What Zoltrak knows about you

Last updated 28 September 2026 · Draft: not yet reviewed by a lawyer.

Without an account

Your journal, your settings, your watchlist, your notes and your paper trading account live in your browser's local storage. They are not uploaded. Clearing your browser data deletes them, and nobody holds a copy, Zoltrak included.

With an account

Signing up stores:

• your email address, held by the authentication service so you can sign in;
• a handle, which is public;
• a bio and picture, if you add them, both public;
• trades you upload, only if you turn sharing on;
• who you follow, which is public;
• anything you post in a coin room, which is public.

Sharing is off by default. Signing up does not put your trading on a public leaderboard. That is a switch you have to turn on yourself.

Zoltrak never stores your password. Sign-in goes straight to the authentication service, which returns a token.

Your wallet

Connecting a wallet shares its public address and nothing else. That is the same address anybody can already see on a block explorer.

Zoltrak never asks for, receives, or stores a private key or a seed phrase. There is no code path in it that could accept one.

There are two kinds of wallet here and they sign in different places. A browser wallet — Phantom, Solflare, Backpack — signs inside its own window, and Zoltrak only ever gets the signed result back. A Zoltrak wallet, the one that appears if you sign up with an email, is an embedded wallet run by Privy. It signs inside Privy's own secure environment, and the key is split so that no single party — not Privy, not Zoltrak — can move your money alone.

Turning on away-stops delegates that wallet: Privy will accept an instruction from Zoltrak's server to carry out a stop you set, even with your browser shut. That server is built but not switched on yet, so today a stop only fires while Zoltrak is open and nothing uses the delegation. It is the one case where something could be signed while you are not at the keyboard. It is off unless you turn it on, it applies only to the Zoltrak wallet, and turning it off ends it. Even then it is permission and not a key: Privy holds the key, Zoltrak holds permission to ask.

Crash reports

When something breaks, Zoltrak sends an error report so it can be fixed. It contains a message, a trimmed stack trace, which page you were on, and your browser's user-agent string.

It deliberately does not contain your account, your wallet address, your email, your handle, anything you typed, anything from your journal, or anything from your browser storage. Anything shaped like a key, an address, a token or an email address is stripped before the report leaves your browser, and the report is sent without your login attached so it cannot be tied back to your account.

It is posted to a Discord channel the developer watches, so Discord handles it on the way through. That is the whole destination — a report is not written to the Zoltrak database and is not attached to your account, because by the time it is sent there is nothing on it to attach.

What is sent to other services

Using Zoltrak makes requests to:

• DexScreener and GeckoTerminal — coin prices and pools;
• CoinGecko, Coinbase and Kraken — the SOL price, and each other's answers to check it against. CoinGecko is also asked what SOL was worth in the past, so a trade can be valued at the price you actually paid rather than at today's. That request carries the dates of your trades and nothing else — no address, no wallet, no login;
• Jupiter — swap quotes, building a transaction, and the small price chart on each row of the board (that request carries only the coin’s address). It is also asked for your wallet’s own swap history, so the app can show when you bought a coin and what you paid for it. That request contains your wallet address, and the history it returns is already public on the chain;
• pump.fun and PumpPortal — new-coin data, and building a launch or a trade on that curve;
• IPFS gateways (ipfs.io, Cloudflare, dweb.link, Pinata, nft.storage) and Arweave — a coin’s own artwork. When a coin is new enough that none of the price services has a picture for it yet, the app reads the address the coin itself carries on the chain and asks one of these for it. The request contains the coin’s address and nothing about you — no wallet, no login. Only these gateways are ever contacted: the address is chosen by whoever created the coin, so a coin pointing anywhere else is ignored rather than followed;
• public Solana nodes — reading balances, reading your past transactions, and confirming transactions;
• Jito — when MEV protection is on, your already-signed transaction is relayed through it privately instead of the public mempool;
• Privy — only if you use a Zoltrak wallet: it creates it, holds its key share and signs with it;
• MoonPay — only if you buy coins with a card, or cash out to one: the payment happens on MoonPay's own page, so they take your card and identity details and Zoltrak never sees either. They are told the wallet address the coins are going to or coming from, because that is the payment;
• IPFS gateways — coin images, which are addressed by the coin and not by you;
• Google/YouTube, Twitch and X — only if you link that account, to confirm the handle is yours;
• Discord — a bug report goes to a Discord channel the developer watches, not to a database;
• Supabase — accounts, the leaderboard and coin rooms.

Most of that list is read-only price and coin data that would be fetched whether or not you had an account. The ones that involve you specifically are Privy, MoonPay, Supabase, Jito and the account-linking services, and each is named above with what it gets.

Those requests carry your IP address, as any web request does. When you look up a wallet, that wallet's public address is sent to the services above so they can answer. Zoltrak does not send them anything about you beyond what the request needs.

No tracking

No advertising networks. No third-party analytics. No tracking cookies. The only things kept in your browser are the app's own data and, if you sign in, a session token.

Deleting your data

Without an account: clear your browser storage for this site and it is gone.

With an account: email ZoltrakTrades@gmail.com and ask. Deletion is done by hand at the moment, not by a button in the app. Clearing your browser storage removes the local copy either way, but it does not remove the account itself.

Children

Zoltrak is not intended for anyone under 18.

Changes

This page may change. The date at the top says when it last did.

Contact

Questions about privacy, or to ask for your account and data to be deleted: ZoltrakTrades@gmail.com.

To do before launch: confirm which region your database is hosted in. If you will have users in the UK or EU, have someone check this against GDPR. Account deletion is by email for now, not automated. This is a careful draft, not legal advice.