Legal

Privacy notice

Last updated 17 September 2026. Pump.packs has no accounts with names or emails: your wallet is your identity. It sets one cookie when you sign in and stores wallet addresses with launches. This page explains what it processes, and why.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is the operator of Pump.packs. There is no contact form on this site; the controller is reached by email at runnexadam2545@gmail.com, the same address named for legal notices in the terms.

2. Wallet addresses and transactions

When you sign in with Phantom, the site sees your Solana wallet address and a message signed by that wallet. When you pay a launch fee, the transfer from your wallet to the Pump.packs dev wallet, its memo and its signature are written to the Solana network. When your coin is created, its name, symbol, logo, description and website are written to pump.fun and to Solana. Chain data is public by design, replicated by every node, and cannot be changed or deleted by Pump.packs or by anyone else.

Pump.packs stores in its own database: your wallet address; each sign in (a random session id, its expiry, a hash of the IP address and the browser string, for abuse prevention); the launches you prepare (card, coin name, symbol, logo, X link, the fee amount and memo, the payment signature and the wallet that paid, the creation signature and the coin's mint address); every fee transfer the site sends or observes, so that a wrong or late payment can be refunded by hand; the market data it reads about each coin (price, market cap, volume, bonding progress); and the card fund of each coin (creator rewards read from the coin's trades, the target price, and the transfer signature once the card has been transferred to your wallet). Legal basis: Article 6(1)(b) GDPR (performing the service you asked for: signing you in, launching your coin, refunding a failed launch, handling the card fund) and Article 6(1)(f) GDPR (the legitimate interest in an accurate public listing of card coins and in preventing abuse of the launch limits).

3. What the site processes

  • Server logs. The hosting provider records the IP address, time, requested page, browser and referrer of each request for security and error diagnosis, for a short period. Legal basis: Article 6(1)(f) GDPR.
  • Search and page views. Card searches and page requests are handled by the site's own API routes and are not tied to a wallet. No analytics service is loaded.
  • Sign in. Your wallet address and the signed sign in message are sent to the site's server, which checks the signature and creates a session. The message is not stored after the check; the address and the session are.
  • Rate limits. The number of launches per wallet per hour and the number of requests per IP address are counted to keep the launch service usable for everyone. Legal basis: Article 6(1)(f) GDPR.
  • Coin logo and X link. The logo you upload and the X link you enter on the launch form are written into the coin's metadata, served by Pump.packs and by pump.fun, and shown on the coin page. Enter only what you want to be public forever.
  • Card requests. The request page sends nothing and stores nothing; what you type there stays in your browser until you post it yourself on X, under X's own privacy notice.

4. Cookies and storage in your browser

Pump.packs sets one cookie, __Host-cp_sid, when you sign in with Phantom. It holds a random session id, is only readable by the server (httpOnly), is only sent over HTTPS, and expires after seven days or when you log out. It is strictly necessary for the sign in you asked for and needs no consent banner. No advertising or analytics cookie is set. Your browser also keeps a small local setting for the theme preference; it stays on your device and can be cleared at any time. Phantom itself is separate software with its own privacy notice, and pump.fun and Dexscreener, when you follow a link to them, have theirs.

5. Service providers

Pump.packs runs on infrastructure from the following providers, each bound by a data processing agreement or acting as an independent public service:

  • Vercel Inc. (hosting and server logs, edge locations in the EU and worldwide).
  • Supabase Inc. (database, coin logos and metadata files, region eu-central-1 in Frankfurt).
  • Helius Labs Inc. (Solana RPC endpoint, queried by the server only; your fee transfer is broadcast through it, and it never sees your browser).
  • PumpPortal (the API through which the dev wallet creates coins on pump.fun; it receives the coin's name, symbol and metadata link, never your wallet address).
  • pump.fun and its indexer, which copy the coin's public metadata and image when the coin is created.
  • Public market data services (Dexscreener and pump.fun's public data) queried by the server, not by your browser.
  • The public card databases named on each card page are queried by the server during imports only; your browser never contacts them.

Where a provider processes data outside the European Economic Area, the transfer rests on the EU standard contractual clauses or an adequacy decision.

6. Retention

  • Server logs: deleted by the hosting provider after a short period (normally a few days to a few weeks).
  • Sessions: deleted after they expire or when you log out; unpaid drafts expire after 20 minutes and are removed with their temporary logo upload within a day.
  • Launches, payments and card funds: kept as long as the coin exists on pump.fun and the listing is offered, because they mirror public chain data and document fee payments and refunds.
  • Card catalogue: kept and refreshed as long as the site runs; individual cards are hidden on request through the takedown process.

7. Your rights

Under the GDPR you have the right to access the personal data held about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to lodge a complaint with the supervisory authority competent for you or for the operator. Because chain data cannot be erased, requests concerning it can only be met by removing the data from what the site displays. Use the channel in section 1.

8. Changes

This notice is updated when the site changes what it processes; the date at the top tells you when. The terms of use and how it works describe the service itself.