Security

VAPE cannot move your funds, never asks for a seed phrase or private key, and asks your wallet to sign only a trade you start. Its server keeps no request logs (logging is disabled in code), sets no cookies and runs no analytics.

Your keys

VAPE never sees a private key. Every signature — swap, approval, limit order, cancel — happens in your wallet's own window; the page only prepares transactions you asked for. The only external script the trade lane loads is a self-hosted, hash-pinned build of Solana's web3 library — nothing is fetched from third-party script CDNs.

Who sees what

• VAPE's server — pages and coin reads, including your starred coins a few at a time; Solana balance and status reads for a connected wallet (passed through, never logged); optional trade receipts (hash-keyed).
• Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — the pages' fonts.
• Image servers (dd.dexscreener.com, cdn.dexscreener.com, and sometimes CoinGecko's or X's) — coin logos.
• DexScreener (api.dexscreener.com) and GeckoTerminal (api.geckoterminal.com) — asked by the new terminal from your browser during ordinary use (the boards, coin pages and their charts, search), with no cookies and no referrer: coin and pool addresses only. The classic page does not ask them.
• Binance public API (fapi.binance.com) — the classic page's BTC paper-desk chart.
• KyberSwap (aggregator-api.kyberswap.com) and Jupiter (lite-api.jup.ag, api.jup.ag) — trade quotes and swaps: the tokens and amounts, and your public address once a swap is built.
• Base public node (mainnet.base.org) and Robinhood Chain public node (rpc.mainnet.chain.robinhood.com) — on the new terminal, a coin page's chart reads the pool's live trades (pool addresses), with no cookies and no referrer; on either page, if you trade: quotes, balances, allowances and sends for your connected address.
• Hugging Face — hosts the public instance; standard infrastructure logs apply.

We deliberately do not route your quotes or swaps through VAPE's server: that would hand one party (us) your address, your intent and your IP address at once — the worst geometry under "nothing traces back to users".

What the pages and the engine do to protect you

• The pages load no third-party scripts (only Google Fonts' stylesheet), tell your browser to send no referrer, and cannot be framed by other sites.
• The operator's own positions, armed alert levels and wallet sync are not served to the public: those routes need the operator's key, and the engine's graded-wallet names and tags are stripped from public trade and holder lists.
• If you run VAPE on your own computer, the engine answers only its own pages: a request from any other website is refused, and so is a request that names another host (DNS rebinding). Tools without a browser (curl, scripts) still work.

The receipt ledger

Optional trade receipts are stored keyed by HMAC(server secret, address) — the disk never holds your raw address, so a leak or an address-walking visitor cannot list who trades here. The public site answers a lookup by address with verified, refuted and unverified counts only, never the receipts. Rows are unverified until our own chain read confirms the transaction, and unverified rows are excluded from every aggregate claim. Your local receipt copy is cleared when you disconnect your last wallet.

Bridges

VAPE has no bridge and will not embed one. Funding Robinhood Chain links out to the official Arbitrum portal — you leave VAPE, and VAPE never holds or routes those funds.

VAPE v578.61 · This page is served by the engine itself and describes the product as currently shipped. · Disclaimer · Privacy · Security