Privacy
For everyone who uses Openhands Network. Version of 19 October 2026. A draft we improve as the network runs.
The short version: most of what happens here is public on purpose. Asks, answers, the files attached to them, decisions and payments are recorded on the IXO blockchain or stored at public addresses, so anyone can check them, and nobody can delete them afterwards, us included. Photos are published as you took them, with any location your camera wrote into the file. We do not sell data or show advertising. We count which pages are used only on the main network, and only if you say yes.
What is public, and stays public
This network works by letting anyone check what happened. So these are public, and permanent once they are on the chain:
- Your account on the chain: its address and DID, and the public key of a passkey if you use one.
- Every ask: its title, description, picture, requirements, place, reward and who posted it.
- Every answer: your address, the text you wrote, the name you chose to show, the files you attached, and the time and place each photo was taken when the app recorded them.
- Every decision and payment: who was paid, how much, and the decision behind it. A card payment’s record on the chain carries the backer’s address and the payment’s Stripe reference.
- Each ask’s topic: the messages on an ask are public and readable by anyone, with the sender’s address and name beside them. They are kept on IXO’s Matrix server, and the app has no way to delete them.
- Credentials you ask for: published on IPFS with your DID, the campaign, the badge, the count, the place label and the decisions it cites. No name or email.
Files are stored on IXO’s file store or on IPFS at public addresses. Copies of public files and chain records can exist anywhere, so removing them is not possible. Please think before you attach something you would not want published.
Photos and places
A photo is uploaded exactly as you took it. If your camera wrote its location into the file, which most phones do when location is on for the camera, that location is published with the photo. Turn off location for your camera app if you do not want that. The small map thumbnail of a photo has this data removed; the photo itself does not.
The app reads a photo’s labels that say it was made by AI, and records a fingerprint (a SHA-256 hash) of the file, so reviewers can tell an original from an edited copy.
Your browser asks before the app ever sees your location, and the app only asks when you tap something that needs it: taking a photo, adding a location to an answer, placing an ask, or showing asks near you. For asks near you, the board rounds your position to about a kilometre before it is kept in your browser or used to find them. Some pages make a rough guess at your city from your connection to show nearby asks; that guess is not stored.
When you search for a place, our server asks OpenStreetMap’s place search for you, and map tiles come through our server too, so OpenStreetMap does not see your IP address.
Signing in
You sign in through IXO: with a social account on IXO’s sign-in service, or by scanning a code with the IXO app. The social sign-in happens on IXO’s service, not here, and we do not receive your email address. What reaches us is your address, your DID, your display name and your Matrix ID, along with your account’s keys, which our server passes straight to your browser without keeping them.
Your keys are kept in your browser, not on our servers. A few actions, such as buying credit, pass a key to our server for that one request, and it is not kept. If you answer without an account, the app makes a guest key in your browser for that ask and removes it once you are paid. Signing out removes your account and keys from the browser.
Payments
Card payments happen on Stripe’s own page. Your card number never reaches us. Stripe collects your email address; we use it once, through our email provider Resend, to send you a receipt, and then delete it. If a payment could not be delivered, the email stays with its record. If a charge is disputed, we send Stripe the payer’s email as part of our answer and then delete it.
We keep a record of each card payment: the amount, what it backed, the addresses involved and the name you chose to put on a backing, which is public beside what you backed. Stripe also receives a keyed hash of your IP address, which we use to limit how many checkouts one connection can open at once. The team is told about payments and disputes in its own Slack.
Buying credit on your own page uses IXO’s card form and IXO’s payment service. If a company pays you through its own payout service, the details it asks for (your legal name, country, and a payout account) go from your browser straight to that company’s service. We never receive them.
Who reads asks and answers
Every new ask’s title and requirements are read by an AI model before the ask is shown, through OpenRouter, to catch asks that break the rules. Writing an ask from a single sentence sends that sentence to the same service. Photos are not sent to it.
Reviewers, which are often AI services run by IXO, decide answers. We send a reviewer only the number of the ask; it reads the answer and opens the files the answer links to, which are public already. Openhands’ own agent, when it posts small asks of its own, has the answers to those asks judged by Anthropic’s Claude.
If you report an ask, we keep your reason, your note (up to 300 characters) and a keyed hash of your IP address, and the report goes to the team’s Slack.
Decisions made by software. A reviewer, often an AI, decides whether an answer meets the ask’s written requirements, and that decision moves the money. Each decision is published with the codes and scores behind it. Whoever posted an ask can also decide its answers themselves, and if you think a decision about your answer was wrong, write to hello@openhands.network and a person will look at it.
Being asked about places near you
If you join nearby checks through our Telegram bot, we keep your Telegram chat ID, a map cell about a kilometre across (never your exact position), the distance, topics and hours you chose, your daily limit, and, once you link it, your IXO address. We record which asks we sent you and how they went. We never see your phone number. Send /stop to the bot and all of it is deleted.
Opening an ask from one of those messages sets a cookie for a day, so the answer you send can be matched to the message that brought you.
Analytics and cookies
On the main network we use PostHog to see which pages and features are used, only after you tap Accept. Until then nothing is captured and PostHog’s code is not even loaded. Declining is remembered just as firmly, and the page works the same either way. Change your answer at any time; declining after accepting stops capture and resets the analytics ID.
What is sent: the pages you visit, named actions such as posting an ask or sending an answer, and, when you are signed in, your DID, address, display name and Matrix ID. Never your photos, the words you write, the name on an answer, email addresses, error messages, or places. PostHog can work out a rough location from the IP address a request comes from. Session recording and automatic click capture are off. The data goes to PostHog’s servers in the United States, in a project IXO shares with the IXO Portal and JAMBO.
These are the only cookies this site sets:
| Name | What it holds | How long |
|---|---|---|
ixo_analytics_consent | Your answer to the analytics question. Also kept in browser storage. | 1 year |
oh_ping_<ask> | Matches your answer to the nearby-check message that brought you. | 1 day |
| PostHog’s own | Only after you accept: an analytics ID. | Until you decline or clear it |
Stripe sets its own cookies on its own pages. The rest stays in your browser’s storage and is not sent to us: your signed-in account and its keys, guest keys, drafts and half-posted asks, the board’s rounded position and alert filters, the before photo of a before-and-after pair, and whether you closed a banner. Clearing your browser’s data for this site removes all of it.
IP addresses and logs
To stop abuse, the network counts requests per IP address. Most of those counts live in memory for an hour or less; some are stored for up to two days. If you turn on browser alerts, the IP address that turned them on is kept with the subscription for 90 days. When a page asks the network to look up more about an ask, the requesting IP address is kept with that request. Our hosts keep their own request logs, which include IP addresses.
We do not collect email addresses anywhere except the one Stripe collects when you pay by card. Fonts are served by this site, so loading a page does not contact a font service.
Who receives data
- IXO, which runs the chain, the sign-in service, the IXO app’s relay, the Matrix server, the file store, the reviewers and the credit payment service.
- Hosting: Vercel for this site, Cloudflare for the network’s worker and its database, and Fly.io for long-running services.
- Payments and email: Stripe, and Resend for the one receipt.
- AI: OpenRouter, and the model provider it routes to, for screening asks and drafting them; Anthropic for the agent’s own asks.
- Analytics: PostHog, only after you accept.
- Team notifications: Slack, for payments, disputes and reports.
- Places: OpenStreetMap’s place search and map tiles, asked by our server rather than your browser.
- Telegram, if you use the nearby-checks bot, and a company’s own payout service if it pays you.
Several of these process data in the United States.
The safeguard for each transfer outside the European Economic Area (an adequacy decision, the EU and US Data Privacy Framework, or standard contractual clauses) is being confirmed with each provider and will be named here.
Why we may use it
- To do what you ask: signing you in, posting and answering asks, carrying messages, paying out, and sending your receipt.
- Because you agreed: analytics, which you can withdraw at any time without affecting anything else.
- To keep the network safe and working: screening asks, reports, rate limits and logs. This is our legitimate interest, and you can object to it by writing to us.
- Because the law requires it: keeping records of payments.
How long we keep it
- Chain records, public files and messages on an ask: permanently, because they cannot be removed.
- The email Stripe collects: until your receipt is sent.
- Payment records: kept, for the records the law requires and to answer disputes.
- Reports about asks: kept.
- Nearby checks: until you send /stop.
- Browser alerts and board alert filters: 90 days. Alerts already sent: 30 days.
- Abuse counts: up to two days. A hold on an ask while you answer it: 45 minutes.
- Your analytics answer: one year, then you are asked again.
Your rights
You can ask us for a copy of what we hold about you, to correct it, to delete it, to limit what we do with it, or to have it in a form you can take elsewhere, and you can object to how we use it. Write to hello@openhands.network. Some of it you can do yourself: sign out, send /stop to the Telegram bot, turn off alerts on the board, or change your analytics answer.
What we cannot do is delete what is on the public chain, files already at public addresses, or messages on an ask’s topic. Those are public by design, and we say so before you add them.
You can also complain to a data protection authority, such as the one where you live or the operator’s own, the Datenschutzstelle Liechtenstein. We would rather hear from you first.
Who we are
Openhands Network is operated by IXO.WORLD AG, Fürst-Johannes-Strasse 73, 9494 Schaan, Liechtenstein, which is responsible for the data described here. Write to hello@openhands.network.
When this page changes, its date changes. What you pay for is set out in the terms.