What stays on your machine

Wallet connections are handled by Phantom, Solflare, or Backpack in the browser. MintBox does not ask you to paste a secret key, seed phrase, or password, and it has no server-side signer. The selected network and the pool ids you create in this browser are stored in localStorage so the liquidity page can suggest them. Clearing site data removes them.

What is sent to a server

The upload route receives the image file or the metadata JSON you submit and stores it in Supabase Storage when that is configured, otherwise Pinata. It does not receive your wallet address. The trending route requests public coin lists. The tracker route requests public posts from X only when X_BEARER_TOKEN is set; otherwise it returns sample posts that are not from real accounts. The Raydium config route requests public fee parameters. None of these routes store a database of wallets.

What is public anyway

A confirmed Solana transaction, including the fee transfer and your mint, is public. Uploaded images and metadata are public. Your RPC provider sees the calls your browser makes to the cluster URL you configured.

What we do not do

We do not add hidden transfers, token approvals, or address harvesting. We do not run analytics in this codebase. We do not sell wallet addresses, because the application does not collect them.