Privacy Policy

This policy applies to your use of the WebSoroban website and IDE. By using the Service, you agree to the collection and use of information as described here.

WebSoroban is operated by BayLeaf OÜ, registered at Kesklinna linnaosa, Ahtri tn 12, Estonia.

For the purposes of applicable data protection law, BayLeaf OÜ acts as the data controller for personal data processed through the Service, except where a specific processing activity is described otherwise in this policy (blockchain networks operate independently of our control — see Section 10).

This policy applies to the WebSoroban website and the WebSoroban IDE/Service. It does not apply to:

• Public blockchain networks (Stellar testnet and mainnet), which operate independently of WebSoroban and are governed by their own decentralized protocol rules.
• Third-party wallets (such as Freighter, xBull, Albedo, Lobstr, or Hana) that you connect to WebSoroban. Those wallets have their own privacy practices.
• Third-party websites or services linked from WebSoroban.

We collect only what is needed to operate the Service. Each category below reflects our current understanding of actual practice.

4.A Account information

If account creation is required or offered, we may collect:

• Name and email address, provided by you at signup or via OAuth
• Username and account ID, generated or provided by you
• Authentication credentials or authentication tokens from a third-party sign-in provider (Google, GitHub, or Discord)

This information is provided directly by you and is necessary to create and secure your account.

4.B Developer and project data

Depending on how you use the IDE, we may process:

• Smart-contract source code and project files you write or upload, where you choose to save a project to our servers rather than keep it only in your local browser session
• Build, compilation, and test logs generated when you run or compile a contract
• Deployment records, including which network (testnet or mainnet) a contract was deployed to and the associated transaction outcome
• Prompts and code snippets you submit to the AI Copilot (see Section 9 for AI-specific handling)

We treat your source code and project files as confidential developer content. We do not claim ownership of your code, and we do not use your project data for purposes beyond operating, securing, and improving the Service, unless you separately and explicitly agree otherwise.

4.C Blockchain and wallet information

Wallet connection. When you connect a browser wallet (such as Freighter, xBull, Albedo, Lobstr, or Hana) to deploy or interact with mainnet, WebSoroban receives your public wallet address (a Stellar G… address). Your wallet's private key is held and used by your wallet extension, not transmitted to or stored by WebSoroban, when you use connected-wallet (non-custodial) mode.

Custodial signing. WebSoroban's default signer for testnet is a wallet generated and held by WebSoroban on your behalf, so that you can test contracts without first installing a wallet extension. Separately, WebSoroban offers an opt-in custodial mode for mainnet, which you must explicitly enable and acknowledge as carrying risk, in which WebSoroban stores a private key on its infrastructure and signs mainnet transactions using that key at your instruction.

We do not collect, and you should never submit to us, your seed phrase or recovery phrase, or the private key of any wallet you intend to keep self-custodied. Where custodial signing is used, key handling is limited to what the custodial feature technically requires, and is described further in Section 14 (Security).

On-chain data. Transaction hashes, contract addresses, invocation data, and any other data you submit to the Stellar network through WebSoroban become part of the public, immutable Stellar ledger once confirmed. See Section 10.

4.D Technical information

Collected automatically as you use the Service:

• Browser type and version
• Device type (e.g., desktop or mobile)
• Operating system
• Referrer URL
• Session identifiers and log data

4.E Usage and analytics information

We may collect information about which pages and IDE features you use, session duration, and general interaction patterns, in order to understand how the product performs and where it breaks.

4.F Communications

If you contact support, submit feedback, report a bug, or otherwise message us, we collect the content of that communication and your contact details, in order to respond to you.

4.G Payment information

WebSoroban offers paid features today, including Pro and Premium subscription tiers (higher deploy and function-test limits, verified via testnet XLM payment) and AI Copilot credit packs (purchased with fiat via our payment processor). There is no separate Enterprise tier at this time.

For AI credit purchases, payment card details are collected and processed directly by our third-party payment processor Dodo Payments. WebSoroban does not receive or store your full card number. We may retain limited billing information, such as your email address, billing name, Dodo customer ID, and transaction/invoice references, to maintain your account and issue receipts.

We receive personal data from:

• You, directly (account details, code you save, support messages, payment setup)
• Your browser and device, automatically (technical and usage data)
• Third-party wallet applications you choose to connect (public wallet address)
• The Stellar network itself, which is a public, decentralized ledger (on-chain transaction data)
• Third-party authentication providers (Google, GitHub, Discord OAuth)
• Analytics and error-monitoring providers (Vercel Analytics, Google Analytics when enabled, and Sentry when configured)

We do not use your data for advertising, and we do not sell personal data.

If and to the extent EU/UK data protection law applies to our processing, we rely on the following legal bases:

You may withdraw consent for any consent-based processing (such as marketing emails or non-essential cookies) at any time, without affecting the lawfulness of processing carried out before withdrawal.

We use cookies and similar technologies to operate and understand the Service:

• Essential cookies — maintain your login session and core IDE state. These cannot be disabled without breaking core functionality.
• Analytics cookies — Vercel Analytics and Google Analytics (when configured) help us understand feature usage and performance.
• Marketing/advertising cookies — we do not currently use these.

The AI Copilot is a natural-language assistant that helps you generate, debug, and optimize Soroban contracts.

What is processed. When you use the AI Copilot, the prompt you type and any code snippet you include with it are sent to OpenRouter for processing, which routes your request to an underlying model provider (such as Anthropic, OpenAI, or Google) to generate a response. WebSoroban also stores your Copilot conversation threads, messages, and run history in your account so you can review past sessions and undo changes.

Retention and training. OpenRouter does not store your prompt or completion content by default; it retains request metadata (such as token counts and latency). Each downstream model provider has its own data-retention and training policies. WebSoroban does not opt in to OpenRouter's voluntary product-improvement data sharing, and we do not use your Copilot submissions to train or fine-tune any AI model. Your Copilot data in WebSoroban is retained while your account is active and until you delete the relevant thread or your account.

Ownership. You retain ownership of the code you write, including code produced with AI Copilot assistance, subject to the terms of our Terms of Service.

Never submit the following to the AI Copilot, to our support team, or anywhere else in the Service:

• Private keys
• Seed phrases / recovery phrases
• Passwords
• API secrets or tokens
• Any wallet authentication credential

WebSoroban does not need this information to provide AI assistance, and no legitimate feature requires it. If a feature ever appears to request one of these, treat it as suspicious and contact us immediately.

Stellar, including the Soroban smart contract layer, is a public, decentralized network. This has consequences that are different from typical cloud software:

• Once a transaction or contract deployment is confirmed on testnet or mainnet, the associated data (contract address, transaction hash, invocation parameters, and the public wallet address that signed it) becomes publicly visible on the ledger and is replicated across the decentralized network of nodes that maintain Stellar.
• This on-chain data is not controlled by WebSoroban. We cannot modify, hide, or delete data once it is recorded on the public ledger, because no single party controls the Stellar network.
• Testnet data (including data from the free Friendbot faucet) is separate from mainnet and does not involve real value, but is still publicly visible on the testnet ledger.
• Mainnet transactions are irreversible and involve real XLM. WebSoroban simulates every mainnet transaction, shows you the fee, and requires your explicit confirmation before signing; WebSoroban does not deploy or invoke contracts on mainnet without your action.
• Data we control (account records, saved project files, support tickets, logs) is distinct from data recorded on the public blockchain. Deleting your WebSoroban account removes the data we control, as described in Section 19, but has no effect on data already confirmed on-chain.

We work with service providers to operate WebSoroban:

Where we engage a processor, we require them to process personal data only on our instructions and to protect it appropriately. We do not treat our processors as joint controllers unless a specific arrangement genuinely makes that accurate.

WebSoroban is a globally accessible, browser-based service. BayLeaf OÜ is established in Estonia (EU). Your data may be processed in countries other than your own, including the United States, where several of our infrastructure and service providers are located.

Where EU/UK data protection law applies and personal data is transferred outside the EU/EEA or UK, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) with our processors, and we assess provider locations and subprocessors as part of our vendor review.

We retain personal data only as long as necessary for the purposes described in this policy:

On-chain data is not subject to any retention period we control — see Section 10.

We apply reasonable technical and organizational measures designed to protect the personal data and code you entrust to us, including:

• Encryption of data in transit (HTTPS/TLS)
• AES-256-GCM encryption of custodial wallet secrets and BYO API keys at rest
• Access controls limiting who inside our organization can reach account, project, and key-related systems
• Logging and monitoring of platform activity
• Secure development practices for the Service itself

Custodial key material, where used, is handled with additional care given its sensitivity, and access is restricted accordingly. Private keys are decrypted only in memory at signing time and are never logged.

Depending on your location, you may have rights over your personal data, which can include the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Receive a portable copy of data you provided to us
• Withdraw consent, where processing is based on consent
• Lodge a complaint with a data protection authority in your jurisdiction, where applicable

To exercise any of these rights, contact us at hello@websoroban.in. We will respond within the timeframe required by applicable law. We may need to verify your identity before acting on certain requests.

Automated decision-making. The AI Copilot generates suggestions to assist you, but does not make automated decisions about you that produce legal or similarly significant effects.

WebSoroban is a developer tool intended for people building software, not a service directed at children. We do not knowingly collect personal data from children under the age threshold applicable in your jurisdiction (13 in the United States, 16 in some EU member states). If you believe a child has created an account or provided us with personal data, contact us at hello@websoroban.in and we will take appropriate steps to address it.

We distinguish between two types of communications:

• Service communications — account, security, billing, and operational notices necessary for the Service. You cannot opt out of these while your account is active.
• Marketing communications — product updates and newsletters. You can unsubscribe at any time via the link in the email or by contacting us.

When you delete your account (by contacting us at hello@websoroban.in):

• We delete or anonymize the personal data and project data we control within 30 days of your verified request, except where we are legally required to retain certain records for longer (for example, billing records for tax purposes).
• Deleting a project removes it from our servers immediately — there is no separate grace or backup period for project files.
• If a subscription or credit balance ends, billing records may be retained as required by law even after account deletion.
• Custodial key material associated with your account is permanently deleted from our systems when your account is deleted.

Blockchain data is different. Deleting your account does not, and cannot, remove any transaction, contract, or wallet address you already published to Stellar testnet or mainnet. That data exists on a public, decentralized ledger outside our control, permanently. See Section 10.

Data Controller: BayLeaf OÜ, for personal data processed to operate the Service.

Where we use third-party providers (Section 11) to process personal data on our behalf, those providers act as processors under our instructions, not as independent controllers of that data, except for payment processors (such as Dodo Payments), which typically act as independent controllers of payment data under their own privacy policies.

We may update this policy as our product, vendors, or legal obligations change. When we do:

• We will update the "Last Updated" date at the top of this page.
• For material changes, we will provide additional notice, such as an email or in-app notification, before the change takes effect.
• Continued use of WebSoroban after a change takes effect constitutes acceptance of the revised policy.

• Website: WebSoroban (websoroban.in)
• Contact email: hello@websoroban.in