of data transferred and status code, browser type and version, operating system, and referrer URL. This data is processed solely to ensure reliable, secure delivery of the website and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR. We use Cloudflare's Free plan without Logpush configured, so we do not receive or store raw request logs ourselves. Cloudflare's own retention is governed by its privacy policy, not by a period we set.

Because Cloudflare, Inc. is a US company, your data may be processed outside the EU/EEA. This transfer relies on Standard Contractual Clauses (Art. 46(2)(c) GDPR) and/or Cloudflare's EU-US Data Privacy Framework certification, where applicable. See Cloudflare's privacy policy and Data Processing Addendum.

Bot Fight Mode may place a __cf_bm cookie (and cf_clearance if you pass a challenge). Both are strictly necessary for defending the site against automated abuse, so no consent banner is required. The legal basis is Art. 6(1)(f) GDPR.

Operator write proxy. On the hosted hostname, market metadata and hide writes go through same-origin Pages Functions (/api/markets/...) so the browser never sees the API's operator Basic Auth. Cloudflare processes those requests (path, IP, and the Function's server-side credentials to the API). End-user browsers do not receive those operator credentials as cookies.

Backend / trading API. api.wen.nocturne-standards.org is the service the portal uses to fetch markets, register participants, accept trades metadata, leaderboard data, and feedback. It runs on a server we operate (DNS-only at Cloudflare, not proxied, so Cloudflare does not see this traffic). Every request is logged by nginx on that server, recording IP address, timestamp, requested path, status code, and browser user-agent string. These logs are used solely to operate, secure, and troubleshoot the API, under Art. 6(1)(f) GDPR. Log files are rotated daily and kept for 14 days in compressed form, after which they are deleted (via the server's /etc/logrotate.d/nginx configuration).

4. Data stored in your browser (local storage)

WEN stores information in your browser's local storage (not cookies). This data stays on your device unless a feature listed below explicitly sends it to our API. None of it is shared with third-party advertisers. You can clear it by clearing this site's data in the browser. Disconnect / Clear key in the app removes the local participant record and trading-key cache.

Storing this data does not require consent under section 25 TDDDG because it is strictly necessary to provide the trading functionality you request (Art. 6(1)(f) GDPR / Art. 6(1)(b) GDPR to the extent it supports the trades you initiate).

5. Participant registration and trading data

To trade, WEN registers you as a participant on api.wen.nocturne-standards.org. Depending on use, this can include: a participant id we generate, your test-network Moonlight account address, a self-transfer memo proof and its transaction hash, a cryptographic trading-key commitment, and timestamps for creation, verification, and linking. This is processed to operate the market (matching activity, enforcing per-participant limits, attributing trades to a commitment) under Art. 6(1)(b) GDPR (performing the service you use) and Art. 6(1)(f) GDPR (running a fair, abuse-resistant market).

The API also indexes public on-chain market activity (prices, pool reserves, trade tape keyed by trading-key commitment, leaderboard aggregates, achievement holdings). That chain data is already visible on the public test network. The off-chain participant record is what binds a Moonlight address to a trading commitment for this demo. Deposit transactions can still link a funding wallet to a trading-key commitment for that one transaction.

On-chain KYC is off. If a future deployment turns contract KYC on, this section will be revised before that change is offered to users.

6. Beta feedback

If you use the in-app feedback form, we send your message and category together with technical context to /pm/feedback on the API. That context can include the page you were on, URL, market id if any, participant id and status if present in this browser, whether a trading commitment is linked, user-agent, language, viewport size, timezone, and offline flag. The endpoint does not require you to be logged in. As with any request to the API, your IP address is processed as described in section 3. Do not include personal information in the message beyond what is needed to describe the issue.

7. Fonts

This application uses the Inter and IBM Plex Mono typefaces, served from our own host. No connection is made to Google Fonts or any other third-party font service at runtime.

8. Cookies and third-party trackers

WEN does not itself set cookies, and does not embed analytics, advertising, or third-party tracking scripts. The only cookies ever set here are the Cloudflare security cookies in section 3.

9. Connecting a wallet

To trade, you connect a browser wallet (separate software, not operated by us). That wallet's own privacy practices govern how it handles your keys and account data. We only receive what the wallet's connection interface provides to the page (for example the account address you choose to share), as described in sections 4 and 5.

10. External links

This application links to external resources, including documentation, nocturne-standards.org, GitHub, and public test-network explorers. Following such a link takes you away from this application; the privacy practices of the respective provider apply there.

11. Recipients of data

Beyond Cloudflare (UI hosting and Pages Functions named in section 3) and our VPS (API hosting), we do not share your data with third parties.

12. Your rights

Under applicable law, you have the right at any time to access, rectification, erasure, restriction of processing, data portability where applicable, and to object to processing based on Art. 6(1)(f) GDPR. Email contact@nocturne-standards.org to exercise these rights.

13. Right to lodge a complaint with a supervisory authority

14. No automated decision-making

The trading engine executes trades according to published contract rules. It does not make automated decisions producing legal or similarly significant effects about you within the meaning of Art. 22 GDPR.

15. Changes to this policy

This privacy policy is current as of the date above. We will update it if functionality changes (for example if identity verification is enabled, a new backend is added, or retention periods change). The version published on wen.nocturne-standards.org is the one that applies.