LegalPrivacy
Privacy
policy
What reaches our servers, what stays in your browser, and what is public on a blockchain whether anyone likes it or not.
This document is not finished. The structure below is in place and the factual sections are accurate, but the operative wording has not been written or reviewed, and the operating entity is not yet named. Do not rely on it. It is published in this state so the gaps are visible rather than hidden.
The factual sections below are accurate today. The sections marked as outstanding need decisions and, in places, a review of who processes what.
OperatorNot yet stated
JurisdictionNot yet stated
StatusDraft, not in force
What we never receive
Your private key or seed phrase. There is no code path that accepts either, and no situation in which we would ask. Signing happens inside your wallet, and we receive only the signed transaction or the fact that you declined.
What you give us on purpose
The token details you type into a tool, and any logo you upload. A logo and its metadata file are stored by us and served over HTTPS, because your token's on-chain record has to point at a link that keeps working. Anything written on-chain is public and permanent by design: that is the point of it, and it is outside anyone's power to delete.
Wallet addresses
When you connect a wallet, the site sees its public address. That address is already public on-chain, but it is not anonymous: it links together everything that wallet has ever done. We treat it accordingly and do not use it to build a profile of you.
Network requests
Blockchain reads are proxied through our service so that an API key is not exposed in your browser. That proxy carries the request and the response, and nothing about your keys. The programs your transactions reach are listed on the security page.
Analytics
To be written. State exactly what is measured once the funnel events are wired: event names, that no wallet address or mint address is ever sent, retention period, and whether any of it leaves our own infrastructure.
Third parties
To be written. Name the hosting provider, the RPC provider and any other processor that sees a request, and say what each receives. Needed before this page can be accurate.
Retention and your rights
To be written. How long uploads and logs are kept, how to request deletion of an uploaded logo, and the rights that apply under the operating entity's jurisdiction. Note that on-chain data cannot be deleted and say so plainly.
Cookies and local storage
The site stores your theme choice and your draft token configuration in your own browser so that a refresh does not lose your work. Those never leave your device by themselves.
To be written. Confirm this list is exhaustive once analytics is wired, and state whether any cookie requires consent in the target jurisdictions.