Privacy Policy

Stockpile is a non-custodial app that turns news stories into bags of tokenized stocks and pre-IPO tokens on Solana. This Privacy Policy explains what information we collect when you use the Stockpile mobile app and website (the "Service"), how we use it, and who we share it with.

1. Information we collect

Information you provide

• Sign-in details. The email address you sign in with. Sign-in and one-time codes are handled by Privy.
• Profile. An optional username and display name.
• Saved bags. The bags you bookmark.
• Support messages. Anything you send us when you contact support or give feedback.

Information created when you use the Service

• Wallet address. The public address of the embedded Solana wallet Privy creates for you, together with your Privy user ID.
• Trade requests. When you ask for a quote or build a swap, we receive the tokens, amounts, and wallet address involved so we can fetch quotes from Jupiter and prepare the transactions.
• Signed transactions. Transactions you sign on your device are sent to our API, which relays them to the Solana network through Helius and tracks whether they confirm.
• Bag positions. For each confirmed swap you attribute to a bag, we store the transaction signature, token, direction, amounts, and block time. We read these from the blockchain, not from your device, and use them to show your cost basis and performance per bag.
• Portfolio and activity. We read your wallet's public balances and transaction history from the blockchain so we can show them in the app. We fetch these when you ask for them and do not keep a separate copy beyond the bag positions above.

Collected automatically

• Technical data. When your device talks to our servers, our hosting provider (Cloudflare) processes your IP address, request metadata, and basic device and app-version information as part of normal operation and security.
• App updates. The app checks Expo's update service for new versions, which shares your app version and platform.

What we do not collect

• Private keys and recovery phrases. Your embedded wallet's keys are secured by Privy's key-management system and are never available to Stockpile. We cannot move your funds and cannot recover your wallet.
• Advertising or analytics trackers. The app has no third-party analytics, advertising, or cross-app tracking SDKs.
• Device data. We do not access your contacts, photos, camera, microphone, or precise location.
• Bank or card details. Stockpile does not process fiat payments.

2. Public blockchain data

Solana is a public blockchain. Your wallet address, balances, and every transaction you make are permanently and publicly visible to anyone, and can be linked to you if your address is ever associated with your identity. Stockpile cannot change, hide, or delete information recorded on-chain.

3. How we use your information

• To create and secure your account and embedded wallet.
• To show your saved bags, portfolio, activity, and per-bag performance.
• To get swap quotes, prepare transactions, sponsor network fees, and relay your signed transactions to Solana.
• To enforce eligibility and restrictions, and to detect and prevent fraud, abuse, and security incidents.
• To operate, debug, and improve the Service.
• To reply to support requests and send important service or policy notices.
• To comply with legal obligations.

We do not use your information for advertising, and we do not sell or rent it.

4. Third-party services

Stockpile relies on these providers. Each has its own privacy policy and terms.

Providers that process data about you

• Privy: sign-in, email one-time codes, and embedded wallet infrastructure. Privy processes your email, device and session details, and wallet keys under its own security model.
• Jupiter: token swap aggregation and routing across Solana liquidity, plus token metadata and prices. Jupiter receives the wallet address, tokens, and amounts involved in each quote and swap.
• Helius: Solana RPC infrastructure. We use it to read balances and transaction history, simulate transactions, and send your signed transactions to the network.
• Cloudflare: hosting for our API and website, content delivery, and security. It also connects our API to our managed Postgres database.
• Expo: delivers over-the-air app updates.
• Apple App Store and Google Play: app distribution, under their own policies.

Data and content providers (no personal data sent by us)

• Backed Finance (xStocks) and PreStocks: token issuers whose product metadata and logos we display.
• tokens.xyz: price chart data.
• Pyth Network: reference prices for the underlying assets.
• CongressInvests and the official U.S. House and Senate disclosure sites: public STOCK Act trading disclosures used to build disclosure bags.
• OpenAI: helps us curate and summarize public news stories on our servers. None of your personal data is sent to OpenAI.
• DiceBear: generates default profile avatars from a seed value.
• News publishers: the stories we link to belong to their publishers. When you tap "Read story", the publisher's site opens and its own privacy policy applies.

Some images, such as token logos, news images, and avatars, load directly from these providers' servers. Like any web request, this exposes your IP address to the host.

5. How we share information

We share information only:

• with the service providers above, as needed to run the Service;
• when required by law, regulation, subpoena, or other legal process;
• to protect the rights, property, or safety of Stockpile, our users, or others, including to investigate fraud or sanctions violations;
• as part of a merger, acquisition, financing, or sale of assets, subject to this Policy; or
• with your consent.

6. Data retention

We keep account data (email, username, wallet address, saved bags, and bag positions) for as long as your account is active. When you delete your account, we delete this data within 30 days, except where we must keep it to meet legal obligations, resolve disputes, or enforce our agreements. Server logs are kept for a short period for security and debugging. Data held by Privy and other providers follows their own retention policies. On-chain data cannot be deleted.

Some data, such as cached bags and preferences, is stored on your device and is removed when you sign out or delete the app.

7. Security

All traffic between the app and our servers is encrypted with TLS. Access to our database and secrets is restricted, and the transactions we prepare are checked and simulated before you are asked to sign them. No system is perfectly secure, however, and you are responsible for keeping your device and your sign-in email secure.

8. Your rights and choices

Depending on where you live (for example under the GDPR, UK GDPR, or CCPA/CPRA), you may have the right to:

• access the personal data we hold about you and receive a portable copy;
• correct inaccurate data;
• delete your account and personal data;
• object to or restrict certain processing; and
• withdraw consent where processing is based on consent.

To use any of these rights, email support@stockpile.cash from the address linked to your account. We will respond within the time required by law. We do not sell or "share" personal information for cross-context behavioral advertising as those terms are defined under California law. You may also complain to your local data protection authority.

Deleting your Stockpile account does not delete your wallet or its funds. Before you delete your account, move your assets or export your wallet through Privy.

9. Children

Stockpile is not intended for anyone under 18. We do not knowingly collect information from minors. If we learn that we have, we will delete it.

10. International transfers

We and our providers operate in the United States and other countries. Your information may be processed outside your country, under data protection laws that may differ from yours. Where required, we rely on appropriate safeguards such as standard contractual clauses.

11. Changes to this policy

We may update this Policy from time to time. If we make material changes, we will notify you in the app or on this page before they take effect. The "Last updated" date shows the latest version.

12. Contact

Questions about this Policy or our data practices? Email support@stockpile.cash.