Privacy Policy

1.1 Account Information

When you create a GrandmaStake account, we collect:

• Email address — used for account identification, login, and service notifications.
• Password (hashed) — your password is processed through the Argon2id password-hashing algorithm before storage. We never store your plaintext password and cannot recover it.

1.2 Wallet Data

When you create a GrandmaStake-managed wallet, we store:

• Solana public key— your wallet’s public address on the Solana blockchain.
• Encrypted wallet blob — a doubly-encrypted representation of your private key. Your private key is encrypted inside a hardware-isolated enclave (AWS Nitro Enclave) using a key derived from your passphrase via Argon2id and AES-256-GCM-SIV. That encrypted blob is then wrapped with a second layer of server-side AES-256-GCM envelope encryption. We never store your private key in plaintext, and we cannot decrypt your wallet without your passphrase.

1.3 Staking, Transaction, and Order Records

We maintain records of staking operations performed through the Service, including stake account addresses, delegation amounts, unstaking requests, and Solana transaction signatures. This data is used to display your staking history and account activity within the application. If you buy or sell SOL through the Service, we also keep records of those orders — order identifiers, fiat and crypto amounts and currencies, the wallet address involved, and the payment provider’s transaction reference. We do not receive or store your card numbers, bank account details, or identity documents; those are handled directly by the payment provider (see Section 5).

1.4 Session, Authentication, and Device Data

We use cookies and tokens to authenticate your session:

• JWT access tokens — short-lived tokens stored in HttpOnly, Secure, SameSite=Strict cookies, inaccessible to JavaScript.
• Refresh tokens — longer-lived single-use tokens stored in HttpOnly cookies, used to obtain new access tokens. Token families are tracked to detect theft.
• CSRF tokens — used to protect state-changing requests against cross-site request forgery.
• Sign-in device records— to detect sign-ins from a device you haven’t used before (and email you about them), we store a one-way cryptographic hash of device characteristics for each device that signs in to your account. We store only the hash — not your raw IP address or browser details — and it is used solely for this security notification.

1.5 Security Audit Records

We keep an append-only audit log of security-sensitive account events, such as passphrase changes. Each record contains only your internal account identifier, the event type, and a timestamp — never a passphrase, key, or wallet data. These records are deliberately tamper-resistant (they cannot be edited or deleted by our application services) so that an attacker who compromises an account cannot erase the trace. They are retained even after account deletion; see Section 7.

1.6 Communications You Send Us

• Contact form— if you use the contact form, the name, email address, subject, and message you provide are delivered to our support mailbox by email. They are not stored in the Service’s database.
• Alert subscriptions — if you request a notification (for example, that an unstaked balance is ready to withdraw), we collect the email address and wallet public key you provide in order to send that notification.

1.7 Infrastructure Logs

Our hosting infrastructure may capture standard server logs including IP addresses, browser type, operating system, and request timestamps. These logs are retained by our infrastructure provider in the ordinary course of operations and are not used by Toshi CSS for tracking, profiling, or marketing. Our own application logs are written to avoid personal data: email addresses and wallet addresses are masked or truncated before logging, and passphrases, keys, and wallet blobs are never logged.

• Account management: to authenticate you, manage your session, and send account-related notifications.
• Wallet operations: to look up your public key, relay your staking instructions to the Solana network, and display your balance and history.
• Security: to enforce rate limits, detect suspicious activity, protect against unauthorized access, and notify you of security-relevant events such as sign-ins from a new device, account lockouts, and credential changes.
• Compliance: to meet applicable legal, regulatory, and sanctions obligations.

We do not use your data for advertising, sell it to third parties, or use it for any purpose other than operating the Service.

The Platform routes Solana RPC requests through a server-side proxy to protect our RPC endpoint credentials. These requests are forwarded in real time and are not logged or stored by the proxy. The proxy does not record wallet addresses, transaction data, or any other payload content.

GrandmaStake uses authentication cookies only — HttpOnly, Secure, SameSite=Strict cookies that carry your session tokens. These cookies are required for the Service to function and cannot be disabled while using the authenticated portions of the application.

We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party cookie-based services.

We do not sell your personal data. We may share information only as follows:

• Blockchain: Staking transactions are broadcast to the public Solana blockchain. Your wallet public address and on-chain transaction details are publicly visible. This is inherent to how blockchains work and is not controlled by Toshi CSS.
• Infrastructure providers: Our hosting provider may collect standard server logs as described in Section 1.7. AWS infrastructure is used for secure enclave operations; wallet key material reaches AWS hardware only in encrypted form, and plaintext key operations occur only inside the hardware-isolated enclave.
• Email delivery: Service notifications (verification links, security alerts, account deletion confirmations, and similar) are delivered through a third-party email delivery provider, which processes your email address and the content of those messages in order to deliver them.
• Fiat purchases and sales: If you buy or sell SOL through the Service, that functionality is operated by our third-party fiat services provider. To process your order, we share your wallet address and transaction details with the provider. Any identity verification (KYC) and payment details (card or bank information) are collected and processed directly by the provider under its own privacy policy, which we encourage you to review — we do not receive or store them.
• Legal requirements: We may disclose information in response to a lawful court order, subpoena, or other legal process requiring disclosure.

We employ multiple layers of security to protect your data:

• Database encryption at rest (TDE): All database tables, transaction logs, binary logs, and temporary files are encrypted using MariaDB Transparent Data Encryption (AES-CTR).
• Column-level envelope encryption: Wallet blobs receive an additional AES-256-GCM encryption layer at the application level, separate from TDE, using keys that are stored independently from the database.
• Hardware-isolated enclave:All private key operations occur exclusively inside an AWS Nitro Enclave. Before your browser sends your encrypted passphrase, it verifies a hardware-signed attestation document from the enclave — checking its cryptographic signature chain up to the AWS Nitro root of trust — and checks the enclave’s build measurement against a value pinned in the application’s published source code. The expected measurement for each release is also published in our release notes so that third parties can independently rebuild and audit the enclave image. This provides strong tamper evidence, though — as with any system where one party operates the full stack — it is a defense-in-depth measure rather than a mathematical guarantee.
• Mutual TLS between services: All inter-service communication uses mTLS with client certificates. All external traffic is encrypted via TLS.
• Minimal privilege: Each service accesses only the database tables it requires. The backend API never has access to raw wallet blobs.

No security system is perfect. While we take significant precautions, we cannot guarantee absolute security against all possible threats. This is why your recovery phrase — stored securely offline — is your ultimate guarantee of access to your funds, independent of our systems.

We retain your account data for as long as your account is active. You may request account deletion at any time; deletion is confirmed by a link sent to your email address. When you confirm deletion:

• Removed immediately:your email address, your notification preferences, and your account’s security-lockout state are erased, and every active session on every device is signed out. Your account can no longer be used to sign in.
• Retained as a one-way hash: we keep a keyed cryptographic hash of your original email address. This hash cannot be reversed to reveal your address, but it allows our support team to locate the deleted account if you later contact us from that address — for example, to ask about historical activity or, where possible, to restore access. If you do not contact us, the hash identifies nothing.
• Retained: staking and transaction records, order records, and your encrypted wallet blob. The blob is retained because the Service is non-custodial: it can only be decrypted with your passphrase, and deleting it would permanently destroy access to any funds remaining in the wallet. Staking, transaction, and order records are retained for recordkeeping and to meet legal and regulatory obligations.
• Retained: the append-only security audit records described in Section 1.5. These contain no personal data beyond an internal account identifier and exist precisely so that account history cannot be erased by an attacker — including via a deletion request.

On-chain data (your public key, staking transactions, and SOL balance) exists on the Solana blockchain and cannot be deleted by Toshi CSS. That data is public and permanent by design.

You may contact us to request access to, correction of, or deletion of your personal data. We will respond to verified requests within 30 days. Deletion operates as described in Section 7: identifying information is removed, while certain records (staking, transaction, and order history; the encrypted wallet blob; and security audit records) are retained for the reasons stated there. We cannot delete on-chain data, and we cannot provide your private key or recovery phrase because we do not store them in any recoverable form.

If you have any privacy-related concerns, contact us at info@toshicss.com.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected such information, contact us and we will promptly delete it.

The Service may contain links to third-party websites or services (e.g., Solana explorers, wallet providers, and the fiat purchase/sale provider described in Section 5). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies independently.

We may update this Privacy Policy from time to time. The “Last Updated” date at the top of this page reflects the most recent revision. Your continued use of the Service after the updated Policy is posted constitutes acceptance of the changes. For material changes, we will make reasonable efforts to notify you by email.

For privacy-related inquiries:

• Privacy: info@toshicss.com
• General: info@toshicss.com