Effective date: 20 August 2026
Provided by: Strata Labs, British Virgin Islands
Applies to: stratabook.app, the Strata web app, and the Strata Android app distributed via the Solana dApp Store (package app.stratabook.trade), which displays the same website.
Strata is a self-custodial, non-custodial decentralised exchange interface. We do not hold your funds, and we do not run accounts.
We do not collect names, email addresses, or phone numbers. We set no cookies. We run no third-party analytics, advertising, or cross-site tracking of any kind, and we do not sell or share personal data.
There is no sign-up, no profile, and nothing to delete on our side, because we do not build one.
Verified against the application source:
Strata is an interface to the Solana blockchain. When you trade:
If you require confidentiality of trading activity, understand this before using any on-chain exchange.
| Data | Why | Notes |
|---|---|---|
| Wallet public key | to display balances, positions and orders, and to construct transactions for you to sign | Processed when you connect a wallet. We never receive your private key or seed phrase. |
| Wallet-linked service records | account state, portfolio and portfolio history, rewards, and referrals | Our API (/account, /portfolio, /rewards, referrals) processes data keyed to your wallet address. This is more than transient display: it is a server-side record associated with a public key. |
| Bug reports you submit | to triage and fix defects | /bugs/submit. Whatever you type is sent to us — do not include seed phrases or private keys. |
| IP address + standard request metadata (user agent, timestamps) | unavoidable in serving any website; used for delivery, security, and abuse prevention | Received by our hosting/CDN provider and our API (api.stratabook.app). |
| Transaction parameters you enter | to quote and route your trade | Amounts/markets are processed to compute a route and build a transaction. |
We never receive your private keys, seed phrase, or session signing key. Wallet signing happens inside your wallet or on your device.
Strata's zero-popup trading uses a session key generated in your browser as a non-extractable CryptoKey stored in IndexedDB. Non-extractable means the raw
key material cannot be read out by the page, by us, or by any script — it can
only be used to sign locally. It is never transmitted to us. Clearing site data or
using the in-app control removes it.
Device-local storage. All of the following stay in your browser and are
never transmitted to us: strata.vault.session.v2, strata.vault.sessions.v3
(session records), strata.legal.accepted (your consent acceptance),
strata.bars.v1, strata.bookDemo, strata.bridge.pending.0,
strata.chunkReloaded, strata.market.submit.lock.v1,
strata.selectorSpark.v1, strata.swap.hostsDown.v1, strata.swap.markets.v1,
strata.trade.bottomPanelHeight.v1, strata.vault.balance.tick — UI
preferences, cached market lists, and operational state. Clearing site data
removes them.
Using Strata, your browser makes requests to the following services. Each
necessarily sees your IP address; none receive personal data from us, and we
do not control their practices. Review their policies directly.
| Service | Purpose |
|---|---|
| Vercel (hosting / CDN) | serving the site |
api.stratabook.app | our own quote/route/market-data API |
| Solana RPC provider(s) | reading chain state, submitting transactions |
| Your wallet provider (Seed Vault Wallet, Solflare, Phantom, Coinbase Wallet, or another compatible wallet) | connection + signing |
| TradingView (self-hosted charting library) | price charts |
| Backpack Exchange | historical candle data |
| CoinGecko | token images |
Jupiter (static.jup.ag) | token metadata/images |
Circle (iris-api.circle.com) | CCTP cross-chain transfer attestations |
| Jito | validator/bundle metadata |
Backed Finance (xstocks-metadata.backed.fi) | tokenised-equity metadata |
| Solana block explorers | outbound links you click |
The Android app is a Trusted Web Activity: it renders the same website in a
system browser component, so identical data flows apply. It requests no additional
device permissions, and collects no device identifiers or advertising ID.
The in-app consent gate (version 2026-08-26, shown before wallet connection)
requires you to attest that you are at least 18 years old and legally able to agree to the Terms. It also
requires you to attest that you are not a resident or citizen of, and are not accessing from, the United States, nor any jurisdiction where use of Strata is
prohibited, and that you are not a sanctioned person (including OFAC-listed
persons or territories).
This is self-attestation only. We do not perform KYC, we do not collect
identity documents, and we do not geoblock. We therefore hold no identity data —
which is why this policy has so little to describe — but it also means
eligibility rests on your declaration, not on our verification.
Strata Labs is established in the British Virgin Islands. Processing is
governed by BVI law, and by other regimes where they apply extraterritorially to
users in those territories.
Retention. We keep server access logs (containing IP addresses) for
14 days, after which they are deleted. We hold no accounts and build no
profiles, so there is no other personal-data store to retain.
Depending on where you live, you may have rights over personal data relating to
you — typically to access it, correct it, request deletion, object to or restrict
processing, obtain a copy, and complain to your data protection authority.
In practice, here is what those rights mean at Strata, stated plainly rather
than as boilerplate:
What we can act on. Server access logs containing your IP address (§6), and
records our API keeps against your wallet address — account state, portfolio and
portfolio history, rewards, referrals, and any bug report you submitted (§4). If
you ask us to delete these, we can and will.
What nobody can act on. Your wallet address and every transaction you signed
are on the Solana blockchain. That data is immutable and public. We cannot delete, alter, or restrict it—and neither can anyone else, including us. Any
promise to erase on-chain activity would be false, so we do not make one. If that
is unacceptable to you, do not transact on a public blockchain.
What we do not hold at all. We have no name, email, phone number, address,
identity document, or account for you (§2, §5a). An access or deletion request
for that data will be answered honestly: we do not have it.
Verifying who you are. Because we hold no identity data, we cannot verify a
request the usual way. For anything tied to a wallet address, we will ask you to
sign a message with that wallet — control of the key is the only proof of
association that exists here, and it is stronger than most identity checks. We
will not hand over wallet-linked records to someone who cannot demonstrate
control of the wallet.
How to exercise them. Email stratabookdex@gmail.com. We aim to respond within
30 days. If we cannot comply — most often because the data is on-chain, or
because we never held it — we will tell you why rather than ignore the request.
Complaints. If you believe we have handled your data improperly you may
complain to the data protection authority in your jurisdiction, in addition to
contacting us.
Strata is not directed to, and may not be used by, anyone under 18. We do not
knowingly process data from anyone under 18.
Because we run no accounts and collect no identity data, we cannot verify age —
this sits alongside the jurisdiction and sanctions attestations in §5a as a
declaration you make, not something we check. If you believe someone under 18 has
used Strata, contact us; note that on-chain activity cannot be erased by anyone.
Session keys are non-extractable and device-local (§4). All traffic is served over
HTTPS. No system is perfectly secure, and self-custody means you are responsible for your wallet, seed phrase, and device. We cannot recover funds or reverse an
on-chain transaction.
Material changes will be posted here with an updated effective date. The in-app
consent gate is versioned (VITE_LEGAL_VERSION) and can require re-acceptance.
Strata Labs
British Virgin Islands
stratabookdex@gmail.com
Public channels: X @Stratabookdex ·
Telegram t.me/stratabook