Your data.
Clearer expectations.
This notice describes the current Testnet app. It is a draft for review, with operator and retention details still to be completed before publication.
Account and wallet data
When authentication is configured, Salapi uses Supabase for sign-in and saved account records. Depending on the sign-in method, account data can include an email address, profile information, user ID and session cookies.
The current app uses service-managed Testnet wallets. Wallet records link a public address to a user ID and store an encrypted signing secret on the server. This is a custodial setup, not independent user key custody.
What becomes public
Stellar Testnet transactions, wallet addresses, registered usernames, contract events and campaign terms can be inspected publicly. Proof URLs and document hashes submitted to campaigns are public references. Do not include private, financial or sensitive personal information in a public proof document.
Computing a proof file's SHA-256 hash in the campaign form happens on your device. That action does not upload the file. If you host a proof document elsewhere, the hosting service has its own privacy terms.
Deleting a local account or clearing browser storage does not remove already published network records. Testnet operators may reset their network separately.
Browser storage and providers
The app uses cookies for authentication, browser storage for preferences and some local draft/goal metadata, and a service worker for cached application assets. Clearing that storage can remove local preferences and drafts and require signing in again.
Supabase, Stellar network infrastructure and Stellar Expert can receive requests needed for authentication, data reads and transaction receipts. Vercel traffic and performance tools are loaded only when observability is explicitly enabled for that environment. The local preview does not load those production observability tools.
Requests and unfinished details
For a privacy question, contact the Salapi team through the project's existing communication channel. A dedicated privacy contact and a verified operator address have not yet been specified in this draft.
Account photos and your choices
Account photos are shown by default to participants on confirmed transfer receipts and to signed-in users reviewing your exact registered username before sending. You can turn these two preferences off separately in Account details. Explicitly saved opt-outs remain off. Your email is not included in these identity displays, and this does not create a public photo directory.
Nonanonymous campaign donations default to showing your available username and permitted account photo in the public donor feed. The donation form explains this choice before you confirm. You can disable profile sharing or choose anonymous display for that donation. Anonymous display hides your name, photo, wallet and receipt link in the app feed, but cannot make the underlying Stellar transaction private. Previous anonymous donations are not changed by these defaults.
Custom account photos are stored in a private bucket. The app provides temporary links after checking the applicable owner or participant scope. Turning sharing off stops subsequent sharing, but cannot recall images or links already loaded or copied.