The staking applications at stardust.pub and its subdomains.
Last updated: August 26, 2026
The data controller is Stardust Staking and Solutions OÜ (trading as Stardust Staking), a private limited company registered in Estonia, Narva mnt 7a, Tallinn, 15172, Estonia. This policy covers the staking applications we operate at stardust.pub and its subdomains — aleo.stardust.pub, sol.stardust.pub, sui.stardust.pub, mon.stardust.pub, and the portfolio page on this site (together, the “staking apps”). Our corporate website and our public RPC endpoints are covered separately by the corporate Privacy Policy.
The staking apps are non-custodial interfaces: staking transactions are constructed in your browser and signed by your own wallet. We never have access to your keys or your funds, and the apps have no user accounts.
Our web server automatically processes limited technical information about each request: your IP address, your browser’s user-agent string, the URL requested, the referring page your browser reports, and date and time stamps. These logs are used for security and debugging only, are kept for at most 14 days, and are then deleted. Request bodies and cookie contents are not written to these logs.
One consequence of how the Aleo network’s API is shaped deserves plain statement: the Aleo app queries positions through URLs that contain the wallet address being looked up, so for that app a queried address can appear in these short-lived logs alongside the requesting IP address. The other three apps send such queries in request bodies, which are not logged.
The staking apps make no requests to third-party servers from your browser. Blockchain data, validator metadata, and market prices are all fetched through proxies on our own domains, so the upstream providers see requests from our server, not from you — they do not learn your IP address or which wallet addresses you look up. All fonts are served from our own domain. The staking apps load no analytics, advertising, or tracking scripts of any kind, and their security policies (CSP) do not permit the browser to contact any host but our own domains.
The staking apps set exactly two families of cookies, both scoped to stardust.pub and its subdomains, both marked Secure and SameSite=Lax:
| Cookie | Contents | Set when | Lifetime | Purpose |
|---|---|---|---|---|
sd_wallet_<chain> |
your public wallet address | only when you connect a wallet | 7 days | lets the portfolio page show your positions across chains without reconnecting each app |
sd_stale_<chain> |
a timestamp | after a transaction | 2 hours | tells the portfolio page its cached view of that chain is out of date |
They are sent only with requests to our own subdomains and are not recorded in server logs. Disconnecting your wallet clears the address cookie; both expire on their own. These cookies exist solely to provide the cross-page portfolio feature that you invoke by connecting a wallet. Under the EU ePrivacy rules they are strictly necessary for a service you explicitly request, which is why the staking apps show no cookie consent banner: there is nothing non-essential to consent to. If we ever add anything that is not strictly necessary, we will update this notice first and seek your prior consent.
The staking apps keep functional caches in your browser’s localStorage: cached staking positions keyed by your wallet address, cached validator names and logos (about one week), your selected network on the Aleo app, and similar interface state. This data stays in your browser, is never transmitted to us, and disappears when you clear your browser’s site data.
A wallet address is a public, pseudonymous identifier on a public blockchain. When you connect a wallet, the staking apps process your address in your browser to display balances and positions, store it in the cookie described above, and include it in the blockchain queries that flow through our proxies. We do not link wallet addresses to names, emails, or any other identity information — the staking apps have no accounts and collect none of those things.
Nothing else is retained.
If you are in the European Economic Area, you have the rights the GDPR provides: to access, rectify, or delete personal data we hold about you, to object to or restrict its processing, to data portability, and to withdraw consent where processing is based on it. Given what the staking apps store, there is usually little to act on server-side — the logs above expire on their own, and cookies and browser storage are under your control — but any request is welcome. You also have the right to complain to a supervisory authority; in Estonia, that is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate).
We may update this policy to reflect changes to our practices or for legal, operational, or regulatory reasons; the date at the top reflects the latest revision. For questions, requests, or complaints about this policy, contact us at admin@stardust.pub or by post at Narva mnt 7a, Tallinn, 15172, Estonia.