Legal

Privacy Policy

No accounts, no cookies, no third-party tracking. This page lists everything Solstack stores.

What Solstack does not do

• No sign-up, email, or password. The only identity Solstack sees is your wallet's public address: it's logged when you connect a wallet (see Connected wallets below), and used to sign you in if you choose to (see Saved snapshots below).
• No third-party analytics or tracking scripts: no Google Analytics, ad pixels or session recording. Solstack keeps its own basic visit log instead (see Visit log below).
• No cookies used for tracking. Solstack sets no cookies at all.

Visit log

When a page opens, and each time you move to another page, the app tells Solstack's server which page you're on. The server stores: the page's address (including a token or wallet address in the URL, if the page has one), the site that linked you there, your approximate location (country, region and city, as looked up by Cloudflare from your IP address), the name of your network provider, whether you're on a phone, tablet or computer, and your browser and operating system. Your IP address itself is not stored: a one-way code made from your IP address and browser is saved instead, so visits from the same browser and network can be counted as one visitor. The log is only used to see how Solstack is used, is never shared or sold, and each entry is deleted after a year.

Connected wallets

When you connect a wallet to the app, the app tells Solstack's server the wallet's public address, which wallet app you used (Phantom, Solflare and so on), which network the app is on (Mainnet or Devnet), and the page you connected on. This is sent once per wallet and network each time you open the app in a new browser tab. The server stores it with the same details as the visit log: your approximate location, your network provider, your device, browser and operating system, and the same one-way code instead of your IP address, so a connection can be matched to the visit it happened in. If you're signed in with that wallet, that's noted too. Connecting doesn't sign anything or give Solstack any access to your wallet. A wallet address is public on Solana, but this log links it to your use of Solstack, so it is only used to see how Solstack is used, is never shared or sold, and each entry is deleted after a year.

Tool steps

When you use a tool, the app tells Solstack's server which step you reached: a wallet scanned, the review shown before your wallet asks to sign, the Confirm button pressed, and whether the transactions confirmed or failed, with the error message you saw, and whether you shared or downloaded a result image. It also sends a few numbers about that step, such as how many accounts a scan found and how much SOL they hold. If a wallet is connected, its public address is included. If you check a wallet by pasting its address, that address is not sent, only what was found in it. The server stores this with the same details as the visit log: the page, your approximate country, your network provider, your device and browser, and the same one-way code instead of your IP address. It is only used to see where tools work and where people get stuck, is never shared or sold, and each entry is deleted after a year.

Telegram bot

When you use Solstack's Telegram bot (to scan a token, send /start or /help, or add it to a group), Solstack's server records what was asked: the token address (if any), when, whether the bot answered, whether it was a private chat or a group, and the language your Telegram app is set to. For a group, the group's name is stored too. Your Telegram user id and the chat's id are not stored: one-way codes made from them are saved instead, so people and chats can be counted. Your name, username and messages are not stored, and messages in a group that aren't meant for the bot are not logged. To post and update its reply, the bot also keeps the chat and message it's answering for about 15 minutes. The log is only used to see how the bot is used, is never shared or sold, and each entry is deleted after a year.

What stays on your device

A few small preferences are saved with your browser's localStorage, which never leaves your device and Solstack never reads remotely: your light or dark theme choice and, if you've created tokens through Solstack, a local list of them used by My Tokens. Clearing your browser storage clears this; it does not affect anything on-chain.

Saved snapshots (opt-in)

The Holder Snapshot tool keeps the snapshots you've paid to export in this browser. If you connect a wallet and choose Sign in to save to wallet, they are saved on Solstack's backend instead, keyed to that wallet. Signing in means signing a plain text message with your wallet. It is free, is not a transaction and cannot move funds. Solstack then stores: your wallet's public address; for each snapshot, the token or collection address, its name and symbol, holder counts, the filter you used, when it was taken, the signature of the fee payment, and the holder rows themselves (wallet addresses, balances and how each address was classified, which are public on-chain data). A session token is kept in your browser for seven days so you don't have to sign again. Nothing else is stored, nothing is shared with third parties, and only a session for that wallet can read its list. You can delete individual snapshots or clear the whole list from the tool at any time, which deletes them from the backend.

Launchpad allowlists and sale descriptions (opt-in)

If you create a Launchpad sale with an allowlist and choose to publish it, the list of wallet addresses and their caps is stored on Solstack's backend so that listed contributors can fetch their Merkle proof from the sale page. The list is not published; only a wallet's own proof is served. A description and links you attach to a sale are stored and shown publicly on solstack.xyz/launch. Contributions, claims and refunds are on-chain and never touch the backend.

Multisender and Airdrop sends

When you send with Multisender or Airdrop, Solstack's server stores what it needs to finish the send without your browser: your wallet address, the recipient list with amounts, each batch's progress and signature, and the key created for that send, which is encrypted and kept after the send ends so that any SOL that reaches it later can be returned to you. The addresses, amounts and signatures become public on-chain as the send runs anyway. Your wallet's own keys are never sent or stored.

Market-making bots

When you start a Grid Trading Bot or DLMM Liquidity Bot, Solstack's server stores what it needs to run the bot without your browser: your wallet address, which everything goes back to when the bot stops; the token, the pool and the settings you chose; the bot's status, trades, activity log and value over time; and the key created for that bot, which is encrypted and kept after the bot stops so that anything that reaches it later can be returned to you. The bot's trades are public on-chain anyway. Your wallet's own keys are never sent or stored.

The devnet faucet

Solstack's devnet faucet also has a server component. When you request test SOL, that request briefly passes through a serverless function which sees the wallet address you're funding and your IP address, kept only in memory to enforce a per-address / per-IP cooldown, and cleared automatically whenever the function restarts. Nothing from the faucet is written to a database or kept long-term.

On-chain activity

Every transaction you sign is broadcast to the public Solana network and is permanently visible there, as with any wallet or explorer. This is a property of Solana as a public ledger, not something Solstack controls.

Third parties

The app's Solana RPC requests go through a relay on Solstack's server, which adds the key for Solstack's RPC provider (Helius) and passes them on without storing them; it also limits how many requests one IP address can make. Token prices are looked up through Solstack's server too. Some requests go straight from your browser to another provider: Arweave, through Irys, when you upload a token image; Jupiter when you sell or swap a token; Helius's transaction sender for some bulk tools; and Raydium, Meteora, Orca, DexScreener and CoinGecko for pool and price data. Those providers see your IP address, as any site you load does, and handle it under their own privacy policies.