Privacy policy

raid is a web app for launching, trading and discussing tokens on the Stellar network. This policy explains what personal data raid collects when you use the app, why, who processes it on our behalf, how long it is kept and the rights you have. It applies to the raid web app and its installable version.

raid is built so that ownership facts are public: wallet holdings, trades and token launches happen on the public Stellar ledger. Please read section 4 on what that means for your privacy.

The operator of raid is responsible for the processing described in this policy. You can reach us here:

We collect only what raid needs to run your account and keep it secure:

• Account details: the email address you log in with, or the name and email your Google or Apple account shares when you choose to log in that way; your raid handle, display name and the bio, avatar and banner you add.
• Wallets: the public addresses of the wallets created for your account (a Stellar wallet, plus EVM and Solana addresses used for deposits). Private keys are managed by our wallet provider, Privy; raid never sees or stores them.
• Activity in raid: tokens you launch, trades you make through raid, theses you post and their likes, who you follow, alerts, your watchlist, copy-alert choices and your settings.
• Sign-ins and security: for each signed-in device, a device name taken from your browser (for example “Chrome · Windows 11”), the IP address, an approximate location (city or country) worked out from that IP, and when it signed in and was last active. If you turn them on, we also keep your authenticator-app secret (encrypted) and your passkeys’ public keys and device names. Security actions such as signing in with a code, adding a passkey or deleting your account are logged with the IP address and browser.
• Transfers you make: when you send or withdraw XLM, the transaction hash, amount, recipient and memo, so the transfer can be confirmed on the ledger and shown in your history.
• X account (optional): if you link X, your X handle and account id, to show a verified badge on your profile.
• Error reports: when something breaks, technical details of the error. Email addresses and wallet addresses are removed from these reports before they leave your device or our servers.

raid does not use advertising or tracking cookies and does not sell your data. Your browser’s local storage keeps your session, a token that tells raid this device has signed in before, your display preferences (theme, currency, blur) and drafts such as an unfinished token launch; you can clear these at any time in your browser.

Trades, launches, transfers and balances are transactions on Stellar, a public blockchain. Anyone can read them, and they cannot be changed or deleted by us or anyone else. raid shows your handle next to your wallet address, so activity of that address can be connected to your raid profile. Deleting your raid account removes your profile from raid but does not remove anything from the ledger.

• Providing raid: creating your account and wallets, signing you in, showing your profile, portfolio, trades and posts, and running the features you use (performance of our contract with you).
• Security: recognising your devices, asking for your authenticator code on a new device, confirming withdrawals and sends with your passkey, showing your active sessions and preventing abuse (our legitimate interest in keeping accounts and funds safe).
• Fixing problems: understanding and fixing errors (legitimate interest).
• Product updates: only if you opted in when you created your account (consent, which you can withdraw).
• Legal duties: where the law requires us to keep or disclose information (legal obligation).

We use these service providers, each bound to process data only to provide its service to raid:

• Privy: login (email codes, Google, Apple) and wallet creation and signing.
• Railway: hosting for raid’s backend and its database (accounts, profiles, social activity, sessions and security records).
• Vercel: hosting for the raid web app and storage for files you upload, such as token logos.
• Sentry: error monitoring, with emails and wallet addresses removed.
• Stellar network services: the public Stellar servers (Horizon and RPC) that raid reads the ledger from and submits your transactions to.
• Google, Apple and X: only when you choose to log in with Google or Apple, or link your X account.

Locations of sign-ins are worked out on raid’s own servers from a local copy of MaxMind’s GeoLite database; your IP address is not sent to MaxMind. Some providers are based outside your country, including in the United States; where required, transfers rely on safeguards such as standard contractual clauses.

• Account and activity: while your account exists. Deleting your account (Settings → Delete account) removes your profile and account data from raid.
• Sessions: until you sign that device out, or 30 days after it was last used.
• Security logs: for as long as needed to protect accounts and investigate abuse, then deleted.
• On-chain data: permanently, on the public ledger (see section 4).

Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, receive a copy of it, object to or restrict how we use it, and withdraw consent you have given. You can edit your profile and settings and delete your account in the app; for anything else, contact us using the details in section 2. You can also complain to your local data protection authority.

All traffic to raid is encrypted in transit. Authenticator secrets are stored encrypted, device tokens and session tokens are stored only as hashes, and you can add an authenticator app for new-device sign-ins and passkeys for withdrawals and sends. No system is perfectly secure; keep your login email and devices protected.

raid is only for people aged 18 or over. We do not knowingly collect data from anyone younger.

We will update this page when raid’s handling of data changes, and change the date at the top. For significant changes we will let you know in the app.

Questions about this policy or your data:

See also the terms and the risk disclosure.