Privacy

Last updated: 18 October 2026. This policy explains how Spacedust handles personal data when you use Spacedust.

Who we are

Spacedust operates Spacedust. For UK/EU data protection law, it is the controller of the limited personal data described here. Contact us about privacy or a data request using the details below.

The short version

• There is no Spacedust account. No signup, password, name, email address or payment card is collected to use the app.
• We never receive your private key or seed phrase. Signing happens inside your wallet.
• No analytics, advertising, session replay or tracking pixels. Reown/WalletConnect analytics is switched off.
• We do not sell personal data.
• Your wallet address and public transaction data go to the RPC, pricing and wallet-connection providers needed to operate the app.
• Preferences and history stay in your browser and can be deleted from Delete my data.

What we collect

• Wallet and public chain data. Your wallet address, token and NFT holdings, token-account addresses, balances and public transaction data. This is public on Solana; we read it through an RPC provider to scan your wallet and build transactions.
• Transaction details. The mints, amounts, recipients and instructions you choose, plus the signed transaction and its signature. These are needed to simulate, submit and confirm the action you asked for.
• Technical data. IP address, user agent, request path, timestamp and error information processed by our hosting and rate-limiting providers when you call the app or its API routes.
• Local browser data. Your dust threshold, preferred output asset, smart-filter setting, sweep history, hidden assets, the local sweep tally, pending lookup-table cleanup addresses, whether the interface is in Basic or Pro mode (kept only for the current visit), and whether you dismissed the storage notice. This stays on your device.
• Support messages. If you email us, we receive your email address and whatever you include in the message.

We do not knowingly collect your name, postal address, government ID, date of birth, bank details, card details, precise location, contacts, health data or biometric data. We do not ask for and cannot use your private key or seed phrase.

Why we use it, and our lawful bases

• To provide the service you ask for — scanning, pricing, simulating and submitting transactions. UK/EU basis: performance of a contract or steps at your request.
• To keep the service secure and available — abuse prevention, rate limiting, debugging and protecting our providers' API credits. Basis: our legitimate interests in a secure, functioning service.
• To comply with law — responding to valid legal requests and keeping records where required. Basis: legal obligation.
• To answer you — responding to a support or privacy message. Basis: your request and our legitimate interest in support.

Who we share it with

We use the following third-party services. They receive only what is needed for the stated purpose; we do not sell data or give it to advertisers. Wallet addresses and blockchain transactions are public.

• Helius — Solana RPC and DAS indexing. Receives your wallet address, token/NFT account data and transaction data through our server routes, so we can scan holdings and read the chain. If Helius is not configured, the app uses a public Solana RPC instead.
• Jupiter — price, quote and swap-build APIs. Receives the mints, amounts and wallet address (taker) needed to quote and build a route, through our server routes. Token metadata and logos may be fetched from Jupiter's CDN.
• Reown / WalletConnect — wallet connection and relay. When you choose WalletConnect, connection metadata, your wallet address and session data pass through its relay. AppKit analytics is disabled. Without a project id, this route is not used.
• Vercel — hosting, CDN and serverless functions. Processes request logs, IP address, user agent, timestamps and error data as our hosting processor. Vercel Analytics is not installed.
• Upstash / Vercel KV (optional) — shared rate-limit counters. If configured, stores a counter keyed by your IP address and route for 60 seconds. It does not store the request body or wallet address. If not configured, the in-memory limiter is used.
• Solana RPC providers — Helius or the public Solana RPC endpoint. Receives the wallet/transaction data needed to read the chain and submit transactions.
• Token image hosts — when a token logo is shown, your browser requests the image from a third-party host (for example Jupiter CDN, Arweave, IPFS gateways, CloudFront, GitHub, CoinGecko or Trust Wallet). Those hosts receive ordinary request data such as your IP address and user agent. Images are requested with no referrer; we do not control those hosts' logs.
• Your wallet app — Phantom, Solflare, Backpack, Jupiter or another wallet handles signing and its own data. Its privacy policy applies to that interaction; we never receive your keys.
• Solscan — only when you click a transaction link. It receives the request when you open it; we do not send data to it.
• X and GitHub — only when you click a footer link. Those sites receive the request when you open them; we do not send data to them.

We do not use analytics, advertising, session-replay, email-marketing, payment-processing or customer-data platforms. No payment card details are collected: Spacedust's fee is an on-chain SOL transfer.

Cookies and browser storage

We do not use advertising cookies, analytics cookies, tracking pixels or session-replay tools. Spacedust uses strictly necessary browser storage to remember preferences, keep a local sweep history and keep a wallet connection alive. That storage stays on your device and is not sent to us as a profile.

The app's own storage keys are:

• spacedust:v1:threshold
• spacedust:v1:outputAsset
• spacedust:v1:smartFilter
• spacedust:v1:sweepHistory
• spacedust.lastScan.v1
• spacedust:v1:hiddenAssets
• spacedust:v1:lookupTableCleanup
• spacedust:v1:lookupTableAutoReclaim
• spacedust:v1:sweepHistory:sweptWallets
• spacedust:v1:sweepHistory:sweptUsd
• spacedust:v1:cookieNotice
• spacedust:v1:siteMode

If you choose WalletConnect, Reown/AppKit may store its own session and key material in localStorage or IndexedDB under its own keys; that is necessary for the connection to work. We do not set advertising or analytics cookies, and Reown analytics is disabled.

A small notice appears on the site explaining this. It can be dismissed, and it is not a consent gate because there are no optional trackers to consent to. If optional analytics is added later, this policy and the notice must be updated to ask for consent first.

Retention and deletion

• Browser data stays until you clear it, either with Delete my data or your browser's site settings.
• Rate-limit counters, if the shared store is enabled, expire after 60 seconds.
• Hosting and error logs are kept by Vercel for the period in its configuration and then deleted or aggregated. We do not maintain a separate analytics database.
• Support emails are kept only as long as needed to answer the request and meet legal obligations.
• On-chain data is public and permanent. No one can delete a transaction or wallet address from Solana.

There is no Spacedust account to delete. The deletion flow disconnects your wallet and clears this site's local storage, session storage, cookies, caches and IndexedDB databases on that browser. For a request about server logs or a support message, use the contact details above and we will respond within the period required by law.

Your rights

If you are in the UK or EEA, you have the right to access, correct, delete or restrict processing of your personal data, to object to processing based on legitimate interests, to data portability where it applies, and to withdraw consent where processing is based on consent. You also have the right to complain to a supervisory authority — the Information Commissioner's Office in the UK, or your local authority in the EEA.

Because the app has no account, most data is either public chain data (which cannot be deleted) or local data you can erase yourself. Use Delete my data for the local data, and contact us for anything held in support or logs.

International transfers

Some providers are in the United States or other countries outside the UK/EEA. Where required, transfers rely on appropriate safeguards such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an applicable adequacy decision. Contact us if you want more information about the safeguard used for a particular provider.

Security

Spacedust is non-custodial: it never asks for, receives or stores a private key or seed phrase. Transactions are simulated and audited before you sign, and API keys stay on server routes. No system is perfect; you are responsible for your wallet, device and the addresses you enter.

Children

Spacedust is not intended for anyone under 18. We do not knowingly collect data from children.

Changes

We may update this policy when the app or the law changes. The date at the top is the version date. Material changes will be shown on this page; continued use after an update means you accept the updated policy.

Contact

For privacy or legal requests, use the contact details at the top of this page. If a detail is missing, do not assume an address: ask us and we will confirm the correct channel.