There are no accounts, no tracking cookies and no analytics. Nothing about you is stored between visits. The only database holds discount codes, which contain no personal data.
My server briefly sees your wallet's public address and your chosen token name and symbol, so it can build a transaction. It does not save them.
The part worth reading carefully is section 07. Your token image, its name, and your wallet address end up on a public blockchain and on IPFS, permanently, where nobody including me can remove them.
Who is responsible
The data controller for mintonsol.com is the independent developer who operates it, trading as mintonsol.com in Greece, reachable at [email protected].
My full legal name and postal address are not published on this page, but they are available on request. If you want to exercise a data protection right, or you need my identity for a legal or regulatory purpose, email the address above and I will provide it.
I run this alone. There is no team, no data protection officer, and no arrangement to sell or share data with anyone for marketing or any other purpose.
What I do not do
It is shorter to start with what does not happen. This site has:
- No user accounts, so no sign up, no login, no profile
- No tracking or advertising cookies. Cloudflare, which protects the site from automated abuse, sets one or two strictly necessary security cookies to remember that your browser passed a bot check. These carry no personal profile and are not used to track you across sites. No consent banner is needed because security cookies of this kind are exempt.
- No analytics, meaning no Google Analytics, no pixels, no tracking scripts, no heatmaps
- No advertising and no advertising identifiers
- No browser storage, since the site writes nothing to localStorage or sessionStorage
- No database of users. There is no account and no profile, and nothing records who you are. The one database on the server holds discount codes, and the address of every token this server has created, with the network and a timestamp. Those addresses are public on the blockchain anyway and are not linked to any person.
- No database of users. There is no account and no profile, and nothing records who you are. The one database on the server holds discount codes, and the address of every token this server has created, with the network and a timestamp. Those addresses are public on the blockchain anyway and are not linked to any person.
- No profiling and no automated decision making with legal effects
- No fingerprinting. The connect dialog checks which Solana wallet extensions are present in your browser, so it can show which are already installed. This happens entirely on your device, the result is never sent anywhere, and it is not combined with anything else to identify you.
- No sale or sharing of personal data with data brokers or advertisers
Everything you type into the form lives in your browser's memory and disappears when you close or reload the tab, except for the specific items described below.
Exactly where your data goes
Rather than describe this vaguely, here is every field the site handles and its actual destination.
What reaches my server
Your browser makes three kinds of request to my server. When the page loads, it asks what the current fee is, and that request sends nothing but your IP address and standard browser headers. When you create a token, it sends a single request containing your wallet address, token name, symbol, decimals, metadata link, network, your freeze and update authority choices, and a discount code if you entered one.
The third kind is Solana network traffic. Checking your balance, fetching a recent block, broadcasting a signed transaction and confirming it all pass through my server, which forwards them to Helius and returns the answer. These requests carry your wallet address and your signed transactions. They do not carry your keys, which never leave your wallet, and a signed transaction cannot be altered in transit without invalidating its signature.
The server uses all of this to do its job and then forgets it. Nothing about who you are is written to disk. No wallet address, token name, image or IP address is stored.
Two things are recorded, and neither identifies you. The address of every token this server creates, together with the network and a timestamp, so that if someone forges a transaction and blames this site I can show it was not created here. And, when a discount code is used, the code and the mint address it was used for, so a code cannot be claimed twice and an unused one can be given back.
A mint address is already public on the blockchain the moment a token exists, and is not linked to any person in these records. The contents of proxied network requests are not logged.
Three things do briefly persist:
- Web server access logs record your IP address, timestamp, requested path, and browser user agent string, which is the standard log any web server keeps. Retained for 7 days, then rotated out.
- Error logs. If building a transaction fails, the error is logged for debugging and may contain details of that request. Retained for 7 days.
- Rate limiting. Your IP is held in memory for 60 seconds to count requests and block abuse. It is never written to disk and vanishes on restart.
Your Pinata key
The site asks for a Pinata JWT so it can upload your image on your behalf. This deserves a plain explanation, because pasting a credential into a website is not something you should do casually.
The key is used entirely inside your browser. It is attached to requests your browser sends straight to api.pinata.cloud over HTTPS. It is never transmitted to my server, never logged, and never stored anywhere: not in a cookie, not in localStorage, not on disk. When you close or reload the tab, it is gone and you will need to paste it again.
Because you are supplying a credential, use a key scoped to only the permissions it needs, meaning file pinning, rather than an account wide key. And revoke it in your Pinata dashboard when you have finished. This is good practice with any site, not a sign of distrust in this one.
Note that this design means your uploads happen under your Pinata account, subject to Pinata's own privacy policy, and Pinata sees your IP address and your files directly.
Who else sees your IP address
Loading and using the site causes your browser to connect to several independent services. Each one necessarily sees your IP address, and each is an independent controller of that data under its own policy:
- Cloudflare, which carries all traffic to the site through a tunnel and provides network protection. See the note below, because Cloudflare sees more than an IP address.
- esm.sh, a public CDN that delivers the Solana JavaScript libraries the page needs to run
- Google Fonts, since the app page loads two typefaces from Google's servers, which reveals your IP to Google
- Pinata, which receives your image, metadata and IP directly from your browser
- Your wallet extension, whether Phantom, Solflare or Brave Wallet, each with its own privacy policy and its own network activity
One service is deliberately absent from that list. All communication with the Solana network passes through my server rather than going out from your browser, so my Solana provider sees my server's address and not yours. This is explained below.
I have no control over what these services do with that information, and no agreement with any of them on your behalf. If this matters to you, a VPN addresses the IP exposure, and reviewing each service's policy addresses the rest.
Cloudflare's position is different from the others, and worth stating plainly. The site reaches the internet through a Cloudflare Tunnel, which means Cloudflare terminates the HTTPS connection at its own edge and re establishes it onward to me. Your connection is encrypted at every point, but Cloudflare is technically able to see the contents of requests in decrypted form, not merely your IP address. In practice that includes your wallet address and the token name and symbol you submit.
This is how essentially all Cloudflare fronted sites work, and it is the trade off for the protection and availability the service provides. Cloudflare processes that traffic as my processor, under its own privacy policy and data processing terms.
Reaching the Solana network requires an RPC provider. I use Helius, and I route every request through my own server rather than letting your browser call them directly. The practical effect is that Helius sees my server's IP address, never yours, and cannot build a picture of your browsing.
Helius does see what the network needs to process: the wallet address being queried, and the signed transactions being broadcast. That information becomes public on the blockchain moments later anyway. Helius acts as my processor and is subject to its own privacy policy.
The token safety checker at /check reads public blockchain data. Nothing you type there is stored, and the token address you look up is not recorded. On mainnet the lookup goes through my server in the same way as the rest of the site. On devnet it goes directly from your browser to Solana's free public endpoint, which means that endpoint sees your IP address and the address you searched for.
The token safety checker at /check and the authority revoker at /revoke both read public blockchain data. Nothing you type on either page is stored, and the token addresses you enter are not recorded. On mainnet their requests go through my server in the same way as the rest of the site. On devnet they go directly from your browser to Solana's free public endpoint, which means that endpoint sees your IP address and the addresses you entered.
Data that becomes permanent
This is the most important section in this notice, and the one most likely to surprise people.
Creating a token publishes information to two systems designed specifically to be permanent and public.
The Solana blockchain
Your wallet address, your token's name, symbol, decimals, supply, and the metadata link are written to a public ledger replicated across thousands of computers worldwide. Anyone can read it, forever, through any block explorer. Blockchain addresses are pseudonymous rather than anonymous. If your address is ever linked to your identity, through an exchange, a public post, or any other route, all of its activity becomes linkable to you retroactively.
IPFS
Your image and metadata file are published to a distributed content addressed network. Unpinning them from your Pinata account stops Pinata hosting them, but any other node that has copied the content can continue to serve it indefinitely.
Neither I nor anyone else can edit or delete data once it is on chain or distributed across IPFS. A request to erase it is technically impossible to fulfil, no matter who makes it. Please assume anything you submit is permanent, and do not include anything you would not want public indefinitely, whether in the image, the name, the description, or the links.
Why I am allowed to do this
Under the GDPR, the lawful bases for the limited processing I carry out are:
- Performance of a contract (Article 6(1)(b)), because handling your wallet address and token details is the only way to build the transaction you asked for
- Legitimate interests (Article 6(1)(f)), covering short lived server and error logs, and rate limiting by IP, to keep the site secure, working, and resistant to abuse. I consider this proportionate because the data is minimal, kept briefly, and never used to profile anyone.
No consent based processing takes place. The only cookies set are strictly necessary security cookies from Cloudflare, which fall outside the consent requirement, and there is no analytics or marketing.
How long anything is kept
- Form data in your browser, until you close or reload the tab
- Transaction request data on my server, for the duration of the request, a few seconds, then discarded
- Rate limit records, for 60 seconds, in memory only
- Access and error logs, for 7 days, then deleted by rotation
- Cloudflare's logs, per Cloudflare's own retention policy, which I do not control
- Issued mint addresses, kept indefinitely, as a record of what this server has created
- Discount redemption records, kept while the code remains in use, so a code cannot be claimed twice and an unused one can be given back
- Blockchain and IPFS data, permanently, and outside anyone's control
Your rights
If the GDPR applies to you, you have the right to request access to your personal data, its correction, its erasure, restriction of processing, portability, and to object to processing based on legitimate interests. You can exercise any of these by writing to [email protected], and I will respond within one month.
I should be honest about what these rights amount to here, because the answer is unusual:
- I hold no database of users, so an access request will normally find nothing at all associated with you, unless you contact me within the log retention window and can supply the IP address and approximate time to search for. The database holds token addresses this server created and discount code redemptions, neither of which records who you are. If you can tell me a mint address, I can show you what is held against it.
- An erasure request covering server logs can be honoured. An erasure request covering blockchain or IPFS data cannot be, not as a matter of policy, but because the technology makes it impossible for anyone, including me.
- If you email me, that email and your address exist in my mailbox, and I keep correspondence for as long as needed to deal with it. Mail to this domain is handled by Proton Mail, based in Switzerland, acting as my processor. Switzerland has an adequacy decision from the European Commission, so no additional transfer safeguard is required.
Transfers outside the EEA
My own server processes data in Greece. However, several of the third parties in section 06, including Cloudflare, Google, Pinata, esm.sh and Helius, operate globally and may process your IP address outside the European Economic Area, typically in the United States, under their own transfer safeguards.
Blockchain and IPFS data is by design replicated worldwide with no geographic boundary at all.
Email sent to this domain is processed by Proton Mail in Switzerland, which the European Commission recognises as providing adequate data protection.
Children
This site is not intended for anyone under 18 and I do not knowingly process children's data. If you believe a child has used the site, please contact me, though note that anything already written on chain cannot be removed.
Security
All traffic is served over HTTPS. The server has no open ports facing the internet at all. It reaches the outside world through a Cloudflare Tunnel, which makes only outbound connections, so there is no address anyone can connect to directly. Requests are rate limited and validated, and the server holds no user data to lose.
The strongest security property here is structural rather than procedural. The site is designed so that it never possesses your keys or your funds, and holds no record of who you are. It does keep a list of the token addresses it has created, but those are public on the blockchain and are tied to no person. There is very little for an attacker to take.
That said, no system is perfectly secure, and I make no guarantee. Protecting your wallet and your device remains your responsibility.
Changes
If this notice changes, the updated version appears at this address with a new date at the top. Material changes will be noted on the main page.
Contact and complaints
Questions, requests, or concerns go to [email protected].
If you are in the EU and believe your data has been handled unlawfully, you may complain to your national data protection authority, or to the authority in Greece: Hellenic Data Protection Authority. I would appreciate the chance to resolve it directly first.