How we handle your data

1. Introduction

Axy is a concept-mapping tool for science. This privacy policy explains what data we collect through our marketing site at axy-app.com and through the K-Git application itself, how we use it, and the choices you have. It applies to anyone who visits the site, joins the waitlist, or uses the product.

We're a small team that takes privacy seriously: Axy is built for researchers, and researchers expect us to be careful with their data. Our default posture is to collect as little as possible, store it on EU-based infrastructure, and explain everything in plain language.

2. What data we collect

Waitlist form

When you submit the waitlist form, you voluntarily share:

• Your full name
• Your institutional or professional email address
• Your primary field of research

If you arrived via a referral link, we also record the referral code so the person who shared the link can be credited. The referral code itself is an opaque slug — it does not identify the referrer to anyone other than us.

Analytics

We use PostHog to understand how people use the site. PostHog captures pageviews, clicks, page-leave events, the page that referred you to us, and high-level device/browser information (browser family, operating system, viewport size, approximate country derived from IP — we do not store the full IP address long-term).

Session replay on the marketing site (only with consent)

If you accept cookies, PostHog also records an anonymised replay of your session on axy-app.com so we can spot UX problems. Form inputs are masked in every recording — names, email addresses, and any free-text field you fill in are never visible to us in replays. Without your consent, no replays are recorded at all.

Session replay in the K-Git application

PostHog records a replay of your session from the moment you open the K-Git application (web or desktop) — including the login, signup, and invitation-acceptance screens, before you've signed in — so our support team can see what happened before you reported a problem, without asking you to reproduce it. This is separate from the marketing site's cookie banner — there is currently no consent prompt inside the product itself.

Knowledge-graph content — node and edge labels, descriptions, and search text — remains visible in these recordings. We already store that content in our own database, so masking it in a replay would prevent our support team from diagnosing your issue without reducing what we're able to see about you. Anything you type into a credential field, such as a password, or an email address field, is always masked and never legible — including on the invitation-acceptance screen, where we mask the invited email address itself even though it's rendered as text, not typed. Recordings are retained for 30 days. Only members of our small internal team can access them, and we are working on limiting this further to the specific people who respond to support requests.

Cookies

See section 4 below for the full cookie list. In short: on the marketing site, we use one functional cookie to remember your consent choice, and a set of PostHog analytics cookies that are only set if you accept. Inside the K-Git application, PostHog cookies are set automatically from your first visit — there is no separate cookie choice to make there.

3. How we use the data

• Waitlist management. We use your name, email, and field of research to evaluate applications, communicate with you about the Axy launch, and onboard you to the product when your cohort opens.
• Traffic and engagement. Aggregated analytics help us understand which pages and messages resonate so we can improve the site.
• User-experience improvements. On the marketing site, session replays (when you've consented) let us identify usability issues — confusing copy, broken layouts, friction in the signup flow — and fix them.
• Support diagnosis. Inside the K-Git application, session replays let our support team see what happened before you reported a problem, so we can fix it without asking you to reproduce it.

We do not sell your data. We do not share it with advertisers. We do not use it to target ads.

4. Cookies

Our site runs in cookieless mode by default. Basic analytics — pageviews, clicks, page-leave — work without setting any cookies and don't require your consent. Cookie-based features (cross-session identification, session replay) only turn on if you accept cookies on the banner.

To change your cookie preferences, clear the axy_cookie_consent cookie in your browser (or clear site data for axy-app.com) and refresh the page — the banner will reappear and you can make a new choice.

5. Third-party services

We rely on a small number of third-party providers. Each is contracted as a data processor and stores data on EU-based infrastructure where the option is available.

• PostHog Cloud (EU region) — analytics and session replay, for both the marketing site and the K-Git application. PostHog data is hosted on EU servers.
• Waitlister — manages our waitlist. When you submit the form, your name, email, and field of research are sent to Waitlister via our own server, never directly from your browser.
• Vercel — hosts and serves the site. Vercel sees standard request logs (IP address, user agent, URL) as part of normal infrastructure operation.

6. Data storage and security

All personal data we collect is stored on EU-based servers provided by the third parties listed above. Data is encrypted in transit (HTTPS everywhere) and at rest by our providers' infrastructure. Access to production systems is restricted to a small number of team members and is logged.

No system is perfectly secure, and we won't pretend otherwise. We work to keep your data safe, and if we ever become aware of a breach that affects you, we will notify you in line with our GDPR obligations.

7. Your rights under GDPR

If you are in the EU, UK, or another jurisdiction that grants equivalent rights, you have the right to:

• Access the personal data we hold about you.
• Rectification — correct any inaccurate or incomplete data.
• Erasure — ask us to delete your data ("the right to be forgotten").
• Restriction — limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on our legitimate interests.

To exercise any of these rights, email info@axy-app.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority.

8. Data retention

• Waitlist data — kept until product launch and initial onboarding, or until you ask us to delete it, whichever comes first.
• Analytics data — retained for up to 12 months, then aggregated or deleted.
• Session replay data — retained for 30 days (PostHog's default), then deleted.

9. Changes to this policy

If we make material changes to this policy — for example, adding a new third-party service, or changing how long we keep data — we will update the effective date at the top of this page and, where appropriate, notify you by email.

10. Contact

Questions about this policy or your data? Email info@axy-app.com.