Privacy Policy

• We never ask for your seed phrase or private key, and we never ask you to approve a transaction.
• We never try to find out who owns a wallet. Scores describe on-chain behaviour only.
• We do not sell your data or share it for advertising.
• We do not set cookies.
• The extension does not read your browsing history.

When you check a wallet or token, we store the address, the score, the signals behind it, and the public on-chain data used to calculate it. This lets us show the report again, show how a score changes over time, and explain every result. This data comes from the public Solana blockchain and is not linked to your name.

Anyone can look up any address, so reports on public pages (for example /wallet/<address>) are visible to anyone with the link.

If you connect a wallet (for example Phantom), we see its public address. To sign in, you sign a short text message that proves you control the address. Signing a message cannot move funds. We store:

• your wallet address;
• a one time sign in code, which expires after 10 minutes;
• a session, stored only as a hashed value, which expires after 30 days or when you sign out.

When signed in, we also store the things you choose to save: your watchlist, saved wallets, and alerts about wallets you watch.

To understand which features are used, the website stores a random visitor ID in your browser's local storage. It is not a cookie and it contains nothing about you. With it we record simple events, such as “a wallet was checked”, together with the address checked and the time. We do not store your IP address in our database, and we do not use Google Analytics or similar services.

The website keeps a few values in your browser's local storage:

• your sign in session, so you stay signed in;
• the anonymous visitor ID described above;
• an admin token, only if you are the site operator.

You can remove these at any time by signing out or clearing your browser's site data.

• Waitlist. If you request API access we store the email address and project details you enter. We use them only to set up your access and reply to you. No newsletter.
• API keys. Keys are stored only as hashed values. We record how many requests each key makes per day so we can enforce plan limits.
• Payments. Paid plans are handled by Stripe. Your card details go directly to Stripe and never reach our servers. We keep only the Stripe customer and subscription IDs and your plan.
• Account activity. We keep a log of account actions, such as creating or revoking a key, to help with security.

The Vouch extension runs only on the Solana sites listed in its store page (such as pump.fun, Jupiter, Raydium, Magic Eden, Solscan, Birdeye, and DexScreener). On those pages it looks for Solana addresses in the page and shows a score badge next to them.

• Only the address being checked is sent to the Vouch API. Page content, URLs, and browsing history are never sent.
• Your settings (the Vouch website address) are saved with your browser's sync storage.
• When installed, the extension sends one anonymous “installed” event with no identifiers.

When you send a command to the Vouch bot, Telegram passes us the message so we can reply. We check the address you sent and reply in the chat. We do not store your messages, your name, or your username. For usage statistics and rate limits we store a one way hash of your Telegram user ID, which cannot be turned back into the ID.

Sites can embed a Vouch badge. The badge asks our API for the score of the address it shows. We do not receive anything about the visitor beyond what any web request includes.

We rely on a small number of providers to run Vouch:

• Vercel hosts the website and API. Like any web host, it keeps short lived request logs that include IP addresses.
• Neon hosts our database.
• Helius provides Solana blockchain data. We send it the public addresses being analysed.
• Stripe processes payments.
• Telegram delivers bot messages.
• Google distributes the browser extension through the Chrome Web Store.

These providers process data on our behalf and under their own privacy terms. Some of them may process data outside your country.

• Sign in codes: 10 minutes.
• Sessions: until they expire (30 days) or you sign out.
• Wallet and token analyses: kept so scores stay explainable and history can be shown.
• Watchlists, saved wallets, alerts, API keys, and billing records: until you delete them or ask us to.
• Waitlist entries: until your access is set up or you ask us to remove them.

You can ask us for a copy of the data linked to your wallet address, email, or API account, or ask us to correct or delete it. Email privacy@usevouch.xyz from the relevant email address, or tell us the wallet address and we may ask you to sign a message to prove you control it. Depending on where you live, you may also have the right to object to processing or complain to your local data protection authority.

Public blockchain data cannot be deleted by anyone, including us. Deleting your data removes it from Vouch, not from the blockchain.

Connections use HTTPS. Sessions and API keys are stored as hashes, so a database leak would not expose usable credentials. No system is perfectly secure, but we work to keep what we hold small and protected.

Vouch is not intended for anyone under 18, and we do not knowingly collect data from children.

If we change this policy we will update the date at the top of this page. For significant changes we will also post a notice on the site.

Questions or requests: privacy@usevouch.xyz. Vouch is operated by Vouch. See also our Terms of Service.