Privacy

“Continue with Google” gives you a custodial Solana wallet: we create it and keep its key for you. When you sign in, Google tells us your Google account id, your email address and, through the profile scope, your name and profile picture. We store:

• your Google account id and email address (we don't store your name or picture);
• your wallet's address and its secret key, encrypted with AES-256-GCM under a key that only our account service holds;
• your sessions: a random id in an HttpOnly cookie, kept on our server until you sign out or for at most 7 days;
• an audit log of sign-ups, sign-ins, sign-outs, transactions signed (a hash of each), transactions refused (the reason) and key exports, each with your account, the time and your IP address. Keys are never logged.

We sign with your key only for transactions you start on this site that pass our signing rules (you pay the fee; only the Holdfast program, System, Compute Budget, token and memo programs). You can withdraw your SOL and tokens, or export the key, at any time from the wallet menu. Exporting needs a Google sign-in from the last 10 minutes and shows the key once per sign-in; whoever has the key controls the wallet.

• Public chain data. Launches, deposits, trades, holders and wallet addresses are read from Solana and shown to everyone.
• Comments and profiles you sign with a wallet are public, and so are token images and metadata (stored permanently on Arweave).
• IP addresses are counted in memory for about a minute to rate-limit requests and appear in our server logs when a limit is hit; apart from that only the audit log above keeps them.
• Your browser keeps your chosen wallet, watchlist, trade settings and create-form draft in local storage; on test networks also the test wallet's key.
• Providers. The site runs on Railway; Solana RPC providers see the reads and transactions sent through them. No analytics, no ads, and we don't sell or share your data.

We keep your account and encrypted key for as long as the wallet may hold funds. To delete your account, withdraw your funds or export your key first, then email realdoomsalt@gmail.com from the Google address you sign in with. We then delete your email, sessions and encrypted key — after that nobody can recover the wallet unless you exported its key — and your audit entries, unless we need them to investigate abuse. On-chain records can't be deleted.

If our servers, our encryption key or the account database were lost or stolen, funds in Google wallets could be lost or taken: keep only what you are prepared to lose in one. See the terms.

Questions or requests about your data: realdoomsalt@gmail.com.