Privacy Policy

Who we are and what this policy covers

The data controller is Stardust Staking and Solutions OÜ (trading as Stardust Staking), a private limited company registered in Estonia, Narva mnt 7a, Tallinn, 15172, Estonia. This policy covers the staking applications we operate at stardust.pub and its subdomains — aleo.stardust.pub, sol.stardust.pub, sui.stardust.pub, mon.stardust.pub, near.stardust.pub, and the portfolio page on this site (together, the “staking apps”). Our corporate website and our public RPC endpoints are covered separately by the corporate Privacy Policy.

The staking apps are non-custodial interfaces: staking transactions are constructed in your browser and signed by your own wallet. We never have access to your keys or your funds, and the apps have no user accounts.

Server logs

Our web server automatically processes limited technical information about each request: your IP address, your browser’s user-agent string, the URL requested, the referring page your browser reports, and date and time stamps. These logs are used for security and debugging only, are kept for at most 14 days, and are then deleted. Request bodies and cookie contents are not written to these logs.

One consequence of how some networks’ APIs are shaped deserves plain statement: the Aleo app, and NEAR pool discovery (used by the NEAR app and the portfolio), query through URLs that contain the address being looked up, so those addresses can appear in these short-lived logs alongside the requesting IP address. The other networks send such queries in request bodies, which are not logged. NEAR pool discovery additionally asks an external service (FastNEAR) which staking pools an address has used; our server makes that request on your behalf, so the service sees our server’s address and the queried account — never your IP address or identity.

No third party sees your visit

The staking apps make no requests to third-party servers from your browser. Blockchain data, validator metadata, and market prices are all fetched through proxies on our own domains, so the upstream providers see requests from our server, not from you — they do not learn your IP address or which wallet addresses you look up. All fonts are served from our own domain. The staking apps load no analytics, advertising, or tracking scripts of any kind, and their security policies (CSP) do not permit the browser to contact any host but our own domains.

Cookies

The staking apps set exactly two families of cookies, both scoped to stardust.pub and its subdomains, both marked Secure and SameSite=Lax:

They are sent only with requests to our own subdomains and are not recorded in server logs. Disconnecting your wallet clears the address cookie; both expire on their own. These cookies exist solely to provide the cross-page portfolio feature that you invoke by connecting a wallet. Under the EU ePrivacy rules they are strictly necessary for a service you explicitly request, which is why the staking apps show no cookie consent banner: there is nothing non-essential to consent to. If we ever add anything that is not strictly necessary, we will update this notice first and seek your prior consent.

Browser storage

The staking apps keep functional caches in your browser’s localStorage: cached staking positions keyed by your wallet address, cached validator names and logos (about one week), your selected network on the Aleo app, and similar interface state. This data stays in your browser, is never transmitted to us, and disappears when you clear your browser’s site data.

The portfolio page’s watchlist (addresses you choose to monitor without connecting a wallet) is likewise stored only in your browser’s localStorage and is never sent to us or anyone else as a list. When the portfolio fetches balances for a watched address, that address is queried through the same first-party proxies as a connected wallet’s address, with the same logging described above. Removing a watched address or clearing your browser’s site data deletes it. A watched address may belong to someone other than you: everything the portfolio displays for it is public blockchain data, readable by anyone, and watching adds no ability to transact with or access the address.

Wallet addresses

A wallet address is a public, pseudonymous identifier on a public blockchain. When you connect a wallet, the staking apps process your address in your browser to display balances and positions, store it in the cookie described above, and include it in the blockchain queries that flow through our proxies. We do not link wallet addresses to names, emails, or any other identity information — the staking apps have no accounts and collect none of those things.

Retention

• Server logs: at most 14 days.
• Cookies: 7 days and 2 hours respectively, or until you disconnect.
• Browser storage: on your device until you clear it.

Nothing else is retained.

Your rights

If you are in the European Economic Area, you have the rights the GDPR provides: to access, rectify, or delete personal data we hold about you, to object to or restrict its processing, to data portability, and to withdraw consent where processing is based on it. Given what the staking apps store, there is usually little to act on server-side — the logs above expire on their own, and cookies and browser storage are under your control — but any request is welcome. You also have the right to complain to a supervisory authority; in Estonia, that is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate).

Changes and contact

We may update this policy to reflect changes to our practices or for legal, operational, or regulatory reasons; the date at the top reflects the latest revision. For questions, requests, or complaints about this policy, contact us at admin@stardust.pub or by post at Narva mnt 7a, Tallinn, 15172, Estonia.