Privacy Policy

StakePoint operates the website stakepoint.app and the associated decentralised services described above. For the purposes of applicable data protection law, StakePoint is the data controller responsible for the personal data described in this policy.

If you have any questions about this policy or wish to exercise your rights, you can contact us at [email protected].

We collect the following categories of personal data:

Information you provide or connect

• Wallet addresses, when you connect a Solana wallet to use staking, locking, swaps, LP farming, or the Whale Club.
• Your X (Twitter) username and associated authorisation tokens, when you link an X account to the Whale Club for social verification.
• Messages and content you submit, including Whale Club chat messages and submitted social posts.

Information collected automatically

• IP address, and the approximate location we infer from it.
• Device and browser information, such as browser type, device type, and operating system.
• Usage data, such as pages visited, features used, and timestamps of activity, collected through analytics tools.

Blockchain data

• The Solana blockchain is public. We read on-chain data associated with wallet addresses, such as balances, stakes, swaps, and transfers, to operate the Services and to administer rewards. This data is already public on the blockchain and is not created or controlled by us.

We do not collect special category data, and we do not knowingly collect data from anyone under the age of 18.

We process personal data for the following purposes, relying on the lawful bases shown:

• To provide the Services (connecting wallets, staking, swaps, Whale Club participation, rewards): processing is necessary to deliver the service you request.
• To operate the Whale Club and distribute rewards fairly: to calculate scores, rank participants, and distribute rewards.
• To protect the platform and prevent fraud and manipulation: we rely on our legitimate interests to keep the Services fair and secure. This includes logging IP addresses and connection data, and reviewing wallet funding, activity patterns, timing, and location signals to detect and prevent coordinated abuse of the rewards system, multiple linked accounts, and other manipulation. This protects both StakePoint and the honest members of our community whose rewards would otherwise be diluted by such activity.
• To understand and improve the Services: through analytics, where you have consented to non-essential cookies.
• To comply with legal obligations: where we are required to retain or disclose information by law.

We use cookies and similar technologies, including Google services (Google Analytics and Google Search Console), to understand how the Services are used and to improve them. Non-essential analytics cookies are used only where you consent. You can manage cookie preferences through your browser settings.

We do not sell your personal data. We share data only with service providers who help us run the Services, and only as needed:

• Supabase: database hosting and storage.
• Vercel: application hosting and delivery.
• Helius: Solana blockchain RPC and data services.
• Google: analytics and search performance (Google Analytics, Google Search Console).
• X (Twitter): where you choose to link your X account for the Whale Club.

We may also disclose personal data where required by law, to enforce our terms, or to protect the rights, safety, and property of StakePoint, our users, or others.

Some of our service providers are based outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or equivalent mechanisms, to ensure your data remains protected.

We keep personal data for as long as needed to provide the Services and to meet the purposes set out in this policy, including operating the Whale Club, maintaining platform security, and preventing fraud. Security and anti-fraud records, including connection logs, are retained for 180 days to allow us to detect and investigate repeated or coordinated abuse, and are automatically deleted after that period. When other data is no longer needed, we delete or anonymise it.

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion of your data, where applicable;
• object to or restrict certain processing, including processing based on legitimate interests;
• request a copy of your data in a portable format;
• withdraw consent, where we rely on consent.

To exercise any of these rights, contact us at [email protected]. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. The "last updated" date at the top shows when it was last revised. Significant changes will be made clear on the Services.

For any questions, requests, or concerns about this Privacy Policy or your personal data, contact us at [email protected].