Privacy Policy
Last updated 15 October 2026
This policy explains what personal data Expressaid ("DegenTok", formerly T-Minus, "we", "us") collects when you use the DegenTok website, terminal, one-click wallets, alerts and referral program (the "Service"), why, who we share it with, and the choices you have. We are the controller of this data. Words defined in our Terms of Service mean the same here.
In short: we collect as little as we can. We do not ask for your name or ID documents, we never see your private keys, seed phrase or sign-in codes, we do not use advertising or cross-site tracking, and we do not sell your data.
1. What we collect
Information you give us
- Email address, if you sign in with an email code. We use it to sign you in, to approve withdrawals, and to send security notices (new sign-ins, wallet setting changes and withdrawals).
- Passkey, if you sign in with one. The passkey stays on your device; only its public key is stored, by Turnkey.
- Wallet addresses: the browser wallet you connect, your one-click wallet, and any withdrawal wallet you link.
- Withdrawal PIN, if you set one. We store only a salted, one-way hash of it, never the PIN itself.
- Things you set up: wallets you track (with the names and emoji you give them), alert preferences, and the orders you place.
- Alert destinations, if you turn alerts on: your browser's push-notification subscription, or the Telegram chat you link.
- Messages you send to support, and anything you choose to include in them.
Information created when you use the Service
- Trading records: the trades we build or send for you, their fees, your positions and PnL, and your orders, so we can show your history, fill orders and pay referrals.
- Referrals: the referral code you arrived with, the wallets linked to your code, visit counts per code, and your reward claims.
- Technical data: IP address, browser and device type, and request logs. We use these for security, abuse prevention and rate limiting (for example, limiting how many sign-in codes can be requested), and to fix problems. A short device description is included in security emails so you can spot sign-ins that weren't you.
- Session token: while you are signed in to a one-click wallet, a session token is kept in your browser. Our servers keep only a one-way hash of it.
Information from other sources
- Public blockchain data: on-chain trades, balances and token data from Solana, which we store to show charts, holders, wallet statistics and your own activity.
- Screening data: we may check wallet addresses against sanctions and illicit-activity information to keep the Service lawful.
What we do not collect: your name, ID documents (unless the law requires us to ask, see the Terms), private keys, seed phrases, sign-in codes (Turnkey generates and checks them; we never see them), or card and bank details.
2. On your device
Your settings, trading presets, watchlist, chart preferences and recent coins are kept in your browser's local storage, not on our servers. We use browser storage only to make the Service work. We do not use advertising cookies, analytics trackers or tracking pixels, and we do not follow you across other websites, so browser "Do Not Track" signals do not change anything we do. You can clear this data at any time by clearing this site's storage in your browser.
3. How we use data, and our legal grounds
- To provide the Service you asked for (performing our contract with you): sign-in, wallets, building and sending trades, filling orders, showing your history, sending the alerts you turned on, and paying referral rewards.
- To keep the Service and your funds safe (our legitimate interests): security emails, fraud and abuse prevention, rate limiting, enforcing our Terms, and fixing bugs.
- To improve the Service (our legitimate interests): understanding how features perform, using aggregated or de-identified data that does not identify you. We do not try to re-identify it.
- To meet legal obligations: sanctions screening, keeping records the law requires, and responding to lawful requests.
- With your consent: push and Telegram alerts. You can withdraw consent at any time by turning them off; this does not affect anything done before.
We do not use your data for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects, other than blocking access where sanctions or abuse rules require it. You can ask a person to review such a decision.
4. Who we share data with
We share data only as needed to run the Service, with providers bound to protect it:
- Turnkey (wallet infrastructure): holds one-click wallet keys in secure hardware, stores your email or passkey public key as the wallet's owner, sends sign-in codes, and checks every signature against your wallet's policy.
- Email delivery (Resend): sends security notices to your email address.
- Alert channels: your browser's push service (such as Apple, Google or Mozilla) and Telegram, when you turn those alerts on.
- Blockchain infrastructure: Solana RPC and data-stream providers, Jupiter, Raydium, Pump.fun, Meteora and Jito, which receive the transactions you send.
- Hosting and security: Vercel (website), DigitalOcean (servers) and Cloudflare (network protection and encrypted backup storage).
- Market data and AI: market-data sources (such as Birdeye, Jupiter, GeckoTerminal and DexScreener), image sources (IPFS) and an AI provider (Google) used to summarize tokens. These receive public token and market data, not your personal data.
- Authorities, when we believe in good faith the law requires it, or to protect the rights, property or safety of our users, the public or DegenTok.
- A buyer or successor, if DegenTok is sold, merged or reorganized. This policy will continue to protect your data.
We do not sell or rent your personal data, and we do not sell order flow. We may publish aggregated statistics (such as total volume) that do not identify anyone.
5. The blockchain is public
Wallet addresses and transactions on Solana are public and permanent. Anyone can see trades made from your wallet, and other services can link them together. Nobody, including us, can change or delete data written to the blockchain. Information shown on DegenTok about other wallets comes from this public data.
6. How long we keep it
- Account data (email, wallet links, settings stored with us): for as long as you use the Service, then deleted on request, except where we must keep it.
- Trade, order, fee and referral records: for as long as you use the Service and afterwards as long as needed for legal, tax, accounting and dispute purposes.
- Sign-in codes are handled by Turnkey and expire after 5 minutes. One-click sessions expire after 7 days.
- Request logs: a short period, normally no more than 90 days, unless needed to investigate abuse.
- Public market data: up to about 120 days.
- Encrypted backups: a limited period, after which they are overwritten.
- Blockchain data is permanent and outside anyone's control.
7. Security
We protect data with measures such as keeping wallet keys in Turnkey's secure hardware, policy limits on what our server can sign, hashed session tokens and PINs, encrypted backups, and restricted access to our systems. No system is perfectly secure, so we cannot guarantee security. Keep your email account, passkey and devices safe. We will never ask for your private key, seed phrase, PIN or sign-in code — treat any such request as a scam and report it to support@degentok.com.
8. International transfers
We and our providers operate in several countries, including the United States, so your data may be processed outside the country where you live. Where data-protection law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.
9. Your rights
Depending on where you live, you may have the right to:
- know what personal data we hold about you and get a copy, including in a portable format;
- correct data that is wrong;
- have your data deleted;
- object to, or ask us to restrict, how we use it;
- withdraw consent you have given;
- appoint someone to make a request for you, or nominate someone to act for you if you die or become unable to;
- complain to your data-protection authority.
To make a request, email support@degentok.com from the address linked to your account, or tell us the wallet and be ready to prove you control it. We will reply within 30 days, or sooner where the law requires. We will not treat you differently for using your rights.
Deleting your DegenTok account removes the off-chain data we hold about you (except what we must keep), but it cannot delete blockchain records, and it does not destroy your one-click wallet. Withdraw your funds before asking for deletion.
California residents: in the last 12 months we have collected the categories described in section 1 for the purposes in section 3. We have not sold or shared personal information for cross-context behavioral advertising, and we do not knowingly do so for anyone under 16.
India: you may contact our grievance officer at support@degentok.com about how your personal data is handled. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
10. Children
The Service is only for people aged 18 or over. We do not knowingly collect data from anyone younger. If you believe a minor has used the Service, contact us and we will delete their data.
11. Changes to this policy
We may update this policy. The date at the top shows the latest version. For important changes we will try to give notice on the site before they take effect.
12. Contact
Questions or requests about privacy: support@degentok.com.