Privacy Policy

What we collect

UNIHOLIX collects the minimum needed to run an account: an identifier (email or phone) for authentication, a coin balance and its ledger, and basic locale and device preferences stored on your device.

Guest sessions stay local to your browser and are never uploaded.

Why we process it

Data is processed to operate the service — to sign you in, to keep your balance correct and to remember your language. It is not used to build advertising profiles, and it is not sold.

How long we keep it

Account data is kept for as long as the account exists. The ledger is retained as long as legally required for accounting. Device preferences live only on your device.

Live features and public sources

Weather, rankings, news and the search stream are built from public sources listed below. Requests to those sources carry the topic you are exploring, never your account identity. Some are called from our servers and some directly from your browser; the lists below say which.

Location

Weather and nearby features use a place you choose, or — only if you allow it — your device's location. If neither is available, an approximate location is derived from your IP address by a public geolocation service named below. Your coordinates are never stored on UNIHOLIX servers.

UNIHOLIX Today

UNIHOLIX Today can be read without an account. Everyone sees the same daily editions; we do not record what you read or build a profile from it. The editions are written with AI models from material we prepare, and nothing about you is sent to those models.

Votes in Today are anonymous. For each vote we keep the answer, the date and the country our hosting provider reports for the connection (or none when it is unknown). To stop one browser from voting twice, we also keep, for a short time, a one-way code made from a random value stored in your browser and a check value from a small puzzle your browser solves; both are erased within three days after voting closes. In Kids, only the answer is kept. We do not store your IP address, and a vote is never linked to an account. Results are shown only as totals, and a country appears only when enough people there have voted.

Your shelf — letters to your future self, your guesses, your answers and your puzzle progress — is kept only in your browser's storage on your device and is never sent to us; the values and how long they last are listed below. A shelf file you save is stored on your own device, and opening one reads it only in your browser. Share Cards are drawn on your device and go only where you choose to share them.

We keep vote records to run fair polls, which is our legitimate interest, and our hosting and database providers handle them only to run the service for us. You can ask us about them through the Contact page; because a vote is not linked to you, we may not be able to find a particular one.

Your rights

You can request access to, correction of, or deletion of your account data through the Contact page or the in-app account settings. Residents of the European Union may also lodge a complaint with their supervisory authority.

Cookies and local storage

The site keeps a small set of values in your browser, described in the Cookie Policy. No third-party advertising or cross-site tracking cookies are set.

Third-party sources this site reaches

When you use live features, our servers or your browser call the following public services. Each is named by its real operator; we send only the query needed for the feature, never your account identity.

The following services are called directly from your browser, so their operators see your IP address as part of the request. None receives your UNIHOLIX account identity.

• Google Newscalled from our serversHeadlines and links via the Google News RSS feed. Headlines only; no article text or images are stored.
• Bing News · Microsoftcalled from our serversHeadlines and links via the Bing News RSS feed (Microsoft). Headlines only; no article text or images are stored.
• Wikipedia · Wikimedia Foundationcalled from your browserText excerpts from Wikipedia, © Wikipedia contributors, CC BY-SA 4.0.
• Wiktionary · Wikimedia Foundationcalled from your browserDefinitions from Wiktionary, © Wiktionary contributors, CC BY-SA 4.0.
• Wikidata · Wikimedia Foundationcalled from your browserStructured data from Wikidata, CC0 1.0.
• Wikidata Query Service · Wikimedia Foundationcalled from your browserGraph results from the Wikidata Query Service (SPARQL), CC0 1.0.
• Wikimedia Commons · Wikimedia Foundationcalled from your browserMedia from Wikimedia Commons. Each file carries its own license and author, shown beside it.
• Wikimedia Pageviews · Wikimedia Foundationcalled from your browserPageview statistics from the Wikimedia Analytics API, CC0 1.0.
• DuckDuckGocalled from your browserInstant answers via the DuckDuckGo Instant Answer API.
• Hacker News · Y Combinatorcalled from your browserStories via the Hacker News search API (Algolia).
• OpenAlex · OurResearchcalled from your browserScholarly metadata from OpenAlex, CC0 1.0.
• Crossrefcalled from your browserBibliographic metadata via the Crossref REST API.
• Open Library · Internet Archivecalled from your browserCatalog data from Open Library (Internet Archive).
• The Met · The Metropolitan Museum of Artcalled from your browserCollection data from The Metropolitan Museum of Art Open Access program, CC0 1.0.
• Open-Meteocalled from your browserWeather, air-quality, climate, flood and marine data by Open-Meteo.com, CC BY 4.0.
• NASA EONETcalled from your browserNatural event data from NASA EONET (Earth Observatory Natural Event Tracker), public domain.
• USGS · U.S. Geological Surveycalled from your browserEarthquake data from the USGS Earthquake Hazards Program, public domain.
• NOAA National Weather Servicecalled from your browserWeather alerts from the U.S. National Weather Service (NOAA), public domain. United States only.
• World Bank Open Data · World Bank Groupcalled from your browserIndicators from World Bank Open Data, CC BY 4.0.
• Frankfurter (ECB)called from your browserReference exchange rates via Frankfurter, from European Central Bank data.
• CoinGeckocalled from your browserMarket data via the CoinGecko public API.
• BigDataCloudcalled from your browserReverse geocoding (coordinates → place name) via the BigDataCloud client API.
• GeoJScalled from your browserApproximate location from the network address via GeoJS (first fallback when GPS is unavailable).
• ipwho.iscalled from your browserApproximate location from the network address via ipwho.is (second fallback when GPS is unavailable).
• Google SearchOpens Google Search in a new tab. UNIHOLIX is not affiliated with or endorsed by Google Search.
• Bing · MicrosoftOpens Bing (Microsoft) in a new tab. UNIHOLIX is not affiliated with or endorsed by Bing (Microsoft).
• YouTube · GoogleOpens YouTube in a new tab. UNIHOLIX is not affiliated with or endorsed by YouTube.
• Facebook · Metamay ask you to sign inOpens Facebook (Meta) in a new tab. UNIHOLIX is not affiliated with or endorsed by Facebook (Meta).
• Instagram · Metamay ask you to sign inOpens Instagram (Meta) in a new tab. UNIHOLIX is not affiliated with or endorsed by Instagram (Meta).
• Threads · Metamay ask you to sign inOpens Threads (Meta) in a new tab. UNIHOLIX is not affiliated with or endorsed by Threads (Meta).
• X · X Corp.may ask you to sign inOpens X in a new tab. UNIHOLIX is not affiliated with or endorsed by X.
• LinkedIn · Microsoftmay ask you to sign inOpens LinkedIn (Microsoft) in a new tab. UNIHOLIX is not affiliated with or endorsed by LinkedIn (Microsoft).
• TikTok · ByteDanceOpens TikTok in a new tab. UNIHOLIX is not affiliated with or endorsed by TikTok.
• RedditOpens Reddit in a new tab. UNIHOLIX is not affiliated with or endorsed by Reddit.
• GitHub · MicrosoftOpens GitHub (Microsoft) in a new tab. UNIHOLIX is not affiliated with or endorsed by GitHub (Microsoft).
• Google ScholarOpens Google Scholar in a new tab. UNIHOLIX is not affiliated with or endorsed by Google Scholar.
• Wolfram Alpha · Wolfram ResearchOpens Wolfram Alpha in a new tab. UNIHOLIX is not affiliated with or endorsed by Wolfram Alpha.
• arXiv · Cornell UniversityOpens arXiv in a new tab. UNIHOLIX is not affiliated with or endorsed by arXiv.
• Naver NewsOpens Naver News in a new tab. UNIHOLIX is not affiliated with or endorsed by Naver News.
• Naver CafeOpens Naver Cafe in a new tab. UNIHOLIX is not affiliated with or endorsed by Naver Cafe.
• Naver BlogOpens Naver Blog in a new tab. UNIHOLIX is not affiliated with or endorsed by Naver Blog.
• NaverOpens Naver in a new tab. UNIHOLIX is not affiliated with or endorsed by Naver.
• YandexOpens Yandex in a new tab. UNIHOLIX is not affiliated with or endorsed by Yandex.
• SeznamOpens Seznam in a new tab. UNIHOLIX is not affiliated with or endorsed by Seznam.
• DuckDuckGo SearchOpens DuckDuckGo in a new tab. UNIHOLIX is not affiliated with or endorsed by DuckDuckGo.
• Yahoo FinanceOpens Yahoo Finance in a new tab. UNIHOLIX is not affiliated with or endorsed by Yahoo Finance.
• Yahoo SearchOpens Yahoo Search in a new tab. UNIHOLIX is not affiliated with or endorsed by Yahoo Search.
• EcosiaOpens Ecosia in a new tab. UNIHOLIX is not affiliated with or endorsed by Ecosia.
• QwantOpens Qwant in a new tab. UNIHOLIX is not affiliated with or endorsed by Qwant.
• Brave SearchOpens Brave Search in a new tab. UNIHOLIX is not affiliated with or endorsed by Brave Search.
• BaiduOpens Baidu in a new tab. UNIHOLIX is not affiliated with or endorsed by Baidu.
• Apple MapsOpens Apple Maps in a new tab. UNIHOLIX is not affiliated with or endorsed by Apple Maps.
• Google MapsOpens Google Maps in a new tab. UNIHOLIX is not affiliated with or endorsed by Google Maps.
• Google TrendsOpens Google Trends in a new tab. UNIHOLIX is not affiliated with or endorsed by Google Trends.
• Google PatentsOpens Google Patents in a new tab. UNIHOLIX is not affiliated with or endorsed by Google Patents.
• SEC EDGAR · U.S. Securities and Exchange CommissionOpens SEC EDGAR in a new tab. UNIHOLIX is not affiliated with or endorsed by SEC EDGAR.
• OECD DataOpens OECD in a new tab. UNIHOLIX is not affiliated with or endorsed by OECD.
• TradingViewOpens TradingView in a new tab. UNIHOLIX is not affiliated with or endorsed by TradingView.
• Product HuntOpens Product Hunt in a new tab. UNIHOLIX is not affiliated with or endorsed by Product Hunt.
• Crunchbasemay ask you to sign inOpens Crunchbase in a new tab. UNIHOLIX is not affiliated with or endorsed by Crunchbase.
• Hugging FaceOpens Hugging Face in a new tab. UNIHOLIX is not affiliated with or endorsed by Hugging Face.
• Kaggle · GoogleOpens Kaggle (Google) in a new tab. UNIHOLIX is not affiliated with or endorsed by Kaggle (Google).
• Stack OverflowOpens Stack Overflow in a new tab. UNIHOLIX is not affiliated with or endorsed by Stack Overflow.
• DEV CommunityOpens DEV Community in a new tab. UNIHOLIX is not affiliated with or endorsed by DEV Community.
• MediumOpens Medium in a new tab. UNIHOLIX is not affiliated with or endorsed by Medium.
• SubstackOpens Substack in a new tab. UNIHOLIX is not affiliated with or endorsed by Substack.
• BlueskyOpens Bluesky in a new tab. UNIHOLIX is not affiliated with or endorsed by Bluesky.
• Mastodonmay ask you to sign inOpens Mastodon (mastodon.social) in a new tab. UNIHOLIX is not affiliated with or endorsed by Mastodon (mastodon.social).
• Pinterestmay ask you to sign inOpens Pinterest in a new tab. UNIHOLIX is not affiliated with or endorsed by Pinterest.

Keys this site keeps in your browser

These values live only in your browser's local storage. None of them is sent to UNIHOLIX servers, and clearing site data removes all of them.

• unitas.weather.v1localStorageLast weather place and forecast so the weather slot renders instantly. 10 minutes, then refetched.
• unitas.gastronomy.local.v1localStorageNearby eateries found on Wikipedia around your place for the gastronomy slot, so revisiting costs no request. 24 hours, then refetched.
• unitas.geo.cache.v1localStorageGeocoding results for city searches and "my location". Least-recently-used, 240 entries.
• unitas.uai.websynth.v4localStorageLive web synthesis for a search term (Wikipedia / Wikidata excerpts). 24 hours, 40 entries.
• unitas.uai.shortcut.pulse.v1localStorageMomentum ledger for keyword tiers (trend arrow). 60 entries.
• unitas.ouroboros.ladder.v2sessionStorageThe keyword ladder you built, so a language switch restores it. Cleared when the tab closes.
• unitas.swarm.cache.v1localStorageOrganisations you have taken apart in the omni-tech swarm, so revisiting one costs no request. 7 days, 40 entries, least-recently-used.
• unitas.uai.stream.v1localStorageInfinity stream pages for a search term, plus your depth and engraving tier. 24 hours (news 15 minutes), 120 entries.
• unitas.uai.suggest.v1localStorageKeyword ladder suggestions for typed prefixes. 24 hours.
• unitas.localeSwitch.v1sessionStorageScroll position and open search state carried across a language change so the page lands where you were. Consumed on the next render; expires after 5 seconds.
• unitas.sitePage.open.v1sessionStorageWhich footer page (terms, privacy, ...) is open, so a language change keeps it open. Removed when the page is closed or the tab reloads.
• unitas_audio_preflocalStorageYour sound on/off choice ('on' or 'off'); absent means sound on. Read by the site-wide audio provider, the haptic clicks and the logo-page chime. Until you change it or clear browser data; deliberately kept across an app exit.
• unitas_locale_autodetectedlocalStorageA '1' flag that the browser language was checked once for an automatic language switch, so the guess is never repeated on this device. Until browser data is cleared.
• unitas_locale_preflocalStorageThe language you chose manually, so any later visit on this browser re-applies it (a cookie of the same name is the fallback copy). Until you pick another language or clear browser data; kept across an app exit.
• unitas_visit_ledgerlocalStorageWhere you were on the site (curtain phase, ad segment, open cluster surface, locale) plus a timestamp, so an installed app relaunching shortly after being backgrounded returns to the same place instead of replaying the logo page. Holds no identity or entitlement. Honoured for 30 minutes; removed on a fresh entry to the site and on a confirmed app exit.
• unitas.guest.v1localStorageA local, throwaway guest identity (random id, 6-digit virtual number, created time) that lets you look around without an account. It is not a server account. Until you sign in to a real account, end guest mode, or clear browser data.
• unitas.inapp.escape.atlocalStorageThe time (epoch ms) of the last automatic attempt to hand an in-app browser (KakaoTalk, LINE, Facebook, Instagram, ...) over to the real system browser, so the attempt fires at most once per 90 seconds. Overwritten on each attempt; only meaningful for 90 seconds; stays until browser data is cleared.
• unitas.lockin.active.v1localStorageThe keys of the lock-in modules you activated, so the activation survives reloads and language switches. Until you deactivate the module or clear browser data.
• unitas.mail.reservation.v1localStorageThe @uniholix.com handle you reserved at sign-up, when, and its status ('pending', 'claimed' or 'lost'), so the account surfaces can show it. Until browser data is cleared; the code never removes it, only overwrites it when the status changes.
• unitas.pwa.installedlocalStorageA '1' flag raised when the app was installed on this device, so a later browser-tab visit can point you to the installed app instead of a dead install button. Removed the moment the browser offers installation again (the app is no longer installed); otherwise until browser data is cleared.
• unitas.shorts.orphanCleanup.v1.donelocalStorageA '1' flag that the one-time cleanup of data left behind by the retired UNIHOLIX Shorts feature has already run on this device. Until browser data is cleared.
• unitas.uai.brain-grid.v1localStorageYour U-AI search history on this device: query, time, shield score and depth ('surface' or 'deep'), shown as the history strip. Signed-in accounts also get a server copy. Newest 60 entries; removed entirely by the 'wipe history' action; otherwise until browser data is cleared.
• unitas.wallet.prefs.v1localStorageYour wallet preferences: auto-spend on/off, limit and window, auto-refill on/off, threshold and package. Settings only -- no balance, no payment details. Until you change them or clear browser data; kept across an app exit.
• unitas_audio_gate_seensessionStorageA 'true' / '1' flag that the audio-unlock gate has already been passed in this tab (set when you dismiss it, or when the curtain releases the site), so the gate is not shown a second time. Cleared when the tab closes; also wiped on a fresh entry to the site and on a confirmed app exit.
• unitas_cinema_phasesessionStorageThe pre-launch curtain phase this tab is parked on ('gate', 'cinema', 'sealed' or 'released'), so a refresh re-renders that page in place instead of replaying the logo page. Cleared when the tab closes; wiped on a fresh entry to the site and on a confirmed app exit; removed by the founder console's revoke/replay.
• unitas_cinema_segmentsessionStorageWhich of the five cinema ad segments (1-5) is on screen, so a refresh during the ad resumes at that segment. Removed as soon as the cinema phase ends; cleared when the tab closes.
• unitas_console_triggersessionStorageThe founder-console action ('revoke', 'splash', or a ?dev= action) carried across a reload so the next document knows the load is a console transition. Only the founder console writes it. Cleared by the next document after it is read; cleared when the tab closes or on a fresh entry.
• unitas_handoffsessionStorageA '1' flag set just before the installed app redirects itself from '/' to your saved language root, so the next document treats that load as a continuation, not a fresh entry. Consumed (removed) by the very next page load.
• unitas_leave_atsessionStorageA timestamp written when the page unloads normally (pagehide). Its absence next to a live phase record tells the next load the document died without warning, so the state is restored instead of reset. Consumed (removed) at the next page load and re-armed on the next unload; cleared when the tab closes.
• unitas_sovereign_panel_collapsedsessionStorage'1' or '0' -- whether the founder debug panel is collapsed. Only a verified founder session ever renders the panel, so public visitors never write this. Cleared when the tab closes.
• unitas_splash_activesessionStorageA '1' flag raised for exactly as long as the 3-second logo page is on screen, so a refresh during the logo page replays it instead of skipping ahead. Removed the moment the logo page finishes; cleared when the tab closes or on a fresh entry.
• unitas.mail.claim.attempt.v1sessionStorage'<account id>:<handle>' of the one @uniholix.com handle claim attempted in this tab, so a failed claim is retried on the next load rather than in a loop. Cleared when the tab closes.
• unitas.ouroboros.query.v1sessionStorageThe text currently typed in the search bar, so a language switch (which remounts the page) restores it. Overwritten on every keystroke; cleared when the tab closes.
• unitas.ouroboros.shortcut.v1sessionStorage'<group>:<key>' of the shortcut popup that is open, so a language switch reopens the same popup. Removed when the popup closes; otherwise cleared when the tab closes.
• unitas.qw.surface.v1sessionStorageWhich cluster pop-out (and which module inside it) is open on the home, encoded as 'core/<cluster>[/<moduleId>]', or '-' for explicitly closed, so a reload restores the same view. Cleared when the tab closes; wiped on a fresh entry to the site and on a confirmed app exit.
• unitas.selfheal.<scope>sessionStorageHow many times an error screen auto-reset itself in the current window and when the first attempt was, so a persistent fault cannot turn into a reload storm. 30-second window with at most 2 attempts; removed after a stable render; cleared when the tab closes.
• uniholix_today_tablocalStorageThe UNIHOLIX Today tab you opened last, so Today opens there next time. Until you open another tab or clear site data.
• uniholix_today_world_questionlocalStorageYour World Question answers, and a random value this browser makes so it cannot vote twice (the server keeps only a one-way code made from it, erased within three days after voting closes). The newest 14 days.
• uniholix_today_edition_voteslocalStorageYour answers to the votes in Today's daily editions, and the same kind of random value (not sent for Kids votes). The newest 90 votes.
• uniholix_today_letterslocalStorageLetters to your future self, kept sealed on this device until their opening date. They are never sent to UNIHOLIX. Until you delete them; at most 30 letters.
• uniholix_today_guesseslocalStorageYour Tomorrow Guess predictions, so Today can show whether they came true. The newest 60 days.
• uniholix_today_puzzleslocalStorageYour Number Grid progress, so a grid you started is still there when you come back. The newest 14 days.
• uniholix_today_signlocalStorageThe sign you chose in Fortune. Until you change it or clear site data.

Cookies this site sets

Unlike the keys above, cookies travel with every request to UNIHOLIX. Each one we use is listed here, and none of them serves advertising or cross-site tracking. Cookies marked HttpOnly cannot be read by page scripts.

• unitas_sovereignHttpOnlyHMAC-SHA256-signed founder session ('v1.<expiry>.<signature>'). It is the only thing the server trusts when deciding whether founder-only routes and UI exist for this browser. Never set for public visitors. 30 days (Max-Age 2592000); HttpOnly, SameSite=Lax, Path=/, Secure on https. Deliberately not revoked on app exit; revoked only by the explicit sign-out paths above.
• unitas_sovereign_hintcookieA client-readable hint that a founder session may exist, so client code knows to ask GET /api/sovereign/verify and the head bootstrap can pre-paint the released home. It grants nothing by itself. 30 days; not HttpOnly, SameSite=Lax, Path=/, Secure on https.
• unitas_locale_prefcookieFallback copy of the language you chose manually, for browsers that block web storage but allow cookies; also read by the installed-app launch bootstrap (lib/pwa/standaloneLaunch.ts) to open your language root. 1 year (max-age 31536000); Path=/, SameSite=Lax; not HttpOnly; no Secure attribute is set.
• NEXT_LOCALEcookienext-intl's locale cookie. Written only on document navigations, and only when an existing NEXT_LOCALE differs from the locale resolved from the URL, or when none exists and the browser's Accept-Language best match differs from the resolved locale. Because routing.ts sets localeDetection: false, the app never reads it back. Session cookie (no Max-Age/Expires -- gone when the browser closes); SameSite=Lax, Path=/; not HttpOnly.
• sb-<project-ref>-auth-token (split into sb-<project-ref>-auth-token.0, .1, ... when longer than 3180 bytes)cookieYour Supabase Auth session (access token, refresh token, expiry and user record), base64url-encoded with a 'base64-' prefix. Stored in a cookie rather than localStorage so the server can see who is signed in for the coin gate. 400 days (Max-Age 34560000), rewritten on every token refresh; removed (Max-Age 0) on sign-out. Path=/, SameSite=Lax, not HttpOnly (the browser client must read it).
• sb-<project-ref>-auth-token-code-verifiercookieThe PKCE code verifier for the most recently started sign-in flow, needed to complete that flow securely. Contains no personal data. Removed when the flow's code is exchanged or on sign-out; otherwise the adapter's default 400 days. Path=/, SameSite=Lax, not HttpOnly.
• sb-<project-ref>-auth-token-flow-<flowId>-code-verifiercookiePer-flow PKCE verifier slot so two sign-in attempts (for example in two tabs) do not overwrite each other. At most 5 slots exist; the oldest is evicted. Removed when that flow completes, when evicted by a 6th flow, or on sign-out; otherwise 400 days. Path=/, SameSite=Lax, not HttpOnly.
• sb-<project-ref>-auth-token-flows-code-verifiercookieThe list of pending PKCE flow ids (JSON array), which is how the library finds and cleans up the per-flow verifier slots. Removed when no flows remain or on sign-out; otherwise 400 days. Path=/, SameSite=Lax, not HttpOnly.
• uniholix_today_langcookieThe language you chose in UNIHOLIX Today, so its pages open in that language. 1 year (Max-Age 31536000); Path=/today, SameSite=Lax; not HttpOnly; Secure on https.