Privacy Policy

Last updated: September 29, 2026

This Privacy Policy explains what data MassLauncher (“we”, “our”) collects when you use our website and Telegram bot (the “Service”), how we use it, and the choices you have.

1. Information we collect

Depending on how you sign in, we collect:

Google: your Google account ID, email address, and display name (read-only).
Email: the email address you provide and an argon2-hashed password.
Solana wallet: your public wallet address. We never see your private key.
Telegram: your Telegram numeric user ID and username (if you set one).
Service usage: credits purchased and used, tokens you launch, transaction signatures, mint addresses, and aggregate counters.
Technical: session cookies (HMAC-signed, HTTP-only), IP address as logged by our server, browser user-agent string.

2. Deposit wallets

When you sign up, the Service generates a Solana keypair for your deposits. The private key is encrypted at rest with a key derived from a server-side secret. The Service uses it only to move payments you send (SOL, and the supported token when token payments are enabled) to its own wallets. It is never sent to your browser. MassLauncher administrators can access deposit keys for recovery and support.

3. How we use information

To create and manage your account, credits, and launch history.
To detect deposits, credit your account, and sweep funds.
To prevent abuse (e.g. rate-limiting, fraud detection, sanctions compliance).
To respond to support inquiries.

We do not sell your personal data, run ads on the Service, or share data with marketing partners.

4. On-chain information

All transactions are recorded on the public Solana blockchain. Mint addresses, signatures, and wallet addresses are visible to anyone with a block explorer (e.g. Solscan). We have no ability to remove on-chain data once a transaction is broadcast.

5. Third parties we share with

Helius / Solana RPC: receives transaction submissions and balance queries.
pump.fun: receives token metadata and creation requests, and the sales of tokens you pay with (on-chain).
Google: if you choose Google sign-in, receives the OAuth round-trip per its policy.
Telegram: if you choose Telegram sign-in or use the bot.

6. Cookies

We use a single HMAC-signed session cookie (ml_session) to keep you signed in. It expires after 30 days. We do not use analytics cookies or tracking pixels. The website also keeps two small, non-identifying values in your browser’s storage: whether this device has been signed in before (so the header can load without flicker) and, during Google sign-in only, the page to return to afterwards.

7. Data retention

We retain account data while your account is active and for a reasonable period afterward for fraud and compliance purposes. You can request deletion of your account by contacting us; some data (encrypted deposit keys, on-chain records, and aggregate analytics) may be retained as required by law or to maintain the integrity of the Service.

8. Security

Sensitive material (deposit private keys, passwords, secrets) is encrypted or hashed before being stored. We use HTTPS in production and HTTP-only signed cookies. No system is perfectly secure; please use a strong, unique password and protect access to your sign-in methods.

9. Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal data, or to object to processing. Contact us using the address below to exercise these rights.

10. Changes

We may update this Policy from time to time. Material changes will be announced via the Service before they take effect.

11. Contact

Privacy questions? Reach us on Telegram at @MassLauncherBot.