1. Private keys and seed phrases
- Anything that needs a signature is signed inside your browser (locally, with viem). There is no server-side signing on this site, and our API has no field that accepts a private key or a seed phrase.
- Deriving an address from a seed phrase, importing a key, generating a batch of wallets — all of that runs locally.
- Two things you should know:Until you create the vault, private keys for batch-generated wallets are kept in plain text in
localStorageon your own machine. They are kept so a refresh or a language switch does not lose them — a generated key is shown once, and losing it means losing the funds. Once the vault exists they move to encrypted IndexedDB and the plain-text copy is deleted.Both of those live only on your machine. Clear site data and they are gone.
2. What leaves your browser, and where it goes
| Destination | What is sent |
|---|---|
| Chain RPC nodes (our defaults, or the node you choose in the UI) | Signed transactions, public addresses, query parameters |
api.gtokentool.com (our backend) | Report-bot pool and address config; Four internal-market login (an address plus a signature over the login message — not the key); token name, tax rates and other creation metadata; optional raw-transaction broadcast |
getaddr.gtokentool.com (our proxy, OKX DEX upstream) | Public addresses only, used to look up what a wallet holds |
meme.bsc.blockrazor.xyz, api.zan.top (third-party bundler and simulation nodes) | Signed transactions and public call data used to pack internal-market buys into a single block |
Wallet SDKs: MetaMask, WalletConnect (api.web3modal.org, pulse.walletconnect.org), Coinbase (cca-lite.coinbase.com) | Connection handshake and the diagnostics each SDK collects, governed by their own policies |
Google Analytics 4 (G-1L4V1N1VYF) and Microsoft Clarity | See section 4 |
Once a signed transaction is on-chain it is public and irreversible. That is how blockchains work, not a setting on our side.
3. Cookies and local storage
- Cookies:
_gaand_ga_1L4V1N1VYF(Google Analytics 4),_clckand_clsk(Microsoft Clarity, first-party). We tell Clarity not to store data for advertising, so the Microsoft ad cookie_uetvidis not expected to appear. - Local storage: form drafts and last-used values, bot strategy config and run logs, contract call history, inscription records, the wallet vault, the read-only browsing session, and campaign source (
utm_*, which lives only in the current tab). All of it exists so a refresh does not mean filling the form again — none of it is a credential we send back to a server. - No third-party advertising cookies on this site.
4. Analytics: we watch where people get stuck
- Google Analytics 4: pageviews, which button you click, and how far the token deploy funnel gets before it fails — event names and the failing step, never the contents of the form.
- Microsoft Clarity (session replay and heatmaps): clicks, scrolling, mouse movement, and text rendered on the page. Masking is set to Strict, so on-page text — including the private key and address columns our tools generate — is masked in the recording. Content typed into input fields is masked by Clarity at every setting.
- One purpose: finding where the form trips people up. This data is not used for advertising and is not tied to who you are.
- To stop the recording, clear the data your browser stores for this site. That removes the Clarity first-party cookies and the local storage with it.
5. What we do not do
We do not collect email addresses, phone numbers or names. We have no accounts. We do not sell, trade or target with user data. We never send a key generated by our tools to a server.
6. Contact and changes
When this policy changes we update this page and the date at the top. Questions, or a request about data tied to a public address, reach us through the Telegram and X links in the footer.
There is no "delete my account" option here, because there are no accounts to delete.