Privacy

Guest identifier

A random token in a cookie, so you keep the same Guest#1234 name between visits. Sigmate stores only a hash of it, never the token itself.Up to 180 days, or until you clear your cookies.

Wallet address

Your wallet's public address, if you sign in with a wallet. It's used to check on the Solana blockchain whether you hold a token or created it, and is shown shortened next to your messages. Sign-in only asks your wallet to sign a one-time message: Sigmate checks the signature and doesn't keep it.For as long as the account exists.

Wallet app sign-in from a phone

When a phone shows you the list of wallet apps (to sign in, or to pay for Spotlight), Sigmate prepares a short record for a possible round trip through your wallet app: the page to return to and a 4-digit code, kept only as a one-way hash. If you then sign in or pay by opening your wallet app, the record also keeps the wallet you chose, your wallet's public address, the wallet app's connection token and encryption key for this round trip and, for a payment, the booking and the transaction signature. If you type the code in another browser, a one-way hash of a random value in that browser's cookie is kept too, so that only that browser can finish. The record doesn't say which guest or wallet identity started it.Only for that round trip (at most 10 minutes; a new one is prepared if the list stays open longer); the connection token is erased when it ends (within an hour if it runs out unfinished), and the record is deleted about a day after it expires.

Side panel sign-in with a code

When you choose Connect wallet in the Sigmate Chrome extension's side panel, Sigmate prepares a short record in the background (a new one about every 90 seconds while that dialog stays open) and a short-lived cookie that names it. The record keeps a 4-digit code, only as a one-way hash, and how many times it was typed. You then sign in in a Sigmate tab. Where the panel shares this browser's Sigmate session, that sign-in ends the record at once and it keeps your wallet's public address; no code is shown. Where the browser keeps the panel's cookies apart (some browsers and privacy settings do), once you sign in in the tab and confirm, the record also keeps your wallet's public address and a one-way hash of a random value in that tab's cookie, so that only that tab shows the code. You type the code in the panel, which then gets its own wallet session. The record doesn't say which guest or wallet identity started it.Only for that sign-in (at most 2 minutes; its cookie expires within 10); the record is deleted about a day after it expires.

Holder checks

The latest balance check for each wallet and token, which decides your role in that room.Replaced by each new check.

Messages

Room messages, reactions and poll votes. Room messages are public: anyone can read a room's history, signed in or not. Direct messages are covered below.Kept as the room's history. Sigmate V0 doesn't have a way to delete your own messages yet.

Notifications

If you turn notifications on: this device's push address and encryption keys (from your browser's push service), the kind of device (Android, iPhone or iPad, other), whether you turned them on in the installed app, and the Sigmate identity (guest or wallet) and sign-in session they are for. Administrators see only how many devices have notifications on, by kind of device.

Notifications say who wrote and where, never what was said. They travel encrypted through your browser's push service (Google, Apple, Mozilla or Microsoft). Sigmate doesn't send one while you're looking at that conversation or room; that check uses your open connection and is never stored.

Until you turn them off, sign out, or your guest or wallet session on that device ends (notifications stop then), the push service reports the device gone, or 60 days without opening Sigmate on that device. Records of an ended session are deleted with it, within 30 days.

Usage statistics

To learn whether Sigmate is useful, Sigmate records against your browser's guest identifier (or your wallet identity, if your browser has no guest identifier):

• each visit: when it started and when you were last active in it (a visit ends after 30 minutes without activity, and one longer than 24 hours carries on as a new one), whether it was your first, how many times a Sigmate page loaded, how long a Sigmate tab was in front and how much of that time you were using it (the pointer, the keyboard, the mouse wheel or touch), how many times you opened a room, how many messages you sent, and whether a wallet was signed in when it started and at any point during it, never which wallet;
• whether a visit used the Sigmate app installed on your home screen, and on which kind of device (Android, iPhone or iPad, or another);
• whether a visit used the Sigmate Chrome extension's side panel, and when the panel opened a room because of the token in your current tab (never which site you were on);
• where a visit came from, for a fresh page load only: the page it started on (the home page, a token room and its token, your messages, an information page or another page), the website you came from (its name only, such as x.com) and any campaign tags in the link (utm_source, utm_medium, utm_campaign);
• each room you opened in a visit: when you first opened it and were last active in it, how many times you opened it and how you got there (the first page, a search, a tab, your recent rooms, a link, the Chrome extension following your tab, or a Spotlight placement, and then which placement), how long it was in front and in use, and how many messages you sent there, but not what they said: when the first and the last were sent, whether you sent them as a guest or with a wallet, how many were sent with a verified role (DEV, holder or trencher), and whether you had already posted on Sigmate before the first (as a guest or with that wallet, never which one);
• your role in each of those rooms (such as holder), except when a wallet is signed in on a browser that also has a guest identifier: that wallet's role is never recorded;
• when the Say gm button is shown to you and when you use it; when you copy a room's link or share it to X, and which room; which Spotlight placements were on screen (where, and in which position) and which ones you clicked; when the Spotlight checkout opens and from where, whether a price quote worked or why not, and that a booking was made and paid (never which booking);
• when you sign in with a wallet, and whether that wallet was new to Sigmate;
• when the invitation to install the app is shown and whether you open it, when Android reports the app installed, and when you turn notifications on or off, each with the kind of device, including when this happens in a browser.

It never records your IP address or details about your browser or device, apart from the kind of device (Android, iPhone or iPad, or another) for visits in the installed app and with the install-invitation and notification events (above), or whether a visit used the Chrome extension, and it doesn't record which wallet your guest identifier signs in with. Administrators see these statistics only as totals, in an internal dashboard.

Also kept, with no visit, activity or date attached once the deletion is done: a note that usage statistics are off for this browser's identifier (and your wallet's, if you turned them off while signed in), so they stay off; the guest identifiers of Sigmate's own administrators' browsers, so their activity can be left out of the totals; and, every 15 minutes, counts with no identifier at all of the connections that were not recorded (statistics off, older app versions, rate limits).

Your choice: If your browser sends Global Privacy Control, nothing is recorded. You can also turn usage statistics off here, in any browser, or in the Chrome extension's side panel from its account menu. Turning them off also deletes what was already recorded for this browser and, if you are signed in, for your wallet. Where your browser keeps the panel's cookies apart, the panel has its own guest identifier, so its switch covers the panel.

Usage statistics

Checking…

Visits, rooms and actions are deleted automatically after 13 months. The note that usage statistics are off stays until you turn them back on.

Reports and blocks

Who reported what and why, with a copy of the reported content for review, and the list of people you have blocked.Reports stay as a record of how they were handled. Blocks last until you unblock.

Spotlight purchases

If you buy a Spotlight placement: the wallet that paid, the transaction signature and amount, the booking times, and which Sigmate session (guest or wallet) started the checkout. The payment itself is public on the Solana blockchain.Kept as a financial record, so payments can be checked and refunded.

Moderation records

Which rule was triggered, what happened and when. Only Sigmate platform administrators can see them.Deleted automatically after 90 days.

• No email address, phone number, real name, username or password.
• No browser fingerprinting, no advertising trackers and no third-party analytics. Sigmate's usage statistics are its own (above).
• Never your private key or seed phrase. Signing in never asks for a transaction, an approval or any funds. The only transaction Sigmate ever asks your wallet for is a Spotlight purchase you start yourself, with the amount shown before you approve it.
• Your IP address is used for a short time, in memory, to apply rate limits and spot raids. Sigmate doesn't write it to its database or its logs.

Your open room tabs, recently visited rooms, recently used emojis and light or dark theme are saved in your browser's local storage. They never leave your device, and clearing your browser's site data removes them.

While a Spotlight checkout is open, its booking reference, the key that lets you follow it and the transaction signatures your wallet returned are kept there too, so closing the tab never loses a payment. They are removed once the checkout ends.

On a phone, the same storage also keeps:

• in a phone browser where Sigmate may invite you to install the app, in-app browsers such as Instagram's included (they are asked to open Sigmate in Safari or Chrome): when this browser first sent a message, and when the invitation to install the app was offered, accepted or dismissed;
• whether notifications are on for this device, the key they were turned on with, when this device last renewed them, and when you last hid the notifications card;
• while you sign in or pay through your wallet app from a phone: which wallet you chose, the round trip's reference and its 4-digit code, the page to go back to and, for a payment, the token, the booking with the key that lets you follow it and the transaction signature, removed when it ends, or the next time you open Sigmate after it expired (it expires after 10 minutes). The tab your wallet opens also notes how far it got there (handed on or finished), until you close that tab.

In the Chrome extension, the same storage also keeps:

• in the extension's side panel, its own list of recent rooms (rooms you opened, took part in, or kept on screen for a few seconds), cleared with the list's Clear all or with your browser's site data, and, until the panel closes, whether you pinned its room and which rooms you took part in there (for the identity that took part only: a sign-in or sign-out empties the list);
• in the extension's side panel, after a sign-in with a code, that it did (the identifier of the wallet identity it signed in, until you sign out there), so its Sign out can say that it signs out only the panel;
• in the extension itself, whether you closed its first-run tips and the light or dark theme the panel last showed. They are removed with the extension.

Sigmate uses two cookies, plus two short-lived ones while a phone shows you the list of wallet apps or you sign in or pay through your wallet app (they expire within 10 minutes; the same short-lived cookies are used while the Chrome extension's side panel signs you in), and no others. The two are one for your guest identity and one for a wallet sign-in; the short-lived ones only let Sigmate recognise the browser that started the sign-in or payment, and the one you typed its code in. All of them are HttpOnly, so scripts on the page can't read them, and all are sent only over secure connections. The guest cookie also lets Sigmate count return visits (see Usage statistics).

• A guest session lasts up to 180 days. Clearing your cookies starts a new guest identity.
• A wallet session lasts 7 days. Signing out ends it on Sigmate's servers straight away and takes you back to your guest identity.
• Your guest and wallet identities are separate. Signing in doesn't merge them, in usage statistics too.
• Signing out, or a session ending, stops this device's notifications for it.
• In the Chrome extension's side panel, Sigmate uses this browser's session where the browser allows it, and signing out in the panel then signs you out of Sigmate in this browser. Where the browser keeps the panel's cookies apart, the panel has its own guest identity and, after a sign-in with a code, its own wallet session, with the same cookies and lifetimes as above. In both cases, while the panel signs you in, a short-lived cookie names its sign-in record; where a code is needed, a second one is set in the Sigmate tab that shows the code.

The Sigmate Chrome extension shows Sigmate in your browser's side panel. To open the room of the token you are looking at, it reads the address (URL) of the active tab in that window, on your device, only while the panel is open and on screen.

• Only a Solana address found in that URL (at most three; on DexScreener, the pair id as written in the link) is sent to Sigmate to find the matching token, without your session cookie. The URL, the site, page titles and page content are never sent or stored. Addresses that don't match a token are not logged.
• When Sigmate doesn't already know an address found on a supported trading site or explorer, it looks the address up on the Solana blockchain through Helius, as described under "Services Sigmate relies on". Addresses found on other sites are only looked up when you tap Look it up.
• For DexScreener links, whose addresses lose their capital letters, Sigmate asks DexScreener's public API for the pair's correctly written address. Sigmate's servers send DexScreener only that pair address, never your link, your IP address or who you are.
• Rooms the panel opens because of your tab don't show you to other people. You appear in a room's participants, with your wallet and role, only once you send a message, react, vote, pin the room or open it yourself.
• A room the panel opens shows the token's logo, which loads directly from Helius's image service or from the address in the token's metadata, controlled by the token's creator. That host sees your IP address and which logo was requested, at the moment you browse to that token.
• It reads and changes nothing on any web page and runs no code on other sites. It does nothing while the panel is closed or hidden, and nothing in Incognito.
• The panel shows the Sigmate website: the same session, settings, messages and usage statistics as a Sigmate tab, as described on this page, and signing out in the panel signs you out of Sigmate in this browser. Where your browser keeps the panel's cookies apart, the panel has its own session instead (see Sessions and signing out).
• Wallet sign-in and payments happen in a normal Sigmate tab, never in the panel. If the panel can't share this browser's session, signing in in that tab shows a 4-digit code that you type in the panel: only enter it in your own panel (see Side panel sign-in with a code, above).

Sigmate's use of information received through the Sigmate Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Direct messages are only available between signed-in wallets. They are private from other users: nobody else can open a conversation they aren't part of, and token developers have no access to them.

Direct messages are not end-to-end encrypted. They are stored on Sigmate's servers and go through the same automated rules as room messages. If someone reports a direct message, a copy of it is attached to the report for the platform team to review.

• Helius provides Sigmate's access to the Solana blockchain. Sigmate's servers send it the public token and wallet addresses they need to look up and, for payments approved in a wallet app that returns the signed transfer, that transfer, which Sigmate sends to the Solana network. For the Chrome extension, they also send it the addresses found in your tab on supported trading sites and explorers that Sigmate doesn't already know, or that you asked it to look up (see The Sigmate Chrome extension).
• DexScreener (only for the Chrome extension): when a DexScreener link in your tab carries a pair address without its capital letters, Sigmate's servers ask DexScreener's public API for that pair's correctly written address. They send it only the pair address.
• Chrome Web Store distributes the Sigmate Chrome extension and its updates. Installing it from there is covered by Google's own privacy policy.
• Token logos load directly from Helius's image service or from the address in the token's metadata, which the token's creator controls. That host sees your IP address and which token's logo was requested. It isn't told which Sigmate page you are on.
• Railway hosts the website, Sigmate's servers and its database. Like any host, it processes request details such as IP addresses to deliver the service.
• Your wallet app handles connecting and signing. For sign-in, Sigmate receives your public address and the sign-in signature, and, when you open the wallet app from a phone, the wallet app's connection token for that sign-in (see above). A Spotlight purchase asks your wallet to approve a single SOL transfer to Sigmate's wallet. Most wallets send it through their own connection to Solana and return the transaction signature. When you pay with Phantom or Solflare by opening the app through a link (from an iPhone, from a browser other than Chrome on Android, or when Chrome can't reach your wallet app directly), the wallet returns the signed transfer to Sigmate, which checks that it is exactly the payment for your booking and sends it to Solana through Helius.
• Push services (Google Firebase Cloud Messaging, Apple Push Notification service, Mozilla, Microsoft) deliver notifications you turned on. They see your device's push address and when a notification is sent, never who it's from or what it is about: the message is encrypted and every notification has the same size.

Questions about your data, including requests to delete it, go to privacy@sigmate.xyz.