Privacy Policy

The short version

lp.xyz identifies you by wallet address, not by name, email, or any other personal identifier. Nothing about the product requires those. What it stores in its own database is small and functional: wallet nicknames, app preferences, and a record of the actions you took (or authorized) through the app, all keyed to the wallet address that acted. Everything else either lives only in your browser or is public on the blockchain itself, which lp.xyz doesn't control and can't make private.

What lp.xyz stores (in Supabase)

lp.xyz's own database, hosted on Supabase, holds a small set of tables, every row of which is scoped to a wallet address (the account's login wallet) rather than to any personal identity:

Wallet labels

The custom name and archive/hidden status you set for each wallet in your multi-wallet manager. Cosmetic only, never authority over funds.

Settings

App preferences: tooltip verbosity, balance-privacy toggle, default wallet, swap defaults, accent intensity. A copy also lives in your browser's local storage so the UI works before this loads. Supabase is the cross-device source of truth.

Activity records

A record of actions you took or authorized (swaps, liquidity adds/removes, transfers, automated harvests and repositions), written after the transaction is signed, for your own Activity feed. This mirrors what's already public on-chain. It doesn't add anything private.

Automation grants

Whether you've accepted the automation terms (and which version), and whether a delegation is currently live or revoked, per wallet: the record that gates whether the automation worker is authorized to act at all.

Every one of these rows is written and read exclusively by lp.xyz's own server routes using a service-role key. None of it is a public table, and none of it is sold or used for advertising.

What's on-chain, and therefore public and permanent

Every transaction lp.xyz builds is submitted to a public blockchain. Wallet addresses, token balances, LP positions and swap history are all visible to anyone with a block explorer. That's true independent of lp.xyz, and lp.xyz cannot make it private, redact it, or take it down once it's confirmed. If a wallet address is ever linkable to your real identity (by you connecting it to a centralized exchange, sharing it publicly, or any other means outside lp.xyz's control), that link makes your on-chain activity attributable to you, permanently.

What stays only in your browser

• A local copy of your settings, used before the Supabase copy hydrates and while offline.
• Session state for your connected/embedded wallet signer, managed by Turnkey's client SDK.
• Ordinary web analytics/session mechanics standard to any Next.js app (e.g. Vercel's hosting-level request logs), nothing beyond what your browser sends to any site you visit.

Third parties lp.xyz relies on

lp.xyz is an interface over other people's infrastructure. Using it necessarily sends requests (wallet addresses, token mints, and amounts, never a name or email) to the following:

Turnkey

Wallet infrastructure: creates and holds the keys for your embedded wallet inside a dedicated sub-organization, and (only if you enable automation) the delegated signer used for that automation.

Supabase

Hosts lp.xyz's own database: the tables described above.

Helius

Solana RPC and wallet/token metadata (the Digital Asset Standard API). This is how lp.xyz reads balances and positions.

Codex

Token and pool data on EVM chains: pricing, charts, pool discovery.

Solana Tracker

Market data (prices, trending tokens) on Solana.

Jupiter

Swap routing and quotes on Solana.

Relay

Cross-chain bridge routing and execution.

Vercel

Hosts the site and app.

Each of these operates under its own privacy policy, which lp.xyz does not control. None of them receives your name, email, or any identity information from lp.xyz, because lp.xyz doesn't collect those in the first place.

What you can do

• Rename, archive, or hide any wallet from your own settings. That change is yours to make at any time.
• Revoke automation from Settings at any time, which stops the delegated signer from being used going forward.
• Request deletion of the Supabase-stored rows above (labels, settings, activity records, automation grants) by contacting lp.xyz. This does not and cannot delete anything already confirmed on-chain.