There are no accounts, no tracking cookies and no analytics. Nothing about you is stored between visits. The only database holds discount codes, which contain no personal data.
My server briefly sees your wallet's public address and your chosen token name and symbol, so it can build a transaction. It does not save them.
The part worth reading carefully is section 07. Your token image, its name, and your wallet address end up on a public blockchain and on IPFS, permanently, where nobody including me can remove them.
Who is responsible
The data controller for mintonsol.com is the independent developer who operates it, trading as mintonsol.com in Greece, reachable at [email protected].
My full legal name and postal address are not published on this page, but they are available on request. If you want to exercise a data protection right, or you need my identity for a legal or regulatory purpose, email the address above and I will provide it.
I run this alone. There is no team, no data protection officer, and no arrangement to sell or share data with anyone for marketing or any other purpose.
What I do not do
It is shorter to start with what does not happen. This site has:
- No user accounts, so no sign up, no login, no profile
- No tracking or advertising cookies. Cloudflare, which protects the site from automated abuse, sets one or two strictly necessary security cookies to remember that your browser passed a bot check. These carry no personal profile and are not used to track you across sites. No consent banner is needed because security cookies of this kind are exempt.
- No analytics, meaning no Google Analytics, no pixels, no tracking scripts, no heatmaps
- No advertising and no advertising identifiers
- No browser storage, since the site writes nothing to localStorage or sessionStorage
- No account and no profile. The one database on the server holds discount codes, a record of each token created (its address, the network, the date, the fee charged, and a two letter country code, never your IP address), and, if you choose to use my image storage, a record of that upload including your public wallet address. Bringing your own Pinata account records nothing at all. See section 04.
- No profiling and no automated decision making with legal effects
- No fingerprinting. The connect dialog checks which Solana wallet extensions are present in your browser, so it can show which are already installed. This happens entirely on your device, the result is never sent anywhere, and it is not combined with anything else to identify you.
- No sale or sharing of personal data with data brokers or advertisers
Everything you type into the form lives in your browser's memory and disappears when you close or reload the tab, except for the specific items described below.
Exactly where your data goes
Rather than describe this vaguely, here is every field the site handles and its actual destination.
What reaches my server
Your browser makes three kinds of request to my server. When the page loads, it asks what the current fee is, and that request sends nothing but your IP address and standard browser headers. When you create a token, it sends a single request containing your wallet address, token name, symbol, decimals, metadata link, network, your freeze and update authority choices, and a discount code if you entered one.
The third kind is Solana network traffic. Checking your balance, fetching a recent block, broadcasting a signed transaction and confirming it all pass through my server, which forwards them to Helius and returns the answer. These requests carry your wallet address and your signed transactions. They do not carry your keys, which never leave your wallet, and a signed transaction cannot be altered in transit without invalidating its signature.
The server uses all of this to do its job and then forgets it. Nothing about who you are is written to disk. No wallet address, token name, image or IP address is stored.
What is recorded, and why:
- The address of every token created, with the network and a timestamp, so that if someone forges a transaction and blames this site I can show it was not created here.
- The fee charged and the SOL to EUR rate at the time, plus any discount code applied. I have to declare my income in euros, and the exchange rate at the moment of each sale is the only way to work that out afterwards.
- A two letter country code, derived from your IP address by Cloudflare before the request reaches me. Under EU rules, tax on a digital service depends on where the customer is, so I need to know which country a sale came from.
- Discount redemptions, meaning the code and the token address it was used for, so a code cannot be claimed twice and an unused one can be given back.
None of this identifies you. Your IP address itself is never stored in the database, only the country derived from it, and a country alone cannot single anyone out. A token address is public on the blockchain the moment the token exists. The contents of proxied network requests are not logged.
Three things do briefly persist:
- Web server access logs record your IP address, timestamp, requested path, and browser user agent string, which is the standard log any web server keeps. Retained for 7 days, then rotated out.
- Error logs. If building a transaction fails, the error is logged for debugging and may contain details of that request. Retained for 7 days.
- Rate limiting. Your IP is held in memory for 60 seconds to count requests and block abuse. It is never written to disk and vanishes on restart.
If you use my image storage
The site offers a choice. You can supply your own Pinata key, in which case nothing about the upload reaches my server and nothing is recorded. Or you can use my storage, in which case the image and metadata pass through my server and are pinned under my own Pinata account.
If you choose my storage, I record the content identifier of each file, whether it was an image or metadata, its size, the country code, the date, and your public wallet address. I keep that because the files are then hosted under my account and my identity. If someone reports that content is illegal, I have to be able to find it, remove it, and say where it came from.
Your wallet address is public information that your own transaction writes onto the blockchain moments later. I do not record it anywhere else, and never for people who bring their own Pinata key.
If you report content
A notice sent under the content reporting process necessarily contains your name and contact details, because a valid notice requires them. I keep that along with what you claimed and what I decided. The lawful basis is legitimate interests: being able to show that removals were justified, and being able to identify a pattern of bad faith claims.
Your Pinata key
The site asks for a Pinata JWT so it can upload your image on your behalf. This deserves a plain explanation, because pasting a credential into a website is not something you should do casually.
The key is used entirely inside your browser. It is attached to requests your browser sends straight to api.pinata.cloud over HTTPS. It is never transmitted to my server, never logged, and never stored anywhere: not in a cookie, not in localStorage, not on disk. When you close or reload the tab, it is gone and you will need to paste it again.
Because you are supplying a credential, use a key scoped to only the permissions it needs, meaning file pinning, rather than an account wide key. And revoke it in your Pinata dashboard when you have finished. This is good practice with any site, not a sign of distrust in this one.
Note that this design means your uploads happen under your Pinata account, subject to Pinata's own privacy policy, and Pinata sees your IP address and your files directly.
Who else sees your IP address
Loading and using the site causes your browser to connect to several independent services. Each one necessarily sees your IP address, and each is an independent controller of that data under its own policy:
- Cloudflare, which carries all traffic to the site through a tunnel and provides network protection. See the note below, because Cloudflare sees more than an IP address.
- Pinata, which receives your image, metadata and IP directly from your browser
- Your wallet extension, whether Phantom, Solflare or Brave Wallet, each with its own privacy policy and its own network activity
Two things this site deliberately does not do. Typefaces and JavaScript libraries are served from this domain rather than from Google or a public CDN, so loading the page reveals your address to nobody but Cloudflare. Many sites in this category load both from third parties without mentioning it.
One service is deliberately absent from that list. All communication with the Solana network passes through my server rather than going out from your browser, so my Solana provider sees my server's address and not yours. This is explained below.
I have no control over what these services do with that information, and no agreement with any of them on your behalf. If this matters to you, a VPN addresses the IP exposure, and reviewing each service's policy addresses the rest.
Cloudflare's position is different from the others, and worth stating plainly. The site reaches the internet through a Cloudflare Tunnel, which means Cloudflare terminates the HTTPS connection at its own edge and re establishes it onward to me. Your connection is encrypted at every point, but Cloudflare is technically able to see the contents of requests in decrypted form, not merely your IP address. In practice that includes your wallet address and the token name and symbol you submit.
This is how essentially all Cloudflare fronted sites work, and it is the trade off for the protection and availability the service provides. Cloudflare processes that traffic as my processor, under its own privacy policy and data processing terms.
Reaching the Solana network requires an RPC provider. I use Helius, and I route every request through my own server rather than letting your browser call them directly. The practical effect is that Helius sees my server's IP address, never yours, and cannot build a picture of your browsing.
Helius does see what the network needs to process: the wallet address being queried, and the signed transactions being broadcast. That information becomes public on the blockchain moments later anyway. Helius acts as my processor and is subject to its own privacy policy.
The token safety checker at /check reads public blockchain data. Nothing you type there is stored, and the token address you look up is not recorded. On mainnet the lookup goes through my server in the same way as the rest of the site. On devnet it goes directly from your browser to Solana's free public endpoint, which means that endpoint sees your IP address and the address you searched for.
The token safety checker at /check and the authority revoker at /revoke both read public blockchain data. Nothing you type on either page is stored, and the token addresses you enter are not recorded. On mainnet their requests go through my server in the same way as the rest of the site. On devnet they go directly from your browser to Solana's free public endpoint, which means that endpoint sees your IP address and the addresses you entered.
Data that becomes permanent
This is the most important section in this notice, and the one most likely to surprise people.
Creating a token publishes information to two systems designed specifically to be permanent and public.
The Solana blockchain
Your wallet address, your token's name, symbol, decimals, supply, and the metadata link are written to a public ledger replicated across thousands of computers worldwide. Anyone can read it, forever, through any block explorer. Blockchain addresses are pseudonymous rather than anonymous. If your address is ever linked to your identity, through an exchange, a public post, or any other route, all of its activity becomes linkable to you retroactively.
IPFS
Your image and metadata file are published to a distributed content addressed network. Unpinning them from your Pinata account stops Pinata hosting them, but any other node that has copied the content can continue to serve it indefinitely.
Neither I nor anyone else can edit or delete data once it is on chain or distributed across IPFS. A request to erase it is technically impossible to fulfil, no matter who makes it. Please assume anything you submit is permanent, and do not include anything you would not want public indefinitely, whether in the image, the name, the description, or the links.
Why I am allowed to do this
Under the GDPR, the lawful bases for the limited processing I carry out are:
- Performance of a contract (Article 6(1)(b)), because handling your wallet address and token details is the only way to build the transaction you asked for
- Legitimate interests (Article 6(1)(f)), covering short lived server and error logs, and rate limiting by IP, to keep the site secure, working, and resistant to abuse. I consider this proportionate because the data is minimal, kept briefly, and never used to profile anyone.
- Legal obligation (Article 6(1)(c)), for the fee, exchange rate and country code attached to each creation. Greek tax law requires me to keep records of what I earn, and EU rules on digital services require me to know which country a sale was made in.
No consent based processing takes place. The only cookies set are strictly necessary security cookies from Cloudflare, which fall outside the consent requirement, and there is no analytics or marketing. The country code is collected to meet a tax obligation rather than to profile anyone, and it is never used for anything else.
How long anything is kept
- Form data in your browser, until you close or reload the tab
- Transaction request data on my server, for the duration of the request, a few seconds, then discarded
- Rate limit records, for 60 seconds, in memory only
- Access and error logs, for 7 days, then deleted by rotation
- Cloudflare's logs, per Cloudflare's own retention policy, which I do not control
- Issued mint addresses, kept indefinitely, as a record of what this server has created
- Token creation records, meaning the address, network, date, fee, exchange rate and country code, kept for as long as tax and accounting law requires, which in Greece is currently five years from the end of the relevant financial year
- Discount redemption records, kept while the code remains in use, so a code cannot be claimed twice and an unused one can be given back
- Hosted upload records, meaning the file identifier, size, wallet address, country and date, kept for as long as the content remains pinned under my account and for a period afterwards so that an abuse report can still be answered. Files themselves may be unpinned at any time, including to manage storage costs
- Content reports, meaning who sent a notice, what was claimed, the evidence provided and the decision taken, kept indefinitely so decisions can be justified and repeated false claims identified
- Blockchain and IPFS data, permanently, and outside anyone's control
Your rights
If the GDPR applies to you, you have the right to request access to your personal data, its correction, its erasure, restriction of processing, portability, and to object to processing based on legitimate interests. You can exercise any of these by writing to [email protected], and I will respond within one month.
I should be honest about what these rights amount to here, because the answer is unusual:
- I hold no database of users, so an access request will normally find nothing at all associated with you, unless you contact me within the log retention window and can supply the IP address and approximate time to search for. The database holds token addresses this server created, hosted upload records, and discount code redemptions. If you can tell me your wallet address or a mint address, I can show you what is held against it.
- An erasure request covering server logs can be honoured. An erasure request covering blockchain or IPFS data cannot be, not as a matter of policy, but because the technology makes it impossible for anyone, including me.
- If you email me, that email and your address exist in my mailbox, and I keep correspondence for as long as needed to deal with it. Mail to this domain is handled by Proton Mail, based in Switzerland, acting as my processor. Switzerland has an adequacy decision from the European Commission, so no additional transfer safeguard is required.
Transfers outside the EEA
My own server processes data in Greece. However, several of the third parties in section 06, including Cloudflare, Pinata and Helius, operate globally and may process your IP address outside the European Economic Area, typically in the United States, under their own transfer safeguards.
Blockchain and IPFS data is by design replicated worldwide with no geographic boundary at all.
Email sent to this domain is processed by Proton Mail in Switzerland, which the European Commission recognises as providing adequate data protection.
Children
This site is not intended for anyone under 18 and I do not knowingly process children's data. If you believe a child has used the site, please contact me, though note that anything already written on chain cannot be removed.
Security
All traffic is served over HTTPS. The server has no open ports facing the internet at all. It reaches the outside world through a Cloudflare Tunnel, which makes only outbound connections, so there is no address anyone can connect to directly. Requests are rate limited and validated, and the server holds no user data to lose.
The strongest security property here is structural rather than procedural. The site is designed so that it never possesses your keys or your funds. It keeps a list of the token addresses it has created, and, for hosted uploads, the wallet address that made them. Both are public on the blockchain regardless. There is very little for an attacker to take that is not already public.
That said, no system is perfectly secure, and I make no guarantee. Protecting your wallet and your device remains your responsibility.
Changes
If this notice changes, the updated version appears at this address with a new date at the top. Material changes will be noted on the main page.
Contact and complaints
Questions, requests, or concerns go to [email protected].
If you are in the EU and believe your data has been handled unlawfully, you may complain to your national data protection authority, or to the authority in Greece: Hellenic Data Protection Authority. I would appreciate the chance to resolve it directly first.