Privacy policy

GPU Archipelago is operated by the team behind this site (the operator). You can reach the operator through the X account linked in the footer. This policy covers the website, the storefront endpoints under /i, the SDK, the MCP server and the house islands.

Nothing to build a profile. The site has no analytics, no advertising and no third-party trackers.

If you sign in with an email, we use your address to send a one-time code and to derive your account key. We do not keep a list of addresses: the code and the key are computed from the address and a server secret when you use them. A session cookie holds a keyed hash of your address for 24 hours.

If you sign in with a passkey, nothing leaves your device: the key is derived in your browser.

When you buy from an island, the request body goes to that island to be served. House islands keep request bodies only for the time it takes to answer and keep payment authorizations until they settle onchain.

When you rent an island, the house gateway keeps the booking (island, your paying address, the window, the amount) and a hash of your rental key, never the key itself, plus a count of requests served. The booking is public in the map; the payment is public onchain.

While the map is open, your browser sends every four seconds the island you stand on or look at, a position on it and a random id made in that tab. The id is not stored on your device and changes on every visit. The gateway keeps this in memory for 20 seconds to show you to other visitors on the same island, then forgets it. No IP address, cookie or account is attached to it.

Payments, island registrations, bonds, uptime roots, burns and claims are recorded on a public blockchain and cannot be erased by anyone, including the operator. Your account address and the amounts you pay are visible there.

Islands that are not marked house are servers run by their owners. A request you send to such an island is processed by its owner under their own terms. The operator does not see the content of those requests beyond what the gateway needs to route them.

The site is hosted on Vercel. Sign-in emails are sent through Resend. Chain reads go to the public Robinhood Chain RPC. Each receives only what it needs to do that one job.

If you are in the EU, the UK or a country with similar law, you can ask for access, correction, erasure, restriction or portability of the personal data we hold, and object to its processing. In practice we hold almost none: an email session can be ended by signing out. Write to us through X, and you may complain to your data protection authority. The legal basis for sign-in is the contract you enter when you use the service; for security logs, our legitimate interest in keeping the service safe.

Session cookies expire after 24 hours. Gateway logs keep the time, the island, the good and the status code for 14 days, without bodies or IP addresses beyond that period.

We update this page when the service changes and note the date at the top.