Privacy Policy

Who we are

CreateToken.app is operated by CreateToken.app, the data controller for the information described below. For access, correction, deletion, or any other question about your data, write to support@createtoken.app. The same address takes security reports.

Non-custodial by design

We never receive or store your private keys or seed phrases. Wallet connections and any imported XRPL seed live only in your browser’s memory for the current session.

What we process

• Token assets you upload (logo + name/symbol/description) are sent to our pinning provider (Pinata) to be stored on IPFS. IPFS content is public.
• Loyalty data: if you participate, your public wallet address, point totals, and the public transaction signatures you submit are stored in our database to operate the program.
• Account (optional): if you create one, we store your email (or the public wallet address you sign in with) and the wallet addresses you choose to link, so your dashboard can show your launch history and loyalty across those wallets.
• Market data: when a launched token is shown with its live market, your browser requests price and chart data directly from DexScreener; we do not proxy or store it.
• Your IP address, for abuse prevention only. Requests to our API routes are rate-limited per IP so a single client can’t exhaust the paid pinning endpoint or the third-party services behind a launch. The address is used as a short-lived counter key and is not stored alongside your account or wallet.
• Error diagnostics: when the interface crashes, the browser sends us the error message, the top frame of its stack, the page path, and a random reference code so we can find it in our logs. No form contents, wallet contents, or account identifiers are included.

What we do not collect

The core launcher needs no account, email, or personal identity. Accounts are entirely optional — if you don’t create one, we hold no email or linked-wallet records for you. On-chain data is inherently public and outside our control.

Third parties

We rely on public RPC endpoints (Solana, the XRP Ledger, and Ethereum), an IPFS pinning provider (Pinata), DexScreener for the live market data shown on launched tokens, and a hosted database and authentication provider (Supabase) for optional accounts and loyalty. Their handling of data is governed by their own policies.

Retention & deletion

Account records live for as long as the account does. You can erase yours at any time from your account page — the delete action removes your email, profile, and linked wallet records. Rate-limit counters expire on their own within minutes. Two things we cannot delete, and you should assume are permanent: anything already written to a blockchain, and anything already pinned to IPFS, neither of which is under our control.

Your choices

You can use the launcher without the loyalty program. IPFS content, once pinned, may be replicated beyond our control and should be considered permanent and public.

Changes to this policy

We update this policy when what we process changes. The “last updated” date at the top of the page always reflects the current version.