Last updated 10 October 2026 · Applies to the Solid Android app and sendsolid.app
The short version, for anyone using the Solid keyboard: no accounts and no analytics, and the only thing our server keeps about an ordinary payment request is the request itself, so its short link works (section 3e), never who paid it. The keyboard cannot send what you type anywhere, because it contains no code capable of making a network request. Opening a merchant account is a separate, deliberate act that does involve a server, and section 6b says exactly what it involves. Nothing about it changes anything above.
The keyboard has no network access at all. The part of Solid that draws the keys and sees your keystrokes is a separate module with no HTTP client, no Solana library, no analytics and no crash reporter compiled into it. This is enforced by an automated check that fails the build if such a dependency is ever added.
This is why the rest of this document is short. Most privacy policies have to explain what a company does with the data it collects. There is no mechanism here by which your typing could reach us.
We do not collect personal information. Solid has no sign-up, no account, no email capture, no advertising identifiers and no analytics SDK. We do not know who you are, and we have built the app so that we cannot find out. This website is the one place that can count visits, and only on a few pages, and only if you allow it (section 4).
That is the whole of it for using the keyboard, which is what almost everybody reading this does. If you open a merchant account you hand us a business name, an email and a payout address on purpose, and section 6b is about that.
Four things change that. One makes something about you public without sending it to us (section 3a). The other three are the exceptions to "we do not collect personal information": switching on notifications stores a code for your phone and the wallet address it asked about (section 3b), joining Solid Points stores your wallet address and what it has earned (section 3c), and short payment links store the requests you send as links (section 3e). Short links are on unless you switch them off; the other three start off. There is a way out of each.
Ordering from a shop online will be a fifth, once shops can sell online through Solid: a delivery needs your name, mobile number and address, and we keep them for the shop until the order is done (section 6k). No shop can sell online yet, so none of that is kept today.
Several things are stored locally, in the app's private storage, which other apps on your device cannot read. None of it is transmitted to us.
| What | Why | How to remove it |
|---|---|---|
| Learned words | So the suggestion strip improves. Plain letters only, never in a password field, never anything containing a digit or symbol, which excludes addresses, keys, card numbers, emails and links. Nothing is kept until it has been typed three times, and the store is capped. | Settings → Privacy → Erase learned words |
| Your wallet address | To show your balance and to know where requests should be paid. A public address, not a key. | Disconnect your wallet |
| People you have saved or paid | So you can pick someone again, or pay them straight from People, without pasting, and so Solid can warn you about an address that looks deceptively like one of them. Holds the names and labels you type, each person's addresses, and how many times and how much Solid has paid each address from this phone. Those totals are added up on your phone as each payment settles; nothing about them is sent to Solid or anyone else. | Remove anyone on the People screen, or uninstall |
| Requests you have made | So the app can tell you when one is paid, by checking the public chain. The copy on your phone is yours; a request sent as a short link is also kept on our server, for its page (section 3e). | Dismiss any row, or uninstall |
| Recent transactions, as read from the chain | So Activity, and the check for whether a bill was paid, do not fetch the same transactions again every time you open the app. A copy of what the public chain already shows about your wallet, in the app's cache, which your phone may clear at any time. | Disconnect your wallet, or clear the app's cache |
| Spending limits and token settings | Your own caps on what Solid may move. | Change or clear them in Settings |
The app, not the keyboard, needs the internet for three things, and the third only if you open the Swap screen. If you hold a merchant account there are two more, and both are in section 6b and section 6c rather than here, because they do not apply to anybody else.
To read your balance, submit a transaction you approved, and check whether a request was paid. Your wallet address and the transactions you make are sent to this provider, as they must be for any Solana app to function. Solana is a public blockchain: addresses, amounts and transaction history are permanently public and visible to anyone, by design, and nothing in this policy can change that.
Named rather than described, because it sees more of your activity than anyone else on this page: every address Solid looks up and every transaction it submits. Saying "a provider" while naming Vercel, Supabase and the others by name would have been the one vague entry in the list, in the place vagueness helps least.
When you use the Swap screen. Open it and ask what a swap is worth, and Solid sends Jupiter the two tokens and the amount. Ask it to go ahead, and it also sends your wallet address, because the transaction it builds has to name the account that will sign it.
When you save into ORE. The same: the token, the amount and, when you go ahead, your wallet address, for the swap half of the transaction. The saving itself is ORE's own staking program on Solana, which holds your ORE; Solid reads your savings from the chain and sends nothing about them to anybody. The price shown beside them is Jupiter's, asked for ORE alone, the same question from every phone.
For the total on Home, unless you turn it off. To show your balance as one figure in rand or dollars, Home asks Jupiter for the price of every token Solid carries, ORE included. It is the same question from every phone: no wallet address, and nothing about which tokens you hold or how much. Choose Off under You → Currency and nothing is asked; on devnet it is never asked. The total is labelled as an estimate with the time of the price, and a price is never used for an amount you send, request or charge.
When a shop pays Solid from another token. A Solid Business bill is in ZARP or USDC, and a shop may pay it from another token it holds. Solid's server then asks Jupiter what the bill costs in that token, and, when the shop's wallet asks to pay, sends Jupiter the wallet's address so it can build the swap. The swap delivers the bill's token into the shop's own wallet and the payment goes to Solid from there, in one transaction the shop's wallet signs. Nothing about the wallet is kept.
Jupiter sets the rate and builds the transaction; your wallet signs it. Solid takes no fee, no commission and no spread on a swap, and never sets the rate. The figure shown to you is Jupiter's, and it is labelled as Jupiter's wherever it appears.
Phantom, Solflare, Seed Vault or another wallet you chose. Solid hands it a transaction to approve and receives a signature back. Your wallet has its own privacy policy, which governs what it does.
Off unless you turn it on. Solid can add the word
sendsolid.app to the payments you send, using Solana's memo program. It is
a setting in Settings → Privacy and it starts switched off.
What the mark says. Only that word. Not the amount, not who you paid, not what you typed, not which device you used. It answers one question, which is whether a payment was sent with Solid.
It is public and it is permanent. The mark goes on the blockchain, where anyone can read it. From that moment your wallet address is publicly identifiable as a Solid user, by anybody, for ever. Switching the setting off stops future payments being marked; it cannot remove the ones already sent. There is no mechanism anywhere that can, including ours.
It does not come to us. We receive nothing when you turn this on and we keep no list of who has. The mark is on the chain, readable by us on exactly the same terms as by everyone else. It exists so that Solid can tell who its users are without holding a database of them, so that those users can vote on what the app supports next, and so that another project can reach Solid users without asking us for a list we should not have.
If you leave it off, nothing in the app works differently, except that you cannot take part in a vote.
Off unless you turn it on. Solid can notify you when money arrives at your wallet. It is a switch in Settings → Privacy and it starts switched off.
What we keep, and it is the only thing we keep about you. A notification code for your phone, and the wallet address it asked about. That is the whole row. No name, no email, no account, and no record of any payment — not the amount, not who paid you, not when. Everywhere else in this policy that says we hold nothing about ordinary users, this is the exception, and it exists only while the switch is on.
Nobody can ask to be told about an address they do not hold. Turning the switch on asks your wallet to sign the request, and we check that signature against the address before storing anything. Without that, anyone could ask to be alerted every time your wallet was paid — the payments are public, but being told about them the moment they happen is not the same thing.
What the notification says. That you were paid, and nothing more. Not the amount, not the token, not the sender. It is deliberately that short for two reasons: it appears on your lock screen where anyone holding your phone can read it, and it passes through Google on the way to you. Solid reads the detail off the blockchain after you unlock. If the wallet is a shop's, and the shop sells online, a paid order also says "New order", and nothing more: not the order, not the amount, not who ordered or where it is going (section 6k).
Google sees it. Every Android notification is delivered by Google's Firebase Cloud Messaging, and there is no way to send one that does not. Google receives your phone's notification code and the words above. Their Firebase privacy terms govern what they do with it.
Switching it off deletes the row rather than marking it inactive. We also delete registrations that Google tells us are dead — an uninstalled app, a phone that rotated its code — a fortnight after we first hear so.
Off unless you join. Points are a rewards programme you opt into by proving you hold a wallet. Until you do that, nothing about you exists on our side and the rest of this section does not apply to you.
Why it cannot work like everything else here. Every other number in Solid is read off the blockchain by your own phone, which is why we can hold nothing. Points are different: a total your phone worked out for itself is a total a modified app could claim was anything, so points have to be counted by a server. That server is ours, and this section is what it holds.
What we keep. Your wallet address, your points total, and one line per thing that earned or did not earn — which transaction it was, what kind it was, how many points, and why. The “why” is there so you can check our arithmetic rather than trust it.
What we deliberately do not keep. No amounts. Not what you were paid, not what you sent. We store the transaction's signature, which is a reference to something already public and permanent on Solana, and read what we need from there. A copy of your payment history on our server would be a financial record we would then have to secure, retain and hand over if asked, and we would rather not have one.
Who you paid, and for how long. Working out points fairly means knowing when the same two wallets keep paying each other, because that is how a rewards programme gets farmed. So for 45 days we keep who was on the other side of a transaction. It is the only place we write that down, a job deletes anything older every night, and it is not in the points history above.
Nobody can claim points for an address they do not hold. Joining asks your wallet to sign a one-off message we generate, and we check that signature against the address before anything is stored. Without it, anyone could claim your wallet's activity as their own.
A wallet address is not anonymous. It does not carry your name, and it is permanent and public, so anything linked to it stays linked. That is true of Solana generally and it is the reason this section exists rather than being folded into the sentence above about collecting nothing.
Leaving. Settings → Privacy → Delete my Solid data deletes your account, the record of who you paid and your competition entries, once your wallet signs to say it is yours (section 6 lists everything it removes). The points history itself is kept without you attached to it — if a prize draw is open, the list of entries has to still add up afterwards, and the way to have both is to cut your address out rather than rewrite what happened. One wait: if you are in a competition that has closed and not yet been drawn, its entry list is sealed, so the deletion waits for the draw.
Two things in Solid can show somebody the SKR you stake. Both are off until you use them, and neither sends anything about you to us.
Your pass. A shop that takes Solid can offer perks to people who stake SKR and rewards for a full stamp card. To claim one you open Settings → Your pass, your wallet signs a short statement, and your phone shows it as a code for fifteen minutes. The shop's till photographs the code, checks the signature and reads your stake from the Solana staking program, all on the shop's phone. What the shop sees is your wallet address, the stamps you hold from that shop and how much you stake. What we see: nothing, unless the shop gives you a loyalty reward with it (section 6g). Otherwise the pass never reaches our servers, and no record is kept of which shops you showed it to or what perks you got.
Showing your stake on payment links. A switch in Settings → Privacy, off by default. When it is on, the payment links you send ask the page to show the step your stake is at, such as “10,000+ SKR”, and the month you started. Never the exact amount, and nothing under 1,000 SKR. The page asks our server, which reads the public staking program through Helius and keeps nothing.
Your stake is public on Solana whether or not you use either of these. What they change is whether it is put in front of the person you are dealing with.
Suggesting a question. If you stake SKR you can suggest what Solid asks stakers next, from Settings → Have a say. Your wallet signs the suggestion so it counts as coming from a staker. We keep the words, whether it is about a feature or a token, the wallet that signed it and the signature, for ninety days at most, and then delete them. The people who write Solid's questions read the list; it is not published, and one suggestion a week per wallet is accepted.
Your requests go out as sendsolid.app/q/… links. The request is
kept on our server, so its page can show that it came from your wallet, that nobody has
changed the amount, and whether it has been paid. To prove the wallet is yours, it signs
a short statement once, when you connect it (or at your first request, for a wallet
connected before this existed). A shop's bills are made the same way, proved by the
till's sign-in to the shop's account instead of a signature. To turn it
off, switch off Settings → Privacy → Send requests as short
links: your requests then go out as long links with the address, amount and
note written in them, and we keep nothing about them.
What we keep, per link: your wallet address, which is also where the
money goes; the amount and token; the note, if you wrote one; for a split, the total and
how many ways; a reference that goes into the payment so it can be found; how many
payments have arrived and when; the name you put on your links, if you set one in
Settings → Privacy → Your name on payment links; and, if your
wallet has a .sns name that points back to it, that name. The link's page
and the receipt for a payment to it show your name as your own words, not checked by
us. We also keep a hashed session for your wallet, for
90 days, so you do not sign every time. We never keep who paid. The
page checks the public chain for payments carrying the link's reference and counts
them; no signature and no payer's address is stored.
Those checks, and the .sns name lookup, go through
Helius from our server, and Helius sees the addresses involved, which
are public on the chain already. A link can be opened for 30 days and then says it has
expired. Its record is deleted 30 days after it is paid, cancelled or expired. A
request you close without sending is cancelled at once. To delete your links, use
Delete my Solid data (section 6); a shop's bills
are deleted with the shop's account (section 6b).
sendsolid.app is served by Vercel, and embeds no third-party fonts. Vercel keeps standard server logs (IP address, time, requested URL) for operational and security purposes, under their privacy policy.
Counting visits, only if you allow it. The pages about Solid (the
home page, merchants, brand, competitions, terms and this policy) can use
Google Analytics to count visits, so we can see which pages people
read. A banner asks first. Until you tap Allow analytics, nothing is
sent to Google and no cookie is set. If you allow it, Google Analytics sets its cookies
(_ga) and Google receives the page you are on, the site you came from,
your browser and device type, and a rough location worked out from your IP address,
under Google's privacy
policy. We switched off Google signals and ad personalisation, so your visits are
not tied to a Google account or used for advertising.
It never runs on payment, receipt, claim or invoice pages, on merchant sign-up, the merchant account or the admin pages, on voting, or in help, and those pages are built so that Google's script cannot load there. The app itself has no analytics at all (section 1).
Your answer is kept in your browser only, and nobody at Solid can see it. clears it, deletes Google's cookies from this site, and shows the banner.
One exception, on one form. The merchant sign-up form at
sendsolid.app/join shows Cloudflare Turnstile, in a frame from
captcha.sendsolid.app so that it runs apart from the rest of this site, which tells
people from scripts so nobody can open accounts or send email in bulk. While it checks,
Cloudflare sees your IP address, browser details and which site you are on, and uses
them only to detect bots, not to identify, profile or target anybody, under its
Turnstile
privacy addendum. Solid receives only whether the check passed. No other page on
this site loads it.
Receipt pages (/r/ and /rt/) ask this site for the
transaction, and this site reads it from the blockchain through our RPC provider. Your
browser talks to sendsolid.app and nobody else; the provider sees our server asking about
the transaction signature, not you. Solid keeps nothing about the lookup beyond
Vercel's ordinary server logs above, and the transaction itself is public on the
blockchain already.
Payment and receipt pages are noindex and send no referrer, so opening
somebody's payment link does not leak that link to anywhere else. Claim links keep their
secret in the URL fragment, which browsers never send to a server. When you claim a link on
this website, the page signs the claim in your browser with that secret, and only the signed
claim leaves it. To build and send the claim, our server sees the link's own account and the
wallet address you type, asks the chain through the provider in section 3, and keeps
neither.
Solid is not directed at children and is not intended for anyone under 18. We do not knowingly collect information from children. As above, we do not knowingly collect information from anyone.
Solid is operated from South Africa, with a second office in Oregon, United States. Under POPIA, the GDPR and UK GDPR, the Oregon Consumer Privacy Act, the CCPA/CPRA and comparable laws you have rights to access, correct, delete and port your personal data, to object to its processing, and not to be discriminated against for exercising them.
In practice these are mostly satisfied by the design. Unless you switch on one of the things in sections 3b to 3d, or send a short link (section 3e), we hold no personal data about you, so there is nothing for us to disclose, correct or delete. The data that exists is on your own device, under your control: erase learned words in Settings, disconnect your wallet, or uninstall the app to remove everything at once.
Deleting what we do hold, yourself. In the app, Settings → Privacy → Delete my Solid data. Your wallet signs a message saying so, which is how we know the request is yours, and then everything we keep about that wallet goes, on every phone: your Solid Points account, the record of who you paid, your competition entries, your votes in polls that are still open, any question you suggested, your short payment links and their session, and your payment notification registrations. Three things stay, each for a reason: your points history with your address cut out of it (section 3c), ballots in polls whose results are already published, so the count can still be checked, and a shop's record of a loyalty reward you claimed (section 6g), which belongs to the shop. A shop's own account is closed at sendsolid.app/account (section 6b).
We do not sell or share personal information, and we never have. There is no opt-out to offer because there is no sale to opt out of.
If you believe we hold data about you, write to privacy@sendsolid.app and we will answer within 30 days.
South Africa. You may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za. Our Information Officer can be reached at privacy@sendsolid.app.
Elsewhere. Residents of the EU or UK may complain to their national data protection authority; Oregon residents may contact the Oregon Department of Justice. We would rather hear from you first, but you are not obliged to come to us before going to a regulator.
Because we are based in South Africa and also operate from the United States, and because this site is served by infrastructure outside both, information necessarily crosses borders. Specifically:
Section 72 of POPIA restricts transferring personal information out of South Africa. For anyone using the app it is not engaged, for the reason this policy is short: we do not collect personal information to transfer. What crosses a border is a page request and a public blockchain address, never a name, an email, or anything you have typed. For merchant accounts it is engaged, and section 6b says on what basis.
A merchant account is for a business taking payments across a counter. It is opened deliberately at sendsolid.app/join and nobody has one by accident. If you have not opened one, none of this section applies to you.
What is kept: your business name, your email, your payout address, the country your business is registered in, whether your subscription is paid up, and a record of what you agreed to and when. If you use the optional sale notes, or say what a payment from the shop was for (wages, a supplier, rent), whatever you type in them, kept against that payment's transaction. We keep the note, not the address it was paid to. If you send invoices, the invoices and the details you add to print on them (section 6e). If you link the wallet you stake SKR from, its address, and the perks you offer (section 6f).
Your payment ledger. The payments into and out of your shop's payout wallet since you opened the account (or, for a wallet you switched to later, since it became your payout wallet): for each one, the transaction, when it happened, the token, the amount, and which of your invoices or bills it paid. It is read from Solana once, after the payment is final, so your account page can show your history, your takings and your exports without asking the blockchain again every time. We read a payout wallet only after that wallet has signed a message saying it is your shop's, so nobody can have us keep a ledger of somebody else's wallet; we keep that it signed and when. Signing is free and moves no money. Payout wallets set before we began asking, on 4 October 2026, count as signed. Every line names its transaction, so you can check it against Solana yourself. It records never who paid: not the other wallet, not a name. Only you can read it — not your staff phones — and it is held as long as your merchant account and deleted with it. Until 3 October 2026 this policy said we kept no takings; we started keeping this ledger on that date, for merchant accounts only. Nobody using Solid for themselves has one.
If we verify your business: the name we checked, when, which of our staff did it, and a short note of what they checked, such as your registration number against the companies register. Only someone at Solid can verify a business, and only after checking it outside Solid. While your name is still the one we checked, it appears on the previews chat apps show for your invoices, bills and receipts, and those pages say "Verified by Solid". Changing your name ends the verification, and we can withdraw it, with the reason recorded. It is deleted with your account.
Signing in. On the website you sign in with the email link. You can add an authenticator app in Settings, and changing where your money goes, once you have an address, or closing your account needs one. Once you have added it, every sign-in there asks for its code as well, and the website's own pages and powers (your payments, Books, quotes and repeating invoices, add-ons, and changing where your money goes) answer only a sign-in that gave the code, so your email alone cannot open them. The Solid app still signs you in with the email link alone; its next release asks for the code too, and until then the app's own screens, and the invoices and tills they share with the website, open with your email. To check that code, Supabase Auth keeps your authenticator's secret key and when you added it; for each sign-in that has not ended, it keeps when it started, the browser it came from and its IP address, as it does for any account. Our support screens show only whether you have an authenticator and how many sign-ins are open, never from where. If you lose the phone your authenticator is on, we remove it once we have checked it is you, and that is recorded with the reason and who did it. All of it is deleted with your account.
Books, if you add it. The email addresses of up to three accountants you invite, when you invited each, and when each first signed in. An accountant signs in like any account, with an email link, and an authenticator app if they add one, and can read your payments and invoices and download them; they cannot change anything or move money. Remove one and their access ends at once. Cancel Books and they are all removed; if your plan lapses, their access stops until it is paid. Exports are made in your browser, or your accountant's, from what the page reads: Solid keeps no copy of a file. Each address is deleted with your account, and the sign-in made for an accountant is deleted once no shop has them on its list. The invitation email names your business only once Solid has verified its name.
What is not kept: your keys, your customers' contact details (except what a customer gives for a delivery, once online shops open: section 6k), your card details, and who paid you. There are no card details to keep: Solid takes no card payments, and a plan is paid by a Solana Pay invoice from your own wallet. Your payments stay on Solana against your own public address as well, which remains the proof of every line in your ledger.
Where it is held. On Supabase, in a database in Ireland. Supabase is our operator under POPIA and our processor under the GDPR, under their Data Processing Addendum, which incorporates the Standard Contractual Clauses.
Email we send you. Sign-in links, the morning list of invoices to chase, invitations to your accountant and the other emails Solid sends go out through our own mail server, mail.sendsolid.app, hosted for us by xneelo in a data centre in Germany. It handles the address each email goes to and what the email says. xneelo is our operator under POPIA and our processor under the GDPR. Germany is under the GDPR, so this transfer rests on the same basis as the database, below.
The basis for that transfer. Section 72(1)(a) of POPIA permits transferring personal information to a recipient subject to a law providing substantially similar protection. The GDPR is such a law. The transfer therefore rests on adequate law rather than on your consent, which matters: a transfer resting on consent would collapse the moment you withdrew it, and withdrawing would mean deleting your account rather than moving it.
Marketing email is the only thing we ask consent for, it is off unless you switch it on, and saying no changes nothing about your account. Everything else we hold is there because it is necessary to run the account you are paying for. You can change your mind at any time in your account, and the record keeps the wording you were shown and the version of this policy in force when you agreed.
Closing the account deletes the merchant record, the staff labels, the sale notes and the payment ledger, and cancels the subscription, in one action from the account screen. Invoices have a statutory retention under South African tax law that outlives the account, and we would rather say so than promise a deletion we cannot perform.
A request about one of your customers. The sale note is the one field that can hold somebody else's personal information, because merchants write things like "Sarah, table 4". Please do not put customer details there. For anything in it, you are the responsible party and we are your operator.
A merchant can photograph a menu board, a printed list or a shelf label and have Solid read the items and prices off it, instead of typing them. It happens only when you tap Scan a price list and choose a photo. No photo is sent at any other time, and the feature does not exist for anybody who is not a merchant. Scanning somebody's code on the People screen also uses the camera, but that photo never leaves your phone (section 2).
Where the photo goes. To Anthropic, PBC, in the United States, which reads the text in it and returns the items. They are our operator under POPIA and our processor under the GDPR, under their commercial terms and Data Processing Addendum, which incorporate the Standard Contractual Clauses. Under those terms the photo is not used to train any model.
What goes with it: nothing. The request carries the photograph and a fixed instruction telling the model to transcribe a price list. It does not carry your name, your business, your email, your wallet address, your sales, your customers or your account. The photo is stripped of its EXIF data before it leaves your phone, so the location and time it was taken do not go either.
How long it is kept. By us, not at all: the photo is held in memory for the length of one request, is never written to disk and never reaches our database. Anthropic retains inputs for a limited period for abuse monitoring under their terms, and not for training.
This is the only part of Solid that sends anything to an AI provider. A customer paying a bill is never a party to it and their information never reaches a model. That is a boundary in the code rather than an intention: the app has one file that can call the endpoint, the endpoint has one file that can call the model, and a test suite fails the build if either sends anything but the photograph.
If you hold a merchant account, we can send short notices to it: a price change, a planned outage, something new in your country. They appear under the bell in the app, on your phone and, if we choose, on your staff's phones. Nobody without a merchant account receives them.
How we choose who sees one. By the country on your merchant account, which you chose when you signed up. Never by where your phone is: Solid does not ask for your location.
What we learn: nothing. We do not record whether you read a notice or tapped its link. The app asks which notices apply to it, the same as any other request, and whether you have seen one is remembered on your phone and nowhere else. Links go straight to where they say, not through us to be counted.
What a notice cannot do. A notice can link to a web page, showing its address on the button, or to one of a few screens in the app. It cannot open a payment, a payment request or a claim link. If a message that looks like it is from Solid asks you to pay or to sign something, it is not from us.
A merchant can send a customer an invoice: a numbered page with the business's details, what was bought, the VAT and a button to pay. After a sale at the till, a merchant can also send a receipt, which is the same page already marked paid. This section applies only if you do either; everything below about invoices applies to receipts in the same way.
What we keep about each invoice: its number, the lines and prices, the token, the VAT rate, the due date, any note you add, the name you print on it, and, once it is paid, the public transaction that paid it. If you add them, we also keep the details you print on every invoice: your registered name, registration number, VAT number, address, footer and logo. The logo is kept as a small image inside your account's record, so a customer's browser fetches it from nowhere else. All of it is held with your merchant account, on Supabase in Ireland, on the basis described in section 6b.
Your clients stay on your phone. The names, email addresses and numbers of the people you invoice are kept in your phone's encrypted storage and nowhere else. They are not sent to us, are not on your other tills, and are deleted when you sign out. An invoice leaves through your own WhatsApp or email app, so it comes from you, and we never see who it was sent to or send anything to anybody ourselves.
The one piece of a customer on our side is the name printed on the invoice, because an invoice needs one. You choose it and may leave it empty. For that name you are the responsible party and we are your operator, the same as for sale notes.
Invoicing Pro, if you add it. A quote is kept like an invoice, with the date it is good until, and becomes one when your customer accepts it on its page; accepting sends us nothing about them. A deposit is kept as its amount and a second payment reference, and once it is paid, the public transaction that paid it. A repeating invoice keeps what the invoice it copies keeps (its lines, token, VAT rate, note and the printed name) and how often to make the next one. For reminders we keep which ones you have marked sent, by invoice and stage, and nothing about where you sent them. Solid still sends nothing to your customers: a repeating invoice waits in your list for you to send, and each reminder is a message you send from your own WhatsApp or email. The one email we send is to you, at your sign-in address, at most once a morning, listing the invoice numbers, printed names and amounts due; you can turn it off on your Invoices page. All of it is kept, and ends, as the invoices it belongs to do.
Who can read an invoice. Anybody holding its link, as with a PDF you send. The link carries a long random identifier and nothing else, and the page shows what is printed on the invoice: never your email, your other invoices or anything about your staff. Invoice pages are marked so that search engines do not index them. When an unpaid invoice is opened, our server asks the Solana network whether it has been paid; that question names the invoice's payment reference and nothing about the person asking. The receipt page for a payment that settled one of your invoices shows your logo, name and printed details too, and only when the payment went to your wallet.
How long it is kept. As long as your merchant account, and after it for as long as South African tax law requires invoices to be kept.
The shop's own wallet. A merchant can link the shop's own wallet, the one its payments land in, by having it sign a statement naming their shop; a person's own wallet stays theirs. We keep that wallet's address and when it was linked, with the merchant account, on the basis in section 6b. We use it for two things: to let its stake stand in for the plan and its add-ons, which we check by reading the staking program when the shop is billed and once a day after; and, only if you switch it on, to show on your invoices and receipts that your shop stakes. We never hold, move or earn anything from your SKR. Unlinking removes the address, and so does moving where the shop's payments land.
Perks. The perks you offer stakers are kept with your account, and the live ones are shown on your invoices and receipts. We keep no record of who used a perk: a customer's pass is checked on your till and goes nowhere else.
Stamps are in your wallet. A shop running a Solid loyalty card gives a stamp to the wallet that paid it. A stamp is a token on Solana that cannot be sold or moved, readable by anybody, like any payment. We do not keep a copy of who holds them.
The shop's programme - how many stamps fill a card, what a full card earns, and where its stamps are issued - is kept with the shop's merchant account, on the basis in section 6b, so every till in the shop can check a card.
When you claim a reward, the shop's till sends the pass you showed to us, and we keep a record of it: the shop, your wallet address, the signature on your pass and when. That is how a full card is used once and only once, on any of the shop's tills. It holds no name and no amount, and it is not visible to any other shop. It is deleted with the shop's account.
A free reward is not a payment. When a reward covers the whole bill, nothing is sent on chain: the record above is the only trace, and it exists because you signed the pass that claimed it.
What a merchant chooses to publish. A merchant can write a page about their shop at sendsolid.app/b/ and a name they pick: a line about the shop, a few paragraphs, what it does, where it is, its opening hours, and the phone number, WhatsApp number, email address and website they want customers to use. We keep what they write with the merchant account, on the basis in section 6b, and show it only once they switch the page on, and only while Solid has verified the shop under the name it carries, and while the shop's plan is paid or its stake covers it. A merchant can add a cover photo, which we keep with the page and serve from this site only, and, with the Online shop once it opens, a photo of each item, kept and served the same way. The page can also show the shop's items and prices, its stamp card, its perks for SKR stakers and the wallet payments go to, each only if the merchant chooses.
Nothing about who looks. The page counts nobody: no analytics, no tracker and no view counts, on this page, in the directory or in the app; the only counting on this website is the one described in section 4, on a few of its own pages and only if you allow it. It never shows a shop's takings, staff, phones, customers or invoices. Switching it off hides it at once; closing the account deletes it.
For a shop. A shop whose company page is live appears in the directory at sendsolid.app/find/ with its name, what it does, where it is, its line about itself, whether it is open, and whether it runs a stamp card or SKR perks, all from its own company page; and its page may be found by search engines. A merchant can set a map pin, taken from their own browser where they stand and kept with the page, so the directory can sort by distance. Nothing is looked up by anybody else to place it.
Promoted. A listed shop can pay for its offer to appear in the labelled Promoted strip for a week. We keep the offer, its price, when it ran, and the transaction that paid for it, with the merchant account, on the basis in section 6b. The price in rand is worked out from the day's price of ZARP, which our server asks Jupiter for; nothing about the shop or its customers goes with that question.
For a visitor. The directory keeps nothing about you. If you choose "Near me", your browser asks you first, and your location is used inside that page to measure distances and is never sent to us or anyone else. Nobody who looks at the directory is counted.
For a shop, and public by design. A shop Solid has verified can ask Solid to publish that verification on Solana, through Solana Foundation's attestation program. The claim holds the shop's trading name as Solid checked it, the date Solid checked it, and the shop's payout wallet, and it is public: anyone can read it, and anyone can then see the payments into that wallet. It holds nothing about the owner as a person, no registration or VAT number, and nothing about any customer. It is off unless the owner switches it on, from the account page, after being told all of this. What a claim says.
Withdrawing it. Switching it off, renaming, changing the payout wallet, stopping the plan or closing the account makes the claim due to come down, and Solid withdraws it. Every claim also lapses a year after it was made. A blockchain keeps its history, so the record that the claim existed stays on Solana after it is withdrawn; nobody, Solid included, can erase that. We keep our own record of each claim we published and withdrew, with the merchant account, on the basis in section 6b, and of the claim of a closed account until it is withdrawn.
For somebody paying. Before you send to an address, the app reads Solana for Solid's claim about it, through the same provider that reads your balance (section 3), and shows the shop's checked name if there is one. That read goes to the chain, not to Solid, and nothing about it is kept.
Not open yet. No shop can sell online through Solid today, so nothing in this section is kept yet. It is here before it starts, as section 8 promises, because it is the first time Solid will keep a customer's name and address. When shops can sell online, the date at the top of this policy changes.
How it works. A shop that adds the Online shop to its plan can take orders on its company page. You choose what you want, collect it or have it delivered, and pay from your own wallet straight into the shop's. Solid never holds the money.
What is kept for an order: what you ordered and its prices, the shop, whether you collect or have it delivered, where the order has got to, and, once it is paid, the public transaction that paid it. The order is matched to its payment by a reference, the way an invoice is, so we do not record the wallet you paid from, though the transaction itself is public on Solana, as every payment is.
For a delivery, and only for a delivery: your name, your mobile number, the address to deliver to, and any note you leave for the driver. None of it is asked when you collect, and we never ask for your email address.
Who sees your delivery details: the shop you ordered from, to get the order to you, and nobody else. Not other shops, not other customers, never the shop's company page or Find on Solid. Solid's own staff do not look at them, except to fix a fault the shop reports to us. When an order is paid, we email the shop what was ordered and the total, never where it is going, and its phones say "New order" and nothing else (section 3b).
How long they are kept: until 30 days after the order is done, that is collected, delivered, cancelled or refunded, and then they are deleted. If an order is never paid, they are deleted after a day. The record of the sale stays with the shop, as its other sales do, without your name, number or address.
Whose they are. Under POPIA the shop is the responsible party for your details, because it decides to deliver to you, and Solid is its operator: we keep them on the shop's behalf, under the operator terms in section 8b of our terms of service, and use them for nothing of our own. To see, correct or delete them, ask the shop, or write to privacy@sendsolid.app and we will pass it on and help. Deleting them before an order is done means the shop cannot deliver it.
Never for marketing. Solid never uses them to contact you, and never sells or shares them. Our terms do not let a shop add you to a marketing list without asking you first.
Where they are held. With the shop's account, on Supabase in Ireland, on the basis in section 6b.
The architectural claims above are the security model, and they are checkable rather than promised. Each claim names the file that enforces it, and the build fails if the keyboard ever gains a network dependency.
If you find a vulnerability, please report it to security@sendsolid.app before disclosing it publicly. We will acknowledge within 72 hours.
If this policy changes materially, the date at the top changes and the app will say so on next open. We will not begin collecting anything described here as not collected without saying so prominently first.
Solid is built by Bitrora, the South African company named below, which is the responsible party under POPIA and the data controller under the GDPR. Bitrora LLC is a separate company under the same ownership and is the United States presence; it is named here so the address beside it is not mistaken for a second office of the same legal person.
South Africa · Bitrora
0A Otto Du Plessis Drive, Bloubergstrand, Cape Town, 7441
Registration number 2021/664757/07
United States · Bitrora LLC
9450 SW Gemini Drive, Beaverton, OR 97008, United States
Delaware limited liability company, file number 6555007
(503) 451-6650
Information Officer and privacy contact: privacy@sendsolid.app. This policy is governed by the laws of the Republic of South Africa.