Privacy Policy

1.1The controller responsible for your personal data is PumpFlare, the operator of https://pumpflare.fun.

1.2For any privacy question or to exercise your rights, contact us via Telegram (@pumpflaresupport). We answer within one month, as required by the GDPR.

1.3This policy covers https://pumpflare.fun and our API. It does not cover the Solana blockchain, your wallet provider, or third-party sites we link to.

2.1We deliberately collect little. There is no account with a name, no password, and we never ask for an email address to use the Platform.

2.2Public blockchain data. We run an indexer that reads the Solana blockchain and stores trades, tokens and prices — including activity by wallets that have never used PumpFlare. This data is already public by design. We use it for charts, market data, trader statistics and our API. Legal basis: legitimate interest (Art. 6(1)(f)) in operating a market-data service. You can object — see §7.

2.3We do not collect special-category data, we do not run advertising profiling, and we do not sell personal data to anyone.

3.1We use only strictly necessary cookies. There are no advertising, tracking or analytics cookies, which is why you are not asked for cookie consent — consent is not required for cookies that are essential to a service you requested.

3.2We also use your browser's local storage to remember interface preferences (layout, sound, trade defaults). That never leaves your device and we cannot read it from our servers.

4.1We use the third parties below to run the service. They receive only what they need for their function.

4.2What this means in practice. When you load a page or send a transaction, your IP address is visible to the infrastructure providers handling that request (for example our RPC provider). When you view a chart, the mint address you are looking at is sent to our data providers. When you use AI name suggestions, the text you supply is sent to OpenAI.

4.3Some providers are outside the EEA, including in the United States. Transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable to each provider.

4.4We may disclose data where legally required — a valid court order, law-enforcement request or regulatory obligation — and where necessary to establish, exercise or defend legal claims. We will tell you unless we are legally prohibited from doing so.

4.5If the business is sold or merged, data may transfer to the acquirer, who will remain bound by a policy no less protective than this one.

5.1Private keys of in-app wallets are encrypted with AES-256-GCM before being written to the database, and are decrypted only in memory at the moment a transaction is signed. Sessions use signed, HttpOnly cookies. Access to production systems is restricted. Sensitive endpoints are authenticated and rate-limited.

5.2No system is perfectly secure, and we will not pretend otherwise. A key stored on a server is inherently more exposed than one held only by you. If you are not comfortable with that, do not use in-app wallets — connect your own wallet and sign each transaction instead.

5.3If a breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and inform affected users without undue delay, as required by GDPR Art. 33–34.

5.4Found a vulnerability? Please report it via Telegram (@pumpflaresupport) before disclosing it publicly. We will not pursue legal action against good-faith researchers who avoid privacy violations, data destruction and service disruption.

6.1Retention periods are in the table in §2. In general we keep account data while your account is in use, and delete or anonymise it on request.

6.2Some data outlives a deletion request: indexed public blockchain data (it is public and not sourced from you), records we must keep for accounting or legal-defence purposes, and content already published to IPFS or the blockchain.

6.3Server logs containing IP addresses are kept for up to 30 days for security purposes, then deleted.

7.1Under the GDPR you have the right to: access your data; correct it; have it erased; restrict processing; object to processing based on legitimate interest; receive your data in a portable format; and withdraw consent at any time (without affecting processing already carried out).

7.2To exercise any of these, contact us via Telegram (@pumpflaresupport). To prevent someone else impersonating you, we may ask you to sign a message with the wallet in question — that is the only proof of ownership that exists for a pseudonymous account.

7.3Withdraw first. Deleting your account removes your in-app wallet records, including the encrypted keys. Export keys and withdraw balances before requesting deletion — afterwards we cannot recover them.

7.4We cannot erase data from the Solana blockchain or from IPFS. That is a property of those networks, not a choice we are making.

7.5You may lodge a complaint with your data-protection authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz); elsewhere in the EU, your national authority.

8.1We do not make decisions producing legal or similarly significant effects about you by automated means alone.

8.2Automation you configure — auto-snipe rules, limit orders, automation modes — executes automatically, but it acts on your instructions, not on a profile we built of you. Risk scores and launch analyses are informational and do not restrict your access.

9.1The Platform is not for anyone under 18 and we do not knowingly process their data. If you believe a child has used the Platform, contact us and we will delete the data.

10.1We may update this policy. The version and effective date at the top of this page change with it, and we will announce material changes in the Platform. Where a change requires your consent, we will ask for it.