Your data, plainly.

Last updated 9 September 2026. Applies to the Smallstonks iOS app and smallstonks.xyz.

What we collect

Sign-in details. Your email address, or the identifier from Google or Apple sign-in, handled by Privy so you can sign in and get a wallet.
Wallet address. The public address of the wallet created for you. We never hold its private key.
Eligibility. The country you confirm and the country your connection appears to come from, because tokenized stocks are only offered in eligible jurisdictions.
Activity in the app. Baskets you create or save, orders and their transaction hashes, deposits, and gifts, including the email address of a gift recipient you enter.
Balances. Token balances read from the Base blockchain for your wallet, stored as snapshots with a timestamp.

We do not collect contacts, location, photos, advertising identifiers or analytics of your behaviour, and the app contains no advertising or tracking SDKs.

Why

To sign you in, show your portfolio, prepare and track your orders, deliver gifts, meet the eligibility requirements of the token issuer, and answer support requests.

Who processes it

Privy for sign-in and wallet creation.
Supabase hosts our database (Singapore region).
Railway hosts our API.
Alchemy provides blockchain access; requests carry your wallet address.
Resend sends gift emails on our behalf.
Base, a public blockchain, where your transactions are recorded permanently and publicly, as with any onchain activity.

We do not sell your data and we do not share it for advertising.

Retention and deletion

We keep records while you have an account. Email support@smallstonks.xyz from your sign-in address to delete your Smallstonks records; blockchain transactions cannot be deleted by anyone. Your wallet stays yours.

Children

Smallstonks is for adults and we do not knowingly collect data from anyone under 18.

Changes

We update this page when our practices change and note the date at the top.

Contact

support@smallstonks.xyz