Privacy Policy

1.1 Account Information

When you create a Service account, we collect:

• Email address: used for account identification, login, and service notifications.
• Password (hashed): your password is processed through the Argon2id password-hashing algorithm before storage. We never store your plaintext password and cannot recover it.

1.2 Wallet Data

When you create a Service-managed wallet, we store:

• Solana public key:your wallet’s public address on the Solana blockchain.
• Encrypted wallet blob: a doubly-encrypted representation of your private key. Your private key is encrypted inside a hardware-isolated enclave (AWS Nitro Enclave) using a key derived from your passphrase via Argon2id and AES-256-GCM-SIV. That encrypted blob is then wrapped with a second layer of server-side AES-256-GCM envelope encryption. We never store your private key in plaintext, and we cannot decrypt your wallet without your passphrase.

1.3 Staking, Transaction, and Order Records

We maintain records of staking operations performed through the Service, including stake account addresses, delegation amounts, unstaking requests, and Solana transaction signatures. This data is used to display your staking history and account activity within the application. If you buy or sell SOL through the Service, we also keep records of those orders: order identifiers, fiat and crypto amounts and currencies, the wallet address involved, and the payment provider’s transaction reference. We do not receive or store your card numbers, bank account details, or identity documents; those are handled directly by the payment provider (see Section 5).

1.4 Session, Authentication, and Device Data

We use cookies and tokens to authenticate your session:

• JWT access tokens: short-lived tokens stored in HttpOnly, Secure, SameSite=Strict cookies, inaccessible to JavaScript.
• Refresh tokens: longer-lived single-use tokens stored in HttpOnly cookies, used to obtain new access tokens. Token families are tracked to detect theft.
• CSRF tokens: used to protect state-changing requests against cross-site request forgery.
• Sign-in device records:to detect sign-ins from a device you haven’t used before (and email you about them), we store a one-way cryptographic hash of device characteristics for each device that signs in to your account. We store only the hash, not your raw IP address or browser details, and it is used solely for this security notification.

1.5 Security Audit Records

We keep an append-only audit log of security-sensitive account events, such as passphrase changes. Each record contains only your internal account identifier, the event type, and a timestamp; it never contains a passphrase, key, or wallet data. These records are deliberately tamper-resistant (they cannot be edited or deleted by our application services) so that an attacker who compromises an account cannot erase the trace. They are retained even after account deletion; see Section 7.

1.6 Communications You Send Us

• Contact form:if you use the contact form, the name, email address, subject, and message you provide are delivered to our support mailbox by email. They are not stored in the Service’s database.
• Alert subscriptions: if you request a notification (for example, that an unstaked balance is ready to withdraw), we collect the email address and wallet public key you provide in order to send that notification.

1.7 Infrastructure Logs

Our hosting infrastructure may capture standard server logs including IP addresses, browser type, operating system, and request timestamps. These logs are retained by our infrastructure provider in the ordinary course of operations and are not used by Toshi CSS for tracking, profiling, or marketing. Our own application logs are written to avoid personal data: email addresses and wallet addresses are masked or truncated before logging, and passphrases, keys, and wallet blobs are never logged.

1.8 Identity Verification

When identity verification is enabled, it will be required only the first time you cash out SOL to a bank account — never when you sign up, and never in order to buy SOL or to stake. If you do not sell SOL for cash through the Service, you will not be asked to verify your identity. Any identity checks that apply when you buy SOL are run by the payment provider described in Section 5, inside that provider’s own interface and under its own privacy policy — not by us.

The verification itself will be run by Plaid Identity Verification, inside a window supplied and controlled by Plaid and embedded in our application. In that window Plaid collects your full name, date of birth, Social Security number or equivalent tax identifier, residential address, an image of a government-issued identity document, and a selfie used to confirm that a live person is present. You provide this information to Plaid directly, under Plaid’s own privacy policy, which we encourage you to review. None of that information is received by, passes through, or is stored on the Service’s servers.

What we would store is the outcome of the check, and nothing else:

• A reference identifier — the identifier Plaid assigns to your verification, which lets us ask Plaid about it later without holding the underlying data.
• Which verification template ran — the identifier of the configuration that determines which checks are performed, recorded so we can tell what was checked.
• Pass or fail results — separate outcomes for the identity check, the document check, the liveness check, and sanctions screening.
• A risk rating and completion timestamps — the rating Plaid returns and the times at which the checks completed.
• A general reason for a failure — a broad category explaining why a verification did not pass, so that support can help you without holding your documents.

It is worth being explicit about which way this information travels. Identity data flows outward from Plaid to the providers that need it to process your cash-out — it does not come back to us. The payment provider, for example, tells us only whether identity details were supplied, as a yes or no; the details themselves go in and never come out. That means the providers we work with cannot become a route by which we obtain your identity information.

Planned, not built: we intend to add a step in which a settlement partner is given your verified identity details in order to accept a cash-out. In that design, the details would be retrieved from Plaid using the reference identifier above, used for a single call to that partner, and then discarded from memory — never written to our database. This is not implemented and is not in use. If we build it, this Policy will be updated before it is turned on.

• Account management: to authenticate you, manage your session, and send account-related notifications.
• Wallet operations: to look up your public key, relay your staking instructions to the Solana network, and display your balance and history.
• Security: to enforce rate limits, detect suspicious activity, protect against unauthorized access, and notify you of security-relevant events such as sign-ins from a new device, account lockouts, and credential changes.
• Compliance: to meet applicable legal, regulatory, and sanctions obligations.

We do not use your data for advertising, sell it to third parties, or use it for any purpose other than operating the Service.

The Platform routes Solana RPC requests through a server-side proxy to protect our RPC endpoint credentials. These requests are forwarded in real time and are not logged or stored by the proxy. The proxy does not record wallet addresses, transaction data, or any other payload content.

The Service uses authentication cookies only: HttpOnly, Secure, SameSite=Strict cookies that carry your session tokens. These cookies are required for the Service to function and cannot be disabled while using the authenticated portions of the application.

We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party cookie-based services.

We do not sell your personal data. We may share information only as follows:

• Blockchain: Staking transactions are broadcast to the public Solana blockchain. Your wallet public address and on-chain transaction details are publicly visible. This is inherent to how blockchains work and is not controlled by Toshi CSS.
• Infrastructure providers: Our hosting provider may collect standard server logs as described in Section 1.7. AWS infrastructure is used for secure enclave operations; wallet key material reaches AWS hardware only in encrypted form, and plaintext key operations occur only inside the hardware-isolated enclave.
• Email delivery: Service notifications (verification links, security alerts, account deletion confirmations, and similar) are delivered through a third-party email delivery provider, which processes your email address and the content of those messages in order to deliver them.
• Fiat purchases and sales: If you buy or sell SOL through the Service, that functionality is operated by our third-party fiat services provider. To process your order, we share your wallet address and transaction details with the provider. Any identity verification (KYC) and payment details (card or bank information) are collected and processed directly by the provider under its own privacy policy, which we encourage you to review. We do not receive or store them.
• Identity verification:Identity verification is not yet switched on; see Section 1.8. When it is, it will be performed by Plaid inside Plaid’s own embedded window, and the identity information you enter there will be provided by you to Plaid rather than shared with Plaid by us. We receive back only the outcome of the check — pass or fail results, a risk rating, timestamps, and a reference identifier — as itemized in Section 1.8. Plaid processes that information under its own privacy policy, which we encourage you to review.
• Legal requirements: We may disclose information in response to a lawful court order, subpoena, or other legal process requiring disclosure.

We employ multiple layers of security to protect your data:

• Database encryption at rest (TDE): All database tables, transaction logs, binary logs, and temporary files are encrypted using MariaDB Transparent Data Encryption (AES-CTR).
• Column-level envelope encryption: Wallet blobs receive an additional AES-256-GCM encryption layer at the application level, separate from TDE, using keys that are stored independently from the database.
• Hardware-isolated enclave:All private key operations occur exclusively inside an AWS Nitro Enclave. Before your browser sends your encrypted passphrase, it verifies a hardware-signed attestation document from the enclave (checking its cryptographic signature chain up to the AWS Nitro root of trust) and checks the enclave’s build measurement against a value pinned in the application’s published source code. The expected measurement for each release is also published in our release notes so that third parties can independently rebuild and audit the enclave image. This provides strong tamper evidence. As with any system where one party operates the full stack, though, it is a defense-in-depth measure rather than a mathematical guarantee.
• Mutual TLS between services: All inter-service communication uses mTLS with client certificates. All external traffic is encrypted via TLS.
• Minimal privilege: Each service accesses only the database tables it requires. The backend API never has access to raw wallet blobs.

No security system is perfect. While we take significant precautions, we cannot guarantee absolute security against all possible threats. This is why your recovery phrase, stored securely offline, is your ultimate guarantee of access to your funds, independent of our systems.

We retain your account data for as long as your account is active. You may request account deletion at any time; deletion is confirmed by a link sent to your email address. When you confirm deletion:

• Removed immediately:your email address, your notification preferences, and your account’s security-lockout state are erased, and every active session on every device is signed out. Your account can no longer be used to sign in.
• Retained as a one-way hash: we keep a keyed cryptographic hash of your original email address. This hash cannot be reversed to reveal your address, but it allows our support team to locate the deleted account if you later contact us from that address (for example, to ask about historical activity or, where possible, to restore access). If you do not contact us, the hash identifies nothing.
• Retained: staking and transaction records, order records, and your encrypted wallet blob. The blob is retained because the Service is non-custodial: it can only be decrypted with your passphrase, and deleting it would permanently destroy access to any funds remaining in the wallet. Staking, transaction, and order records are retained for recordkeeping and to meet legal and regulatory obligations.
• Retained: the append-only security audit records described in Section 1.5. These contain no personal data beyond an internal account identifier and exist precisely so that account history cannot be erased by an attacker, including via a deletion request.

On-chain data (your public key, staking transactions, and SOL balance) exists on the Solana blockchain and cannot be deleted by Toshi CSS. That data is public and permanent by design.

You may contact us to request access to, correction of, or deletion of your personal data. We will respond to verified requests within 30 days. Deletion operates as described in Section 7: identifying information is removed, while certain records (staking, transaction, and order history; the encrypted wallet blob; and security audit records) are retained for the reasons stated there. We cannot delete on-chain data, and we cannot provide your private key or recovery phrase because we do not store them in any recoverable form.

If you have any privacy-related concerns, contact us at info@toshicss.com.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected such information, contact us and we will promptly delete it.

The Service may contain links to third-party websites or services (e.g., Solana explorers, wallet providers, and the fiat purchase/sale provider described in Section 5). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies independently.

We may update this Privacy Policy from time to time. The “Last Updated” date at the top of this page reflects the most recent revision. Your continued use of the Service after the updated Policy is posted constitutes acceptance of the changes. For material changes, we will make reasonable efforts to notify you by email.

For privacy-related inquiries:

• Privacy: info@toshicss.com
• General: info@toshicss.com