Aeon Terminal

Privacy Policy

Aeon Terminal is a community portal for SPX6900 — chat, voice rooms, a shared board, missions and a feed. This page describes what the app actually stores, who else sees it, and what you can do about it.

Last updated 27 August 2026

The short version

  • We collect an email address (or your X account), whatever you put on your profile, and the things you post.
  • We don’t sell anything, don’t run ads, and don’t run an analytics or tracking product.
  • Chat messages and DMs are deleted after six months. Almost nothing else is deleted automatically.
  • Deleting your account anonymises your profile. It does not erase your posts or the files you uploaded — details below.
  • You can download everything we hold on you, any time, from Settings.

1. What we collect

What you hand us

  • Sign-in details. An email address if you sign in by magic link or with a password, plus a hashed password (bcrypt — we never store the password itself). If you sign in with X we store the link to your X account and the tokens X gives us for it.
  • Your profile. Username, display name, bio, avatar image, links to your X / Reddit / YouTube / TikTok / Instagram, and a crypto tipping address. All of it is optional except the username, and all of it is visible to other members.
  • What you post. Chat messages, direct messages, replies, reactions, polls and votes, feed posts, missions, board pixels, and any file you attach.

What using the app creates

  • Presence. A last seen timestamp on your account, and live presence (who is in which room, who is speaking) for as long as you are connected.
  • Progress. Academy chapter results, XP awards, achievement flags, friend requests, and your block list.
  • Notifications. If you turn on push, one record per browser or device: the push endpoint your browser issues and the keys needed to encrypt a message to it.

Uploads

Images, voice notes and other attachments (max 4.5 MB) go to Vercel Blob object storage, not into the database. Each one gets a long random public URL under a path containing your account id. Those URLs are unguessable but they are not access-controlled: anyone holding the link can open the file without signing in.

IP addresses

We don’t store your IP address in our database. Vercel, which hosts the app, sees it on every request and keeps it in its own server logs; some unauthenticated endpoints also hold it in memory briefly to enforce rate limits. Third-party embeds see it too — see section 3.

2. What we don’t do

  • We don’t sell or rent your data, and there is no advertising network in the app.
  • There is no analytics product, no tag manager and no cross-site tracking pixel anywhere in Aeon Terminal.
  • The codebase does contain an optional performance-monitoring module (page-load and responsiveness timings, device class). It is disabled, it has no collection endpoint configured, and it never records who you are. If that ever changes, this page changes with it.
  • We don’t read your DMs for profiling or advertising. Moderators can read reported content — see section 6.

3. Who else touches your data

These are the services the app genuinely runs on. Each one only receives what it needs to do its job.

  • Neon — the Postgres database. Everything in section 1 that isn’t a file lives here.
  • Vercel — hosting, serverless functions, request logs, and Blob storage for your uploads.
  • Pusher — realtime messages, typing indicators and presence.
  • LiveKit — voice rooms. Audio is relayed live; we don’t record voice rooms.
  • Resend — sign-in and verification emails.
  • Your browser’s push service (Google, Apple, Mozilla or Microsoft, depending on your browser) — if you enabled notifications, the endpoint belongs to them and every notification passes through it.
  • X (Twitter) — only if you choose to sign in with X.

Embedded content sees your IP address

The Feed and the Lounge render posts and players from X, TikTok, YouTube, Instagram, Reddit, Facebook, Vimeo, Twitch and SoundCloud by loading each platform’s own embed code directly in your browser. When one of those loads, that platform receives your IP address and user agent and can read or set its own cookies for its own domain — exactly as if you had visited it. We can’t see or control what they do with that, and we don’t receive anything back from them.

We may also disclose data where the law requires it, or to investigate abuse or threats to the safety of the community.

4. How long it is kept

These are the retention rules the app actually enforces, not aspirations:

  • Chat messages and direct messages: six months. A job runs every Sunday at 03:00 UTC and permanently deletes every message older than that, in public rooms and DMs alike. It cannot be undone and there is no archive.
  • Expired sign-in sessions and email verification links are cleared by the same job.
  • Everything else has no automatic expiry. Your account, profile, feed posts, poll votes, board pixels, Academy progress, XP, friend and block records, and every file you have uploaded are kept until you or a moderator remove them.

Server logs are kept by Vercel under its own retention schedule, which we don’t set.

5. Your controls

  • See and edit — your profile is editable in the app at any time.
  • Export — Settings → Account → “Download your data” returns a JSON file with every row you authored or are named in. Limited to three exports an hour. Other people’s messages are excluded, because that is their data, not yours.
  • Block — blocking a member stops their DMs reaching you.
  • Delete your account — Settings → Account → “Delete account”, confirmed twice.

What deleting your account really does

We tombstone the account rather than dropping the row, so that conversations other people took part in don’t collapse into blanks. Being precise about this matters more than sounding tidy.

It removes: your email address, password, avatar, bio, all social links and your tipping address; the link to your X account; every push-notification registration; your pending friend requests; the blocks you created; and any announcement you authored. Your sign-in sessions are revoked within 30 seconds, on every device.

It does not remove: the account row itself — your username becomes deleted_ plus eight characters and your display name becomes “Deleted user”; your existing chat messages and DMs, which stay in place under that anonymous name until the six-month sweep deletes them; your feed posts, poll votes, board pixels, Academy progress and XP; and — importantly — any file you uploaded, which remains at its public URL in Blob storage.

If you want specific messages or uploaded files removed as well, email privacy@6900isbiggerthan500.com from the address on the account and say what to delete. If you are in the UK/EU, this is also how to exercise your GDPR rights of access, rectification, erasure and objection; we’ll respond within 30 days.

6. Moderation

Nothing is screened before it is posted. Moderators act on reports and on what they see, and to do that they can read the reported content — including a direct message, if a direct message is what was reported. Moderators can remove content and ban accounts. We keep a record of enforcement actions so that a banned account cannot simply be recreated on the spot.

7. Cookies and local storage

  • Session cookie. A signed cookie that keeps you logged in, plus a companion cookie that protects sign-in forms against cross-site request forgery. Both are strictly necessary; without them the app cannot know who you are.
  • Local storage on your device. Your skin, accent colour, sound and haptics settings, drafts and similar preferences. This never leaves your browser and is not readable by us.
  • No advertising or analytics cookies are set by Aeon Terminal. Embedded players and posts may set their own inside their own frames — see section 3.

8. Security, honestly stated

Traffic is served over HTTPS with HSTS, passwords are hashed with bcrypt, sign-in attempts and most write endpoints are rate limited, uploads are checked against their magic bytes, and a strict Content Security Policy restricts what the page may load or talk to.

What that does not mean: direct messages are not end-to-end encrypted. They are stored in our database as text, so anyone with legitimate access to the database — or anyone who breaches it — can read them. Treat DMs as private-but-not-secret, and never send anyone a seed phrase or private key, here or anywhere else.

9. Age

Aeon Terminal is for people aged 18 or over. It is a community built around a cryptocurrency, with open chat, voice rooms and direct messaging, and it is not designed or moderated for children. We don’t knowingly collect anything from under-18s; if you believe a minor has an account, email privacy@6900isbiggerthan500.com and we will remove it.

10. Where your data is

The app runs on infrastructure in the United States and Europe, and the services in section 3 operate globally. Using Aeon Terminal means your data is processed in countries other than your own.

11. Changes

If this policy changes in a way that affects what we collect or who receives it, we’ll update the date at the top and announce it in the app. Continuing to use Aeon Terminal after that means the new version applies.

12. Contact

Questions, data requests, or anything on this page that doesn’t match what you see in the app: privacy@6900isbiggerthan500.com. You can also message a moderator in the app.

Aeon Terminal · SPX6900 · Terms of Use