Privacy policy

Keryx is a reading agent that answers questions and pays the writers it cites, in USDC on Arc mainnet. Public research is published. The separately labeled private research pilot restricts result access to the paying account, while Keryx and the disclosed AI provider still process the question. Choose the appropriate mode before submitting. We do not sell question or wallet data to data brokers. Hosting and wallet services process operational data as described below.

Your question is sent to our server, which sends it to a configured large-language-model provider to plan the research and write the grounded answer. The question, the answer, the agent's reasoning trace, and the payments it triggered are stored and published at a permalink (/dispatch/…), and canonical questions appear in the public archive. Don't put anything in a question you wouldn't put on a public page.

The free, no-wallet tier is rate-limited by a one-way bucket derived from the IP address. The raw IP is not written to the database or joined to your questions; expired limiter buckets are deleted automatically.

The literature workspace stores saved paper metadata, your review question and screening notes on this browser. It requires no account and has no cloud sync. Keryx does not upload these records when you save, screen, export or restore them. Anyone controlling this browser profile or scripts running on this site can access its local data.

Preparing a comparison puts the saved review question and two paper links in an editable question URL; browser history can retain that URL. Notes and screening decisions are omitted. Submitting the question uses the ordinary research policy described above. Downloaded CSV/JSON files contain your personal notes; keep them in appropriate storage. Clearing the workspace removes its browser record but does not delete exports, browser history or disk remnants.

Private purchasing requires an authenticated paying wallet and an enabled deployment. The private checkout shows the AI provider, model and endpoint before you buy. Keryx and that provider process your question; this is not end-to-end encryption. The private result and history routes require sign-in as the paying account. Private jobs use separate storage and are excluded from the public research archive and public payment activity. Payment records on the underlying network may still be public.

The browser asks you to accept saving the private question and payment signature locally before purchase. Recovery files also contain the question and signature in plaintext. Keep exports in private storage. Importing a file saves a local recovery copy; it does not send a new payment. Anyone controlling your browser profile or scripts running on this site could access local data.

In Research, choose Delete local private data and confirm to remove a saved question and signature from the browser journal. A minimal account/job marker remains to prevent another submission. An exported file can restore recovery access later. Deletion does not cancel a signed or in-flight payment, refund funds, delete the server result, or remove exports, backups, disk remnants or copies in other open tabs. Close other tabs to clear their displayed copies. This is not secure disk erasure.

Keryx keeps first-party daily counters so we can see where the product is slow or confusing: for example, how many landing views became accepted asks and completed answers, or how many creator registrations reached verification, a settled citation, and a cash-out. Each row contains only a UTC date, an allowlisted event name, and a count. It contains no wallet, IP, cookie, fingerprint, user agent, referrer, question, source, or payment identifier. Landing counting uses tab-local session storage only to avoid counting the same tab repeatedly that day; it creates no stable user id and sends requests without credentials. These are event totals, never claimed as unique people.

External wallets use Sign-In-With-Ethereum. Keryx stores your wallet address, your role (asker/creator), and a last-seen timestamp. Keryx does not store your email address, Google password, or phone number in its account records. Everything you do on-chain — registrations, payments, withdrawals — is public on Arc by the nature of a blockchain, and Keryx links to it rather than hiding it. Session keys for browser co-signing are generated in your browser and never sent to us.

Mainnet sessions retain an encrypted signing key on this browser. Logout locks it but does not erase funded recovery or refund a Gateway balance. Clearing browser storage or losing this device can lose access; repeating a wallet signature is not a guaranteed backup. This assumes a trusted application origin and browser: compromised same-origin script can use the stored wrapping key to decrypt custody despite its nonexportability, putting deposited funds at risk.

When Google sign-in is enabled, Google authenticates your account and Circle User-Controlled Wallets handles the linked wallet. Google and Circle process the identity information you consent to share, such as your email and basic profile, under their own privacy policies. Keryx uses the authenticated Circle wallet to sign you in; it does not request access to your Gmail messages, Drive files, or Google password. Google sign-in alone does not authorize spending.

The browser sends the Circle user-session token to Keryx to verify wallet ownership and request wallet actions. Keryx forwards it to Circle for those operations and does not persist it in account records. After sign-in, the browser keeps the user token and signing encryption key in memory. During the redirect, short-lived device credentials and login state are saved in this tab's session storage. The Circle SDK also saves OAuth state, nonce and provider entries in local storage. The Keryx continuation is valid for five minutes; returning to complete the flow removes its continuation and matching SDK entries. Abandoning the redirect can leave expired login data in browser storage. The Google callback token is removed from the page URL after the return flow. A public wallet identity is remembered locally and checked against a current Keryx session before reconnecting.

Reloading requires reconnecting Google for new owner-wallet signatures. Google account recovery does not automatically restore the separate encrypted research signing key retained on this browser. Signing out clears Google wallet signing credentials but retains funded research-key recovery as described above.

See Google's privacy policy and Circle's privacy policy.

A source's name, URL, description, prices, and payout wallet are public — that is the product. Two things stay private: the webhook URL + signing secret you may register for citation notifications, and your content itself, which is stored encrypted on IPFS and only decrypted after a payment. API keys are shown to you once and stored only as a salted hash; we cannot recover them.

The extension sends API requests only to https://keryx.cc. Opening the popup checks research availability before you ask; the service and its hosting provider receive ordinary request metadata such as your IP address. Opening a link navigates to the destination you choose. Specifically:

• When you press Ask, it sends your edited question or selected text, source budget, research depth and scholarly-search choice to the Keryx API. If you check Include this page URL as a source, the displayed page URL is appended to the question. Questions, answers, reasoning traces and associated payment records from this public research flow are published and retained. The configured AI provider processes the question; discovery services can receive search queries. Do not submit confidential or personal information you do not want published.
• When you pick “List this page as a paid source”, it opens the Keryx register page with the page URL and title pre-filled. Open editable question on web puts the edited question and chosen options in a web URL; it can be retained in browser history and processed by the website. Submitting on web uses the research policy above.
• It reads the current tab URL, title and text selection only on your invocation, to prepare editable controls or the requested creator link. It runs a selection-reading script for this purpose, without collecting full-page text or browsing history in the background.
• chrome.storage.local holds the right-click hand-off, including selected text and page context until the popup consumes it, and at most ten completed public report URLs with timestamps. The recent list stores no questions or answers. Clear device list removes only that list; it does not delete hosted reports, browser history or downloaded exports. The extension has no analytics beacon or advertising telemetry. An eligible anonymous result can return a private, short-lived, single-use account-claim ticket held only in popup memory, excluded from storage, report links and exports. Save this research to your account deliberately opens the hosted claim page with the ticket in a URL fragment; the website processes it with sign-in and ownership checks, and browser history can retain the link. Closing the popup loses the ticket. Claiming a run does not make published research private.

The configured reasoning provider processes question text to produce answers under its API terms. When enabled, the experimental Cloudflare Workers AI fallback can process public research questions and source excerpts after other providers fail, or when you select its model. Cloudflare states that Workers AI customer content is not used to train models without consent; see its Workers AI data usage policy. Private research continues to use only the provider disclosed at checkout. Circle and the Arc network process the on-chain payments. Pinata pins the encrypted IPFS content creators upload. Their processing is governed by their respective service terms.

The website is served through Cloudflare. Its performance beacon can send page-load metrics to Cloudflare; see its data collection documentation. Wallet connection tools, including MetaMask and WalletConnect when available, also communicate with their service providers. WalletConnect operational telemetry has been observed on the website. These web services are separate from the extension and from Keryx's aggregate product counters.

Published dispatches and on-chain records are retained indefinitely — they are the public ledger the product is built on. Expired rate-limit buckets are deleted; aggregate product counters retain only daily totals. Private pilot records are retained for operation and recovery; no automatic server deletion schedule currently applies. Local deletion does not remove server records or operational backups. If this policy changes, the date above changes with it. Questions, corrections, or deletion requests for off-chain data: [email protected]. On-chain data cannot be deleted by anyone, including us.