01 No account, just a wallet address
There is no sign-up, no login and no password. A wallet address is the only identifier this site keeps, and it is recorded wherever that wallet acts: the pool it asked for, the rules it set, the rounds that paid it, the drops it sent or was sent, the profile it wrote. It is public on Solana already, but everything below is filed under it, so it is worth saying plainly.
02 What is stored, and for how long
Curves. When a wallet launches a token on Raydium's curve, the site records the mint, the curve's address, the launch transaction, the wallet, the plan it signed — its buy, the ladder and the payout rules — and what the watcher reads from chain as the curve fills and graduates, and publishes them. Kept while the site runs: they mirror the pool account and the crank's transaction on chain.
Pools. When a pool is opened for a wallet, the directory records the pool address, the transactions, the two mints, the amounts, the wallet and its one-line note, and publishes them. Kept while the site runs: they mirror records on chain.
Tokens and their rules. A launched token's name, ticker, description, pictures and links, and the payout rules its creator signs — including labels for team wallets and the announcement channels. Kept while the token is listed. The creator can change the rules and blank the description, pictures and links; the name and ticker are fixed, as they are on chain.
Your profile. Anything you put on your public page — a name, a handle, one line, a picture, links — is stored under your wallet and shown at /u/<wallet>, because that is the point of it. Every edit is a message you sign. Kept until you erase it, which you do from that page with one signature.
Notifications. If you switch payouts on in the app or the installed site, your device's push token is stored against the wallet you asked to hear about, so a round can tell you it paid. Kept until you switch it off, or until Apple or your browser's push service says the device is gone, or five sends in a row fail. Nothing else about the device is kept, and the token is used for nothing but that message.
Asks. When a wallet asks for a drop, with a message it signs, the site stores the wallet, the coin, the stock and ticker it named, the message's time and signature, and when it was filed. An ask is public: anyone can look up whether a wallet asked for a coin, and the coin's pages count the asking wallets by what they hold now. Asks are never used to choose who is paid. Kept until you have it deleted (see Deleting what is stored), or until the coin has 2,000 asks and one from a wallet holding more takes its place.
Coins you run. When a wallet claims a coin's tools here without a pool, with a message it signs, the site stores the wallet, the coin, how the pairing rule cleared it, the coin's ticker and name as read then, the message's time and signature, and what the wallet saves: a note, links, its drop defaults and a Discord webhook. All of it but the webhook is public — the wallet, how it was cleared, the note, the links and the drop defaults, wallets it leaves out included; the webhook is kept on the server and used only to post that coin's drops. When the claim ends — let go, replaced, or the rule no longer clears it — what it saved is erased and the rest kept while the site runs, so an old signature cannot be used again. Another wallet pairing the coin, or the operator hiding the wallet, ends it without erasing what it saved; up to 5,000 claims in all, ended ones out first.
Drops. When a drop sent with Pay holders now is filed on the website, the site reads each transaction back from the chain and stores the wallet that paid, the stock, every wallet paid and what it received, the transactions, the coin's ticker, picture and creator as read then, the dollars sent at the time and, for a drop to a coin's OGs, its cutoff and how many of them it reached. A drop is public: its receipt, the coin's page and the site's boards show it, and it may be posted as described under Third parties. Kept while the site runs, the newest 100 a coin and 20,000 in all, oldest out first, or until you have it deleted (see Deleting what is stored); the transfers themselves stay on chain.
Payouts and referrals. What a round paid a wallet — the stock, the amount, the transaction — so the ledger can show it. A buy made through someone's referral link on the website records the buyer's wallet, the transaction and its value, so the referrer can be paid. Kept while the site runs: they mirror transactions on chain.
Reports. When you report a token, a pair or a profile, the site stores what you reported, the name your screen showed for it, the page you reported it from, the reason, the line you added and the time, with a scrambled stand-in for your connection that cannot be turned back into an IP address and changes whenever the server restarts. The newest 5,000 are kept. Reports are also passed to the operator on the site's own alert channel (a Telegram chat or a webhook), name, page and note included.
Takedowns. What the operator removes — a token, or a wallet and what it posted — goes on a list so it stays removed. Kept until it is put back. A removed wallet's handle stays with it, even if it clears its profile.
Server logs. The site is served through Cloudflare, which sees each request, with your IP address, before passing it to the host, Render. Render keeps request logs, with IP addresses, under its own retention. The rate limiter counts requests per IP address in memory only, never on disk.
On your device only. Your theme, whether you dismissed a hint, which referral link you arrived through (thirty days), which payout batches have confirmed, the tokens you hid and the wallets you blocked, an unsent launch draft, a launch or a pairing still in progress, and whether this device has payout alerts on and for which wallet. In the app, also the link to your wallet app — a key for talking to it, its session and your address — until you disconnect. None of it leaves your device except as the request it was kept for.
03 Deleting what is stored
Erase your profile yourself: press Clear profile on your page and sign once. That also switches payout alerts off on every device following your wallet. Or switch notifications off on the payouts page. For anything else stored under your wallet, press Report on your own page, choose Something else and say what to delete, or email support@getstonked.xyz. On-chain records cannot be deleted by anyone.
04 What is not collected
No email addresses unless you write to us, no cookies for tracking, no analytics, no crash reporting, no advertising identifiers, no location and no contacts. Nothing stored here is ever joined with data from anywhere else to follow you, and nothing is sold or given to a data broker. The site never receives your private key or seed phrase — every transaction from your wallet is signed inside your own wallet app.
05 Third parties
Using the site sends requests to a Solana RPC provider; to Jupiter for token metadata and prices; and to DexScreener for the embedded chart. Pictures load from wherever they are hosted: stock logos from the issuers' asset hosts (xStocks' site on Webflow's CDN, xstocks-metadata.backed.fi, prestocks.com), and other pictures from the host a token's metadata or list names — usually an IPFS or Arweave gateway, sometimes GitHub, Google Cloud Storage or Imgur. Connecting a wallet hands off to Phantom or Solflare. Each of these receives your IP address and sees what you look up. Mail to our support address is forwarded by Namecheap, which sees your email address and what you wrote.
We share data with a service only to run the feature it is named for above, and we use only services that give it the same or equal protection as this policy: the host (Render), the proxy in front of it (Cloudflare), Apple's push service, the Solana RPC provider, Jupiter, DexScreener, Phantom, Solflare, the mail forwarder (Namecheap), and the alert channel reports are sent to.
The server sends a payout notification to Apple's push service for the app, or to your browser's push service for the installed site, with your device's token and the message. Payout announcements to Telegram, Discord, X and a creator's own webhook carry a round's totals, never a wallet's own — except a trading competition's result, which names each winning wallet, shortened, with what it won. A drop's post, to the coin's bound Telegram chats, its Discord and the site's own channel, names the wallet that sent it, shortened, with what it sent in all; the site's own webhook also receives the drop's record, that wallet and its transactions in full.
06 On-chain activity is permanent and public
Anything you sign is recorded on Solana permanently and is visible to anyone. That is a property of the blockchain, not of this site, and it cannot be deleted or amended by the operator or by you.