Privacy Policy

Effective: 15 September 2026

Last updated: 3 October 2026

Update, 25 September 2026: Section 2f was rewritten because the Corso website now has a waitlist form. It now says what the form collects, which companies handle it, and how to leave the list. Sections 4, 5, 7 and 8 gained matching lines. Nothing about the app changed.

Corso is a Solana wallet and trading app published by Dinario Technologies Inc. ("Corso", "we", "us"). Corso never holds your keys or your funds. If you sign in with email, Apple or Google, the wallet is provided by Privy, which holds that wallet's key material under its own policy: see Section 5a. This policy explains what Corso collects, what it does not collect, and which independent companies handle information when you use parts of the app.

1. The short version

• Corso never receives your recovery phrase, private keys, or key shares. Not on sign-in, not on import, not on connect. There is no path in the app that sends them anywhere.
• Corso never receives your card number, bank details, or identity documents. When you buy crypto, MoonPay collects and holds those under its own policies.
• Corso does not hold your funds, and cannot freeze, reverse, or recover them. Nothing moves unless you approve it at the time.
• Corso has no account system of its own. If you sign in with email, Apple or Google, that sign-in account is held by Privy, and Corso's service stores a few settings and records tied to it, described in Section 2h.
• Your questions are answered by an independent AI company, and Corso asks you first. That company is Google. It does not receive your wallet address or your keys. See Section 5h.
• Blockchain activity is public and permanent. Nothing Corso does, including deleting your data, can remove a Solana transaction from the blockchain.

2. Information Corso handles

a. Wallet address

Your public Solana address is sent to Corso's own service when you request a swap quote or start a Buy session, because neither can be built without it. It is also sent to the Solana network and to the providers described in Section 5.

In Corso's product analytics your address is shortened before it leaves the app (for example 7xKp…9fQm), and it is shortened a second time on Corso's server as a backstop.

b. App usage events

Corso records events such as opening the app, finishing onboarding, starting a swap, and opening or returning from Buy. Each event carries:

• a random ID created on your device the first time you use the app, kept in the app's local storage. It is not your name, email, phone number, advertising ID, or wallet address, and it is not shared between apps;
• the app version and whether you are on iOS or Android;
• event details such as token identifiers, amounts, fee basis points, and error codes.

Before an event leaves your device, and again on Corso's server, Corso removes any field named like a secret (recovery phrase, seed, private key, password, passcode, email address, or an authentication token), removes anything that looks like a 12- or 24-word recovery phrase, and shortens anything that looks like a wallet address.

Analytics are on by default. You can turn them off at any time in Settings, by turning off Share usage analytics. Turning them off stops new events from leaving the device immediately; events already sent are not removed automatically. To request deletion of Corso-side analytics data, use the Account & Data Deletion page.

c. Transaction requests

To quote and submit a swap, Corso's service passes the tokens, the amount, and your address to the routing provider, and passes the transaction you already signed on your device to be submitted to the network. Corso keeps a short-lived record linking a quote to its transaction so the transaction you approve is the transaction that gets submitted. That record expires within minutes.

d. Support messages

If you email support at support@corso.trade, Corso receives whatever you choose to put in the message. Never send your recovery phrase or private key to Corso support, or to anyone else. No genuine Corso message will ever ask for it.

e. Technical logs

Corso's service and its hosting provider record ordinary technical information about requests (such as timing and error information) in order to run and debug the service. These are kept for 30 days.

f. Website (corso.trade)

The Corso website has a waitlist. It asks for an email address or a Telegram handle, so Corso can tell you when the app is open. It does not ask you to connect a wallet, and it never asks you to sign anything. If you include a Solana address, that address is stored with the row. The form does not ask for a recovery phrase, a private key, or a payment card.

The row is stored in Supabase for Corso. It holds the email or Telegram handle, any Solana address you added, the time, the source label, and the campaign fields on the link if there were any. If you gave an email address, Resend sends that address a confirmation, and Corso uses it for one further message when the app opens. Corso does not sell the address, does not share it for advertising, and does not put it on any other list.

When a new signup is saved, Corso may post one short alert to a private Corso Slack channel. The alert contains a shortened form of the email or Telegram handle, the source label, and the time. It does not contain the full email address or the full handle. The alert is sent only when that Slack destination is configured. If the alert fails, the signup is still saved.

Upstash receives your IP address for about a minute, to limit how often one connection can submit the form. Your IP address is not stored with your signup. Vercel hosts the website and runs the form, and keeps the technical logs described in Section 2e.

Rows from earlier versions of the site are kept the same way. To ask for a waitlist row to be deleted, email support@corso.trade.

The website also counts anonymous page and control events, to see which parts of the page people use. Those counts set no cookie, store no identifier on your device, and follow you to no other site. Your email address is never attached to them. Corso uses Vercel Web Analytics for these counts.

g. Questions you ask Corso

When you ask Corso a question, some answers are built from Corso's own rules and the rest are answered by an independent AI company. That company is Google. What it receives, and what it never receives, is set out in Section 5h. Corso's servers do not save your questions or the answers. Your conversations are kept on this phone, and you can delete them there. The one exception is reporting: if you report an answer, Corso sends that question and answer to its own servers so a person can review it, and keeps them for as long as its service logs, as set out in Section 7. Nothing is sent unless you choose to report it.

Please do not type personal details into a question. A question is free text, so whatever you put in it goes to the AI company answering it.

h. Settings and records tied to your sign-in account

If you sign in, Corso's service stores a few things keyed to your sign-in account or wallet address so the app can work: the trade-size limit you choose, routines you save, token watches, and records of Buy sessions. Corso uses these only to run those features. They are deleted when you delete your sign-in account. Buy records are deleted sooner if 90 days pass from when the Buy session started.

i. Crash and error reports

When the app or Corso's service hits an error, an error report is sent to Sentry, which processes it for Corso. A report holds the error, where in the code it happened, the app version and the platform. It does not include your name, email, wallet address or keys, and Corso turns off session recordings and activity trails. These reports are not covered by the analytics switch.

j. Where you are, roughly

Corso is available only in some places. To check, Corso's service looks up the approximate region of your connection's IP address with IPinfo when the app connects to Corso's service and when you buy. Corso does not use your device's location and does not store the region with your wallet.

3. Information Corso does not collect

Corso does not collect, request, store, or transmit:

• recovery phrases, private keys, key shares, or wallet passwords;
• card numbers, bank account details, or payment credentials;
• government ID documents, selfies, or other identity-verification material;
• your name, postal address, or date of birth;
• contacts, photos, precise location, or advertising identifiers;
• your email address in Corso's analytics. If you sign in with email, that email is held by Corso's authentication provider (Section 5a), not by Corso's analytics.

One thing to know about questions. Corso does not ask you for any of the above and does not save your questions, except the one reporting case described in Section 2g, but a question is free text and is passed to the AI company answering it. Please leave personal details out of it.

Corso does not sell your personal information, and does not share it for cross-context behavioural advertising, as those terms are used in US state privacy laws.

4. Why Corso handles this information

• To run the wallet: show balances, build and submit transactions you approve, and route swaps.
• To answer the questions you ask Corso, which means sending the question and the wallet summary described in Section 5h to the AI company answering it.
• To start a Buy session with the payment provider and return you to the app afterwards.
• To understand which parts of the product work, how many people finish onboarding, how often swaps fail, and why.
• To detect abuse and keep the service available.
• To answer support requests.
• To keep the waitlist on corso.trade and to send the confirmation and the opening message in Section 2f.

Corso is available in the United States at launch and is not offered in the EEA or the UK, so this policy does not set out a GDPR legal-basis table. If that changes, this section will be updated before the app is offered there.

5. Independent companies involved

These companies are not Corso. Each handles information under its own terms and privacy policy, and each holds things Corso deliberately does not.

a. Privy, sign-in and embedded wallets

If you choose Sign in with email, Apple, or Google, Privy authenticates you and provisions and operates an embedded Solana wallet for you. Privy holds your account identifier (your email address, or the identifier your Apple/Google sign-in supplies) and the key material for that wallet. Corso holds no share of that wallet's keys and cannot recover it for you.

Consequence worth stating plainly: on this sign-in path, whoever controls your email or Apple/Google account is on the path to your wallet. Corso does not yet offer an additional security check on top of that sign-in, so protecting that account is the only mitigation available to you today. We are building one. If you want a wallet that does not depend on your email or Apple/Google account, connect a wallet you already control instead.

If you import a recovery phrase or connect a wallet you already use, Privy holds nothing about your keys, the phrase stays in secure storage on your device, and a connected wallet's keys stay in that wallet's app.

Privy Privacy Policy

b. MoonPay, buying crypto with money

If you use Buy, you leave Corso for MoonPay's checkout. MoonPay is an independent company that performs its own identity verification and processes your payment under MoonPay's own terms and privacy policy. MoonPay, not Corso, collects and holds your card or bank details, your identity documents, and the record of your purchase.

Corso sends MoonPay the wallet address the assets should be delivered to, the asset you selected (SOL, or USDC on Solana), the amount and currency, and a reference code so the app can recognise your return. Corso does not receive your payment details or your identity documents from MoonPay, and Corso cannot access, correct, or delete MoonPay's records. Requests about those records go to MoonPay.

MoonPay Terms of Use · MoonPay Privacy Policy

c. PostHog, product analytics

The events described in Section 2b are forwarded from Corso's own server to PostHog, an analytics provider. The app itself contains no analytics tracker, so nothing is sent to PostHog directly from your device. PostHog Privacy Policy · 90 days

d. Solana network access providers

To show balances and history and to submit transactions, the app contacts a Solana network provider. That provider necessarily sees the addresses being looked up and, as with any internet request, the network information that comes with the request. Corso's current primary provider is Helius. Helius Privacy Policy

e. Jupiter, swap routing

Swap quotes and submissions are routed through Jupiter's aggregator via Corso's service. Jupiter receives the tokens, the amount, and the address the swap is for, which are needed to build the route. Jupiter Legal

f. Expo / EAS, app delivery and updates

Corso is built with Expo and may deliver over-the-air updates through Expo's update service, which receives the ordinary request information needed to serve an update to your app version and platform. Expo Privacy Policy

g. Apple, Google, and the Solana dApp Store

However you installed Corso, that store has its own relationship with you and its own privacy policy. Corso does not receive your store account details.

h. Google, the assistant that answers your questions

Some questions are answered by Corso's own rules. The rest are sent from Corso's servers to Google's Gemini API. Google receives your question and a summary of your wallet: the names, amounts and dollar values of up to 20 tokens you hold, and your total balance. Google never receives your wallet address, your keys, your token addresses, or your transaction history. Google may keep this for a limited time to prevent abuse and to meet legal requirements. Beyond that, what Google may do with what it receives is governed by the Gemini API Additional Terms of Service, which set different data-use rules for paid and unpaid access to the API.

Corso asks before your first question goes to Google. If you do not agree, the assistant does not answer. Google Privacy Policy · Gemini API Additional Terms of Service

j. Supabase, Resend, and Slack, the waitlist

Waitlist rows are stored in Supabase. Resend receives the email address you gave and the text of the confirmation, and of the opening message, in order to deliver them. If the Slack alert in Section 2f is turned on, Slack receives only the shortened identifier, the source label, and the time. How long Supabase, Resend, and Slack keep what they receive is set by each company. This policy does not state a number of days for them.

Supabase Privacy Policy · Resend Privacy Policy · Slack Privacy Policy

k. Sentry, error reports

Receives the error reports in Section 2i and processes them for Corso. Sentry Privacy Policy

l. IPinfo, approximate region

Receives your connection's IP address to return an approximate region, as in Section 2j. IPinfo Privacy Policy

6. Blockchain data is public and permanent

Sending, receiving, and swapping on Solana creates public records. Addresses, amounts, tokens, and timestamps are visible to anyone, are copied by many independent parties, and are permanent.

Corso cannot delete, hide, edit, or reverse anything recorded on the blockchain. This is a property of the network, not a Corso policy choice, and it is not something any deletion request can change. See Account & Data Deletion.

7. How long information is kept

8. Your choices and rights

• Analytics: on by default. You can opt out in Settings, by turning off Share usage analytics. The opt-out stops new events; it is not itself deletion of events already sent. See Account & Data Deletion for the request path and pending provider mechanics.
• Deleting Corso-side data: use the deletion page at https://corso.trade/delete or email support@corso.trade. You do not need an account or a login to make a request. What can and cannot be deleted is set out on that page.
• Your sign-in account: deleting your Privy-backed sign-in account also removes your access to the embedded wallet it holds. If that wallet holds assets, move them first, this step cannot be undone.
• Your imported or connected wallet: removing it from Corso removes it from this device. It does not affect the wallet itself, which you continue to control with your own recovery phrase or wallet app.
• Regional rights. Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of personal information Corso holds about you, and to appeal a refusal. Corso has no account system of its own; see Section 2h. The practical way to exercise these is the Account and Data Deletion page, or by emailing support@corso.trade. A waitlist row is found by the email or Telegram handle on it. Corso does not sell or share personal information, so there is nothing to opt out of.
• Contact: support@corso.trade · 390 NE 191st St STE 94833, Miami, FL 33179, US

9. Security

Corso is built so that the most sensitive material never reaches it: recovery phrases and private keys are never transmitted to Corso, and payment details never touch Corso at all. On the device, an imported recovery phrase is held in the operating system's secure storage behind your biometric or passcode, and screen capture is discouraged where the platform allows. Traffic between the app and Corso's service uses HTTPS.

No system is perfectly secure, and Corso cannot protect you against a compromised device, a phishing site, a malicious wallet app, or someone who obtains your recovery phrase.

10. International transfers

The independent companies named in Section 5 operate internationally, so information they hold may be processed outside the country you live in, under their own policies and safeguards. Corso itself is a United States company and holds the limited information described in Section 2 in the United States.

11. Children

Corso is not directed to children and is intended only for people aged 18 or over. Corso does not knowingly collect information from anyone under 18. If you believe a child has used Corso, email support@corso.trade and Corso will delete what it holds.

12. Changes

If this policy changes materially, the updated version will be posted at https://corso.trade/privacy with a new "Last updated" date, and, where required, you will be notified in the app.

13. Contact

Dinario Technologies Inc.

390 NE 191st St STE 94833, Miami, FL 33179, US

Contact: support@corso.trade