PRIVATE BUILD / UPDATED OCTOBER 2026

Your wallet stays yours.

Local mint generation

The address worker generates token mint keys in your browser using cryptographically secure randomness. The mint seed is held in this tab’s memory. GRAST does not send it to a server, save it in localStorage or ask for your Phantom recovery phrase. Closing or reloading the tab loses an unlaunched mint draft. Clearing a JavaScript buffer is best effort and is not a guarantee against a compromised device or browser extension.

Wallet and blockchain data

Connecting Phantom or Solflare exposes your public wallet address to this page with your approval. RPC requests for balances, account data, cost estimates and simulations pass through the same-origin server to its configured Solana RPC provider. Transactions require your explicit approval in the connected wallet. Public addresses, transaction signatures and on-chain token metadata are public data.

Public token metadata

When the site owner connects storage, GRAST uploads your selected logo to public IPFS through Pinata, builds the coin information file automatically, and uploads that file to public IPFS. Its public URL is passed to the Pump.fun mint transaction. Storage credentials stay on the server. Uploaded metadata may be stored permanently on public content-addressed storage. Do not include personal or confidential information.

Browser storage and hosting

The last lookup table’s public address, owner and setup signature are stored in your browser for recovery. No mint secret is stored there. Ordinary hosting and RPC request logs may contain public addresses and connection information. This build includes no advertising analytics. The operator must publish a support contact and retention policy before public service activation.

Your EN / VI language preference is stored in your browser. Interface translation uses a local dictionary and does not send your coin details to a translation service.

Performance measurement

Vercel Speed Insights samples page performance to help improve loading and responsiveness. GRAST removes URL query strings and fragments and masks unknown paths before sending these events. Wallet balances, coin form contents, signatures and private keys are not added to performance events. No advertising analytics are installed.

Script and upload protections

The production build limits initial scripts with content hashes and integrity checks and blocks advertising script origins. Wallet extensions and app browsers have their own permissions and security. Public uploads are paused while mainnet launch is disabled. These safeguards reduce exposure; they cannot guarantee protection from a compromised device, extension, hosting account or dependency.

AI community studio

When AI Studio is enabled, creative briefs and selected art prompts are processed by the operator’s configured AI provider through Vercel AI Gateway. Generation receipts are kept in private Redis for up to 24 hours for duplicate-request protection. A signed, secure browser cookie identifies this temporary studio session; it is not an X account or wallet login. Generated AI artwork is uploaded to public IPFS through Pinata. Mint secrets are generated and passed to wallet review in browser memory only; they are never sent to AI or included in brand-kit downloads.

Brand studio

The original vector editor generates artwork and files locally. Its live checkout is disabled. Downloading either studio’s brand kit does not issue a token or create an X account.