NullMask on Solana: Privacy Policy
Last updated: Oct 23, 2026
This policy explains what data NullMask on Solana handles when you use it, why, how long it is kept and what choices you have. Words defined in the Terms of Use have the same meaning here.
In short
- We do not ask who you are. There is no sign-up, no identity check and no email requirement.
- Your keys are made in your browser from a message your wallet signs, and they stay there. Our servers never receive them, so we cannot read your private balance or your history.
- Amounts are public on the Solana blockchain: your deposits, your withdrawals and both amounts of a swap. Who receives a private transfer, and how much, is not.
- Our servers see the requests you send: your wallet address, the addresses you type and your withdrawals. Deposits and withdrawal recipients are screened by wallet address.
- The application contains no analytics or advertising trackers and sets no cookies. We do not sell data.
1. What a user should know
1. Amounts and times are public. Your deposit amount, each withdrawal amount and both amounts of a swap can be read by anyone on the chain. 2. Taking everything out at once, soon after a deposit, adds up to that deposit. Withdraw round amounts, leave some in, wait, or use a wave. The Withdraw and Swap forms warn you when an amount adds up this way. 3. After a swap you hold an exact, unusual figure of the new coin. Withdrawing all of it points back to that swap. 4. Withdraw to a new address, not the wallet you deposit from, and do not fund that address from your main wallet. 5. Private transfers hide who receives and how much. The coin and the network fee are visible. 6. Fast withdrawals land a few seconds after you click. Waves leave every 15 minutes; how many withdrawals share a wave depends on who else withdraws. 7. Our servers see your requests: your wallet, the addresses you type, your withdrawals. The relayer sees every withdrawal recipient, and recipients are checked with a blockchain analytics provider. Cloudflare carries this traffic. Use a VPN if your IP address matters to you. 8. For a bridge exit, the refund address is part of the order that NEAR Intents and we see. Do not use the wallet you deposit from. 9. This browser keeps your planned wave parts and recent sends, sealed with your keys. On a shared device, use "Forget this device" in the account menu, or clear the site data, when you finish. 10. Points and referrals are optional. Turning points on tells us which withdrawals are yours, and we keep that while the program runs. While holding points run, and only once you turn them on, it also tells us once a day which unspent notes are yours, until each is spent or until you stop it on the Points page. 11. The exit tool pays fees from the wallet you give it, and that wallet becomes linked to the withdrawal. Use a wallet that never touched the pool, funded from somewhere unrelated, and your own RPC endpoint if you can. 12. Your wallet app sees your deposits and the key signature. Withdrawals and transfers do not go through it.
2. Who is responsible
The company that operates the Services (the "Operator") is the controller of the personal data described here. It is established outside the European Economic Area and the United Kingdom. We will give its full legal details to anyone who needs them to exercise their rights, and to any competent authority, on request.
For any question or request about your data, write to [email protected].
3. Your keys stay in your browser
When you unlock, your wallet signs a message and the application derives your account keys from that signature in your browser. The keys are held in the memory of that tab only: locking, closing the tab or disconnecting forgets them. They are never sent to our servers or written to storage.
The application downloads the pool's public records from our servers and finds your notes in your browser. Proofs for withdrawals, transfers and swaps are made on your device. Our servers therefore cannot see your private balance, which deposits fund which withdrawal, or the notes you hold.
We do not hold your wallet's private key. Deposits are signed by your wallet; withdrawals, transfers and swaps need no wallet signature and do not pass through your wallet app.
4. Public blockchain data
Some data is written to the Solana blockchain when you use the Services. It is public and permanent, and nobody, including us, can change or delete it.
| Action | What anyone can read |
|---|---|
| Registration (with your first deposit) | Your wallet address and its NullMask public key, which senders use to pay you privately |
| Deposit | The depositing wallet, the coin, the amount and the time. All deposits of one wallet are recognisable as that wallet's. |
| Deposit approval | When the deposit was approved after its waiting period |
| Withdrawal | The recipient address, the coin, the amount, the relayer's and the protocol's fee, how many notes were spent and the time. The relayer appears as the sender. |
| Private transfer | That a transfer happened, the coin and the network fee. Not the sender, the recipient or the amount. |
| Swap | The coin and the amount in, the coin and the amount out, the fee and the time. A swap that does not run returns the amount in. |
| Wave | The withdrawals sent together at the wave's time, each with its own recipient and amount. Withdrawals of one wave share the network fee and compute budget for their size; a withdrawal that needed more compute, or was sent again after a network delay, can carry a different one. |
| Exit tool | The wallet that pays the network fee for each step |
Because amounts are public, a withdrawal whose amount and fee add up to an earlier deposit or swap output can be matched to it. Section 1 explains how to avoid that.
5. Data our servers see and keep
Three services run the Solana side: the relayer (sends withdrawals, transfers and swaps, and runs the waves), the indexer (serves the pool's public records, the rewards programs and a pass-through for blockchain reads) and the guard (screens and approves deposits).
| Data | What it includes | How long |
|---|---|---|
| A withdrawal or swap being sent | The request: recipient, amount, the notes' public spend tags, the signed transaction | Until it is sent or fails |
| Outcome of a send | Its status and transaction, with the time rounded to the hour; not the request | One day |
| Recipient checks | The recipient address (or a bridge destination) and the result | One day |
| Wave queue | The parts waiting for their waves, in full, from the moment you send them (the parts of a split arrive together, up to a day before their waves) | One day after the wave |
| Wave records | Which wave a part went with and, while the points program runs, whether it was part of a split | Until the points for it can no longer be claimed, at most 30 days |
| Swap orders | The terms, the amounts, the outcome and the hour it started | One day after the swap ends |
| Deposit screening | The depositing wallet, the deposit, the screening result and our decision | Kept as our compliance record, up to 5 years |
| Recipient verdicts at the guard | The address and the result, with no sender, amount or withdrawal | 24 hours |
| Rewards | With points on: your wallet and the withdrawals you claimed. With an invite: the binding of your account to the inviting code, and referral payments. | While the program runs |
| Holding proofs | With points and holding points on: your wallet, the coin and amount your unspent notes hold, and their nullifiers (each note's spend marker) | The nullifiers until a note is spent or you stop holding points, the rest until that day's points are counted; then only your holding points per day, which follow your balance's value, while the program runs |
| Network data | Your IP address, for rate limits, in server memory only | Up to one day |
| Service logs | Counts and events; the guard's log names a depositing wallet with its screening result. No IP addresses, request bodies or recipient addresses. | The newest 250 MB per service: rotated by size, not by date |
| Access log | Failed requests: time, method, service, status. No IP address and no path. | The newest 250 MB: rotated by size, not by date |
| Error reports | Error and warning messages from our servers, without the log lines that came before them. Some contain a wallet address. | The error monitoring provider's retention period |
Records removed after a day may stay in the free space of the database file on our server until that space is reused, and in any backup of it.
The relayer sees the recipient of every withdrawal and swap it sends. For a private transfer it sees the spend tags and the encrypted note, not the recipient or the amount. The application looks a transfer's recipient up in the public records it has already downloaded, so our servers do not learn whom you pay.
6. Screening
We screen wallet addresses before a deposit is credited and before a withdrawal is sent. Screening is about addresses, not people: we hold no identity data to check.
What we check. The depositing wallet, the address you withdraw to, and a bridge exit's destination. A bridge exit's refund address is checked only against sanctions lists and our own blocklist: it is not sent to the analytics provider, and we keep no record of it.
What we check against. Public sanctions lists, public blockchain data, and risk data from a third-party blockchain analytics provider (AMLBot).
What we send to providers. The analytics provider receives wallet addresses only. It does not receive amounts, your IP address, device data or any account identifier.
What we tell you. The application shows whether a deposit or a recipient was accepted. For legal and security reasons we do not show the detailed reason.
7. Who receives data
| Party | What it receives |
|---|---|
| Cloudflare | Every request between your browser and our servers, with your IP address: it terminates the encrypted connection in front of our servers, so it sees the requests in clear. This includes your wallet, the addresses you type and the withdrawals you send. |
| Server hosting | The data stored and processed on our servers |
| Solana node provider | The blockchain reads and transactions our servers send, including wallet balances, account lookups and every relayed transaction. It does not receive your IP address from us. |
| Swap venue (Jupiter) | The coins and amounts of swap quotes, about every 20 seconds while the Swap form is open with an amount. It does not receive your IP address from us. |
| NEAR Intents (1Click) | For a bridge exit: the destination, the refund address, the coins and the amount, with each quote. It does not receive your IP address from us. |
| Blockchain analytics provider (AMLBot) | Wallet addresses, as section 6 describes |
| Error monitoring | Error reports from our servers |
| Email hosting | Messages you send us |
Services your browser contacts directly. Your wallet app or extension, which sees your wallet address, your deposits and the message you sign to unlock. If you use a mobile wallet, its connection service.
Authorities. We disclose data to a court, regulator or law enforcement body only where a binding legal order or applicable law requires it. We do not share data with them voluntarily.
Successor. If another company takes over the operation of the Services, the data passes to it and stays subject to this policy.
8. Browser storage
The application sets no cookies and has no analytics or advertising storage. It keeps the items below in your browser.
| Item | What it holds | How long |
|---|---|---|
| Planned wave parts (local storage) | The parts you planned for a wave: recipients and amounts, sealed with a key from your account keys, so the stored text reads as random bytes without them | Until the part is sent or dropped, or you forget this device |
| Recent sends (session storage) | This tab's recent withdrawals and transfers, with their recipients, sealed the same way | Until you close the tab |
| Wallet choice (local storage) | Which wallet app you connected | Until you disconnect or forget this device |
| Points choice (local storage) | That you turned points on, by wallet address | Until you turn points off or forget this device |
| Holding check (local storage) | The day this device last confirmed your balance for holding points, and a one-way mark of the notes it covered, by wallet address | Until you forget this device |
| Invite code (local storage) | An invite code from a link you opened, until it is used | Until it is used or you forget this device |
| Referral payments (local storage) | Referral payments you sent from the rewards account, until our servers count them | Up to one day, or until you forget this device |
| Preferences (local and session storage) | Theme, withdrawal mode, a proof under way | Until you clear site data, or close the tab |
Forget this device. The account menu has a "Forget this device" action. It removes every item above except the theme, disconnects the wallet and reloads the page. Wave parts planned but not sent yet are dropped; your private balance is not affected.
9. Points and referrals
Both programs are optional. If you turn points on, the application tells our servers which of your withdrawals are yours, so that they can be credited to your wallet. We keep that link while the program runs. While holding points run, the application also confirms your balance once a day when you open Points: a proof made on your device, which never goes on chain, that names your unspent notes by their nullifiers and the amount they hold. When one of those notes is spent later, our servers see that the spend was yours (a withdrawal, a transfer or a swap). We keep the nullifiers only until each note is spent, and afterwards only your holding points per day. A wallet that turned points on before holding points ran is asked again before its balance is ever confirmed. "Stop counting my withdrawals and balance" on the Points page ends the count of your balance on our servers at once and drops the nullifiers we hold for it; the days already counted stay. If you join with an invite link, the inviting code is bound to your account, and the person who shared it sees their earnings, which come from deposit fees, and a share of your points, including your holding points. A referrer with very few referees may be able to tell when they deposited. Holding points follow the value of a balance, so the share of them moves once a week only: a referrer with one referee could still tell roughly what that referee held over a week.
10. The exit tool
The exit tool lets you withdraw without our servers. It reads the chain and sends transactions through the RPC endpoint you give it (a public Solana endpoint by default, which sees your IP address), and pays every step from the fee payer wallet you give it, so all steps are linked to that wallet. Use a fee payer that never touched the pool and is funded from an unrelated source, and your own RPC endpoint if you can.
11. Why we use your data
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the Services: relay withdrawals, transfers and swaps, run the waves | Requests, wave and swap records, network data | Performance of our contract with you |
| Screen deposits and withdrawals, and keep unlawful funds out of the Pool | Deposit screening, recipient checks | Our legitimate interest in protecting the Pool and its users and in respecting sanctions rules; a legal obligation where one applies |
| Run the points and referral programs | Rewards records | Your choice to join, which you can withdraw at any time (for holding points, with the stop on the Points page) |
| Keep the Services secure, prevent abuse and fix faults | Network data, logs, error reports | Our legitimate interest in a secure and working service |
| Answer your messages and requests | Messages | Our legitimate interest in responding to you |
| Handle disputes and respond to binding legal orders | Any data above, as far as needed | Our legitimate interest in defending legal claims; a legal obligation where one applies |
We do not use your data for advertising or marketing, and we do not sell it.
12. Where data is processed and how it is protected
Location. The servers that run the Solana side are located in Finland, in the European Union.
Transfers. The Operator is established outside the European Economic Area and the United Kingdom, and some of the parties in section 7 are in the United States and other countries. Your data may therefore be accessed from, or sent to, countries whose data protection laws differ from yours.
Security. Connections to the Services are encrypted in transit. Access to our servers is restricted to authorised personnel. No system is perfectly secure; if our servers were breached, the data described in section 5 could be exposed. Your keys and your private balance are not on our servers.
13. Your rights
Depending on where you live, you may have the right to get a copy of the data we hold about you, have it corrected or deleted, object to or restrict our use of it, withdraw a choice you made, receive it in a portable format, and complain to the data protection authority of your country.
How to make a request. Write to [email protected]. Because we do not know who you are, we will ask you to prove control of the wallet address by signing a message with it. We do not charge for requests.
Limits. We cannot delete or change data on the blockchain. We may keep screening records after a deletion request where we need them to respect sanctions rules or to defend a legal claim.
14. Automated decisions
Screening decisions are made automatically from address risk data and the public history of the address. A decision can delay, refuse or return a deposit, or refuse a withdrawal recipient. You can ask us to look at a decision by writing to [email protected] with the wallet address and the transaction. A person will consider the request.
15. Children
The Services are for people aged 18 or over. We do not knowingly process data of children.
16. Changes to this policy
We may update this policy. We will post the new version with a new date. For important changes we will also show a notice in the application.
17. Contact
- Privacy requests and screening reviews: [email protected]
- Legal notices: [email protected]