In short
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Wallet address | Identifies your account and lets you sign in | Performance of our agreement with you |
| Account creation time, last sign-in time, number of sign-ins | Security and account history | Legitimate interest (security) |
| Email address (optional) | To tell you when the card becomes available, and nothing else | Consent (you can withdraw it at any time) |
| Temporary sign-in challenges | To verify your signature. Deleted within minutes | Legitimate interest (security) |
| Server logs (IP address, user agent, time) | Keeping the service running and preventing abuse. Held by our hosting provider | Legitimate interest (security) |
What we don’t collect
We never ask for or receive your seed phrase or private keys. We don’t collect your name, ID documents or bank details. We don’t use analytics, advertising pixels or cross-site trackers.
Public blockchain data
Deposits, spends and withdrawals are transactions on Solana, a public blockchain. Anyone can see them, and they can’t be deleted by us or anyone else. Balances in the app are read directly from the chain through a Solana RPC provider (mainnet.helius-rpc.com), which, like any web service, can see the IP address your browser uses to connect to it.
How we use it
To run your account, to keep the service secure, and, if you opted in, to send the card announcement. We don’t sell or rent personal data, and we don’t use it for profiling or automated decisions about you.
Cookies & storage
We set one strictly necessary cookie, stipend_session, which keeps you signed in for up to 7 days. It is http-only and can’t be read by other sites. Your browser also stores which wallet you last used and a few interface preferences in local storage on your own device. Because these are strictly necessary, no consent banner is required.
Service providers
We use a hosting provider for the website and a database provider for account records. They process data only on our instructions. If data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.
Retention
Account records are kept until you delete your account. The waitlist email is deleted when you leave the waitlist or when the card launches and you’ve been notified. Sign-in challenges expire after 10 minutes and are purged.
Your rights
You can access, correct, export or delete your data. Most of it is visible and removable on your account page. For anything else, reach us via @Stipendcash on X. You can also object to processing, withdraw consent, and lodge a complaint with your data protection authority (in Sweden, IMY).
Contact
Questions about your data: @Stipendcash on X.