Coldstar — App Privacy Policy

Effective: June 26, 2026

App: Coldstar  ·  Package: app.coldstar.app  ·  Platform: Solana dApp Store (Solana Seeker)

This Privacy Policy applies specifically to the Coldstar mobile application (the "App"), published for the Solana Seeker device on the Solana dApp Store. It is separate from the privacy policy for the coldstar.dev website. Where the App and the website differ, this policy governs the App.

1. Who We Are

Coldstar is developed and published by Coldstar ("we," "us," or "our"). You can reach us at hello@coldstar.dev.

2. Information We Do Not Collect

Coldstar is designed to function without collecting personal data. Specifically, we do not:

• Require you to create an account, sign up, or provide an email, phone number, or name
• Collect, store, or transmit your private keys, seed phrases, or recovery secrets
• Use third-party analytics, advertising, tracking, crash-telemetry, or profiling SDKs
• Sell, rent, or share personal information with third parties
• Access your contacts, location, microphone, photos, or files

3. Information Stored Locally on Your Device

The App stores the following on your device only, and never transmits it to us:

• Wallet data: public wallet addresses, optional labels you assign, and watch-only wallet entries
• App settings and preferences (for example, display options)

This data is written to your device's secure storage (the Android Keystore / iOS Keychain via the operating system's secure storage facilities). It stays on your device under your control. Deleting the App removes this local data.

4. Private Keys and Transaction Signing

Coldstar is non-custodial. It supports two signing modes, and in neither does the App gain access to your private keys:

• Seed Vault mode: signing is performed by the Solana Seeker's hardware-backed secure element through the Mobile Wallet Adapter. Your keys remain inside the device's secure hardware and are never exposed to the App.
• Air-gap (cold) mode: the App displays an unsigned transaction as a QR code, which is signed by your separate, offline ColdStar signing device. Your keys never touch a network-connected device.

We never receive, store, back up, or transmit your private keys or seed phrase. If you lose access to your keys, we cannot recover them for you.

5. Camera Permission

The App requests camera access for a single purpose: to scan QR codes used in the air-gap signing flow (for example, reading a signed transaction from your offline device). Camera images are processed on your device in real time and are never stored, uploaded, or transmitted. You may decline this permission; QR-based air-gap features will be unavailable if you do.

6. Biometric Authentication

If you enable it, the App may use your device's biometric authentication (such as Face ID, Touch ID, or Android biometrics) to protect access to wallet data. Biometric data is handled entirely by your device's operating system and secure hardware. The App never receives, sees, or stores your biometric information.

7. Network Activity and Third Parties

To show balances and transaction history and to broadcast transactions, the App communicates with public Solana network infrastructure (RPC endpoints). When it does, the following may be sent to the RPC provider as a normal part of using the Solana blockchain:

• The public wallet address(es) you are viewing
• Signed transactions you choose to broadcast
• Standard network metadata such as your IP address, which the RPC provider may observe

This communication is inherent to interacting with any public blockchain and is not unique to ColdStar. We do not control third-party RPC providers; their handling of network requests is governed by their own policies. The App connects to the Solana mainnet-beta network by default.

8. Public Blockchain Transparency

Solana is a public, permanent ledger. Any transaction you broadcast — including the addresses involved and amounts — is recorded on-chain and is publicly visible. This information is outside our control and cannot be edited or deleted by us or by you. Please consider this before transacting.

9. Data Security

Security is the core purpose of this App. Sensitive data is kept in your device's secure storage, private keys are isolated in hardware or kept entirely offline, and the App favors minimizing the data that exists in the first place. No system is perfectly secure, but ColdStar is built to reduce the attack surface around your keys.

10. Children's Privacy

The App is not directed at, and is not intended for use by, individuals under the age of 16. We do not knowingly collect personal information from children.

11. Your Choices and Data Deletion

Because we do not collect or hold your personal information on our servers, there is no account-based data for us to delete. You can remove all data the App stores locally by uninstalling the App from your device. You can also revoke the camera permission at any time through your device settings.

12. Changes to This Policy

We may update this Privacy Policy as the App evolves. Changes will be posted on this page with an updated effective date. Material changes will be reflected in the App's store listing.

13. Contact

If you have questions about this Privacy Policy or the App's data practices:

• Email: hello@coldstar.dev
• Twitter/X: @buildcoldstar