The Spice Melange · privacy

Privacy

Last updated October 10, 2026. This page sums up section 9 of our terms. If they ever differ, the terms win.

The short version

• We keep as little as we can, only to fill orders, prevent abuse and send emails you asked for.
• We never sell your data and never ask for keys, recovery phrases, passwords or account numbers.
• We use no ad pixels, no cookies for tracking, and no third-party trackers.
• Your templates run on your own agents. Your settings, memories, ledgers and keys never come to us.

What we store, why, and for how long

• Orders: order ID, amount, the paying Sui address and the payment record (public on-chain). Unpaid orders are deleted 30 days after the payment window closes, with their email and referral source. Paid orders, with the optional email and referral source, are kept as sales records until you ask us to delete the email or referral source.
• Optional receipt email: used only for your receipt and help with your order. The store doesn't send receipts itself: it saves a receipt draft that includes your email for up to 60 days, and the desk reviews it by hand before any receipt goes out.
• In your browser tab: after checkout, your order ID and order token (and which template you bought) are kept in this tab's sessionStorage so you can come back to the payment step. They stay on your device, are never sent to anyone else, and are cleared when you close the tab. Any referral tag is kept the same way. We set no cookies.
• IP addresses: never stored raw. A salted hash is kept for about an hour for rate limits on orders and course signups, and for reading the signal feed (this applies to anyone who reads the feed, including people who haven't bought anything). If you report a signal post, the hash is saved with that report for 90 days, and a daily report counter tied to it is kept for about 3 days.
• When deletions run: our cleanups run on a schedule (every 10 and every 15 minutes) and also as people use the site, so each deletion here happens shortly after its time is up, not at the exact minute.
• Referral source: if you arrive through a campaign or referral link, a short utm or ref tag is held in your browser tab (no cookies) and saved with your order or course signup so we can credit the referrer. On a course signup it is deleted with that signup.
• Referral codes: each code is stored with the name or pseudonym of the person it credits, an optional note and the date it was created, and is kept until we remove it. Referrers get no access to order data; the sales report shows only counts and totals per code.
• Lesson and course emails (opt-in only): if you tick the box and then confirm by email, we keep your email address, when and where you opted in, and which lessons were sent. For the free course we also keep your optional quiz answers: experience level, goal, time and whether you use an AI agent. Your quiz answers are stored only in our own database; they are not sent to our email provider. We never ask about income, savings, debts, balances or age.
• How long we keep subscribers: a signup you never confirm is deleted 7 days after you made it. A finished lesson series or course is deleted 30 days after the last lesson. If you move from the free course to the 14-day lessons, the course record is deleted 7 days later.
• Signal posts: shown under a pseudonym. The link to your order is kept privately for rate limits and moderation.

Who helps us

• Cloudflare hosts the site and its database, and processes requests to serve it.
• Resend (Resend, Inc.) sends lesson and course emails. It processes your address only to deliver them; your quiz answers are not sent to Resend.
• Mysten Labs runs the public DeepBook indexer (deepbook-indexer.mainnet.mystenlabs.com). On the live market dashboard your browser fetches order-book data from it directly, so, like any website, it sees your IP address and browser type. We send it nothing about you. This is the only outside address your browser contacts on our pages; our fonts and scripts are served from our own site.
• Sui is a public blockchain. Our server reads it through the public Sui GraphQL service (graphql.mainnet.sui.io) to check payments; your browser doesn't contact it. If you use a Sui wallet to reset your token, that wallet is your own software and talks to the network itself. Payments on Sui are public and can't be deleted by anyone.

Unsubscribing and deletion

• Every lesson or course email has a one-click unsubscribe. When you unsubscribe we delete your address, quiz answers, referral source and send history at once, and keep only a scrambled (hashed) copy of your address and the date, so we never email you again.
• To delete your email, quiz answers, referral source or signal posts, write to hello@thespicemelange.org. We do it by hand. There is no self-serve tool yet. On-chain payment records can't be deleted by anyone.

Contact

Sajan Melcher, The Spice Melange · questions and deletion requests: hello@thespicemelange.org. Replies to lesson and course emails go to reserve@thespicemelange.org; please send deletion requests to hello@thespicemelange.org.