Privacy.

Your private key. It is generated inside a hardware secure enclave and never leaves it in a form we can read. Nobody at Vault has ever seen it and nobody can.

Your seed phrase, your recovery key, and your passkey. The recovery keypair is generated in your browser and you store it yourself. We receive only its public half.

Your second-factor codes. Those are sent by Turnkey from their own infrastructure, not by us, so a breach of anything we run cannot produce one.

Your email address, so we can send the confirmation carrying the destination and exact amount. Your vault's sub-organisation identifier and its Solana address, which is public on chain anyway.

Approval metadata: destination, amount, expiry, and outcome. This is the record that lets you check what happened, and it is the same data the enclave already holds.

Your Telegram chat identifier, only if you link one. Your IP address, used to rate limit the support form and the API, held briefly and not tied to your vault.

Every security-relevant event is written to an append-only log: approvals created, transactions signed, attempts refused, credentials changed. The database blocks updates and deletes on that table for every role, including our own administrative one.

This is deliberate. A tamper-evident record is worth little if the party running it can quietly edit it, and that includes editing it on request. It also means we cannot delete those entries for you. They contain no key material and no message content, only what happened and when.

Turnkey holds your keys and enforces the policy engine. Supabase hosts the database. Vercel hosts the site. Brevo sends our email. ImprovMX forwards inbound mail. Helius provides Solana RPC access. Telegram delivers messages if you link a chat.

Each of them sees only what their function requires, and none of them holds anything that could move your funds.

Messages sent through the support form reach our inbox and are kept while we handle them. The form refuses anything that looks like a seed phrase or a private key before it is sent, and nothing about such a message is stored, because the safest way to handle a secret is to never receive it.

No advertising cookies, no third-party analytics, no session recording. Fonts are self-hosted rather than loaded from a CDN, so visiting the site does not tell a font provider that you were here.

You can unlink Telegram at any time, export your wallet at any time, and ask us to delete your account. Deletion removes your vault record, your email address, and your notification channels. It does not remove the audit log entries described in clause 3, and it does not touch anything on the Solana blockchain, which is public and permanent by design.

Deleting your account here does not delete your wallet. Export it first, or the funds become unreachable.

Privacy questions go to support@vaultonsolana.xyz. Security findings go to security@vaultonsolana.xyz, and we would rather hear from you before anyone else does.