Terms of Use

1. Introduction

Stealf is a self-custodial, privacy-focused financial app on Solana, operated by Stealf Corporation, a Delaware corporation ("Stealf", "we", "our", "us"). These Terms of Use ("Terms") are a binding agreement between you and us, and they cover the Stealf mobile app, the website at stealf.xyz and any related services (together, the "Service").

By downloading, accessing or using the Service, you agree to these Terms and to our Privacy Policy. If you don't agree, don't use the Service.

What we store. To run the Service, we keep a small set of data: your email address (encrypted, used to sign you in and contact you), a pseudonym, your Turnkey account identifier, your public wallet address, your points balance, and records of your gift-card orders (product, amount, status and payment details) so we can track them and recover a failed order. Our servers also keep a temporary cache of your public balance and transaction history so the app can update in real time. We never hold your private keys, and our servers never store or cache your private balance. Retention periods and the providers we use are set out in our Privacy Policy.

2. What Stealf Is, and What It Isn't

Stealf is a software company. We build an interface that lets you use your own wallet with third-party protocols on Solana. We are not a bank, a money transmitter, a broker, an investment adviser or a regulated financial institution, and we never hold, pool or move your funds for you. Nothing in the Service is a bank deposit, and none of it is covered by deposit insurance.

The Service is in early access. Features are still changing, some are rolled out progressively, and the app may behave in ways we didn't expect. The Stealf app itself has not yet been audited by an independent security firm. The protocols we connect to have been audited by independent firms, and their providers publish those reports. Those audits cover the providers' code, not ours, and no audit rules out every bug.

3. Eligibility

By using the Service, you confirm that:

• you're at least 18 and legally able to enter into these Terms;
• you aren't located in, or a resident of, a country or region under comprehensive sanctions (currently including Cuba, Iran, North Korea and the Crimea, so-called Donetsk People's Republic and Luhansk People's Republic regions of Ukraine), and you aren't on a sanctions list kept by the United States, the European Union, the United Kingdom or the United Nations;
• using the Service, including privacy-enhancing features, is legal where you live and where you are;
• you understand how self-custodial wallets work, including that blockchain transactions can't be reversed.

Some features carry extra geographic limits, described in their own sections. We may block, limit or end access to any feature where we believe the law requires it, including based on your IP address, device signals or other location indicators. Don't use a VPN or similar tool to get around these limits.

4. What Stealf Provides

The Service is an interface to the following, each run by a third party:

We may add, change or remove features and providers at any time. Cash-out to a bank account, payment cards and identity verification aren't part of the Service today; if we add them, we'll update these Terms first.

5. Fees

Stealf charges no fees and takes no commission. We don't add a margin to swaps, staking, private transfers, xStocks or gift cards, we don't take a referral cut from the providers we route to, and there's no subscription.

Other parties still charge for what they run, and those costs show up in the quote or rate you see before you confirm:

• Solana network and priority fees;
• fees and price impact from the liquidity pools Jupiter routes through;
• Umbra protocol fees on shielded deposits, private transfers and withdrawals, and relayer fees;
• fees the Jito stake pool takes from staking rewards or on withdrawal;
• Bitrefill's pricing on gift cards.

If we ever start charging, we'll tell you in the app at least 30 days beforehand and show the fee before every transaction it applies to. A fee will never apply to a transaction you confirmed before the change.

6. Self-Custody and Your Keys

You hold your assets; we don't. The app creates one Solana wallet for you, and its private key is never in our hands.

Your wallet runs on Turnkey's key infrastructure. Its private key is generated and kept inside Turnkey's secure hardware environments, and you sign in through OAuth or email. Stealf can't see that key, export it or sign transactions with it.

Two balances, one wallet. Your public balance sits in standard Solana token accounts that anyone can see on a block explorer. When you register your wallet with Umbra, you also get a private balance whose amounts are encrypted inside the Umbra protocol (see section 7). The keys Umbra needs are derived from a signature by your wallet, so the same Turnkey wallet controls both balances.

That also means a single point of failure: if you lose access to your login and Turnkey recovery methods, you lose access to both balances, and nobody, including us, can restore it.

You're responsible for keeping your phone, login and recovery methods safe, for checking every transaction before you sign it, and for understanding what each operation does. Transactions on Solana are final once confirmed.

7. Private Transfers (Umbra)

Private balances and private transfers run on the Umbra protocol, operated by Phoenix DAO LLC (Republic of the Marshall Islands), which relies on Arcium's encrypted computation network. When you first turn these features on, you also accept Umbra's Terms and Conditions and Privacy Policy. Where they conflict with these Terms on how the protocol itself works, Umbra's terms control.

Read those documents; the points below matter most.

• Privacy isn't guaranteed. It reduces what others can see on-chain, but timing, amounts, metadata and future advances in cryptography can all weaken it.
• What stays visible. Your public balance and its history are public. Your private balance is attached to your wallet: others can see that your wallet uses Umbra and when you move funds in or out, even though the amounts held privately are encrypted. Private transfers through Umbra's pool are what break the link between sender and recipient. Moving an exact amount out of your private balance right before you spend it makes it easier to connect the two.
• Screening and relayers. Umbra may screen deposits for sanctions or risk and refuse some. Withdrawals depend on independent relayers, so an outage can delay or block a transfer for a while.
• Disclosure. Viewing keys let you share your history with an auditor or accountant. Keep them safe; authorities may legally require you to hand them over.
• Legality. Don't use private features where privacy-enhancing technology is restricted.

Stealf doesn't operate Umbra or Arcium and isn't responsible for how either works, fails or changes.

8. Swaps and Tokenized Stocks

Swaps go through Jupiter, which picks a route across decentralized exchanges. We don't set prices or choose routes, and we can't guarantee execution. The price can move between the quote and the moment your transaction lands, because of slippage, liquidity or network load. A confirmed swap is final.

xStocks are tokens issued by Backed Assets that track the price of listed shares. In the app you get them through a Jupiter swap, like any other token. They aren't shares: you get no voting rights, no dividends paid as a shareholder and no claim on the underlying company, which hasn't issued, endorsed or approved them. Their price can drift from the share price, liquidity can be thin, and you carry the issuer's and its custodian's risk. Backed's own legal documents apply when you hold them.

xStocks aren't available to US persons or to anyone in the United States, and they're also restricted in Canada, the United Kingdom and Australia, among other places the issuer may add. By swapping into xStocks you confirm you're not in, or a resident of, any of these places. We may hide or block xStocks based on your location signals.

9. Liquid Staking (JitoSOL)

You can turn SOL into JitoSOL, a token from the Jito stake pool that represents staked SOL and grows in value as staking and MEV rewards come in. You get JitoSOL by depositing into the Jito stake pool. Stealf doesn't run the pool, pick its validators or hold your JitoSOL.

Before you stake, know that:

• rewards vary with network conditions and validator performance, and can drop;
• the pool's smart contracts or the validators it delegates to can fail or be exploited;
• getting back to SOL may take until the end of the current Solana epoch (often around two days), or cost you a discount if you swap out on the market instead;
• JitoSOL can trade below its underlying value, especially when markets are stressed;
• the Jito pool takes its own fees, as set out in Jito's documentation.

We don't promise any return, and we don't promise you'll get back the SOL you put in.

10. Gift Cards

Gift cards are digital vouchers sold and delivered by Bitrefill and issued by each merchant. You pay in crypto from your wallet, and Bitrefill's terms apply to the purchase. Which cards you can buy, and where they work, depends on the merchant and your country.

Once a code is delivered, the purchase is final and can't be refunded, except where the law says otherwise. Check the country, currency and amount before you pay. Expiry, acceptance and usage rules are set by the merchant, not by us; for problems with a code, contact Bitrefill support first, and we'll help where we can.

11. Acceptable Use

You agree not to:

• break any law or sanction, or use the Service for money laundering, terrorist financing, fraud or sanctions evasion;
• use private features to hide the proceeds of crime or to get around a provider's screening;
• get around geographic limits, including with a VPN;
• reverse engineer, scrape or decompile the app or our backend, except where the law allows it;
• disrupt the Service, abuse rate limits or create automated or fake accounts;
• use the Service in a way that harms Stealf, other users or anyone else.

If you do, we may cut off your access to our interface and report you where the law requires. We can't freeze or move funds in your wallet.

12. Third-Party Services

The Service connects to providers that run under their own terms: Turnkey (keys and sign-in), Umbra and Arcium (private transfers), Jupiter (swaps), Backed Assets (xStocks), Jito (liquid staking), Bitrefill (gift cards) and Helius (Solana infrastructure). We may add, swap or drop providers. We aren't responsible for their outages, fees, policies, data handling or failures, or for any on-chain protocol.

13. Taxes

You're responsible for working out, reporting and paying any taxes on your activity, including swaps, staking rewards and private transfers. We don't give tax advice or file anything for you. Keep your own records; your viewing keys can help you rebuild private transaction history for an accountant.

14. Campaigns and Rewards

We may run waitlist perks, referral programs, giveaways or similar campaigns, each with its own rules shown when it starts. We decide who's eligible, and we may change, pause or end a campaign, or withhold a reward in cases of fraud, abuse or a breach of these Terms. You may earn points for using the Service. Points have no cash value, can't be sold or transferred, and aren't an investment. Holding points doesn't promise you any token, airdrop, allocation or price. If we ever run an airdrop, it will come with its own terms and eligibility rules, and it may exclude some countries, including the United States.

15. Disclaimers

The Service is provided "as is" and "as available", without warranties of any kind, express or implied. In particular, we don't promise that the Service will be uninterrupted or free of bugs and vulnerabilities, that any feature, provider or protocol will stay available or stay solvent, or that you'll earn anything or avoid losses. We also don't promise that your activity will stay private (see section 7). Some places don't allow these disclaimers, so parts of this section may not apply to you.

16. Limitation of Liability

To the fullest extent the law allows, Stealf isn't liable for indirect, incidental, special, consequential or punitive damages, or for lost assets, profits, rewards, data or opportunities. That includes losses from market moves, depegs, exploits, smart-contract bugs, relayer or protocol failures, lost keys, your own mistakes, or anything a third-party provider does or fails to do.

Our total liability for any claim connected to these Terms or the Service is capped at the greater of US$100 and the fees you paid us in the 12 months before the claim. Since we charge no fees today, that means US$100.

17. Indemnity

Where the law allows, you'll cover Stealf's reasonable costs, including legal fees, for third-party claims that come from your breach of these Terms or your violation of a law or of someone else's rights. This doesn't apply to claims caused by our own fault, and it doesn't apply where consumer law prohibits it.

18. Your Consumer Rights

Nothing in these Terms takes away rights you have under consumer protection laws that can't be waived by contract, including those of the European Union and your country of residence. Where those laws apply, sections 15, 16, 17 and 19 apply only as far as those laws allow.

19. Governing Law and Disputes

These Terms are governed by the laws of the State of Delaware and applicable US federal law, without regard to conflict-of-laws rules, unless mandatory consumer law where you live says otherwise.

Where your local law permits it, disputes will go to binding individual arbitration in Wilmington, Delaware, under the American Arbitration Association's rules then in force, and you give up class actions and jury trials. If you live in the EU or the UK, this paragraph doesn't apply to you, and you can bring a claim in the courts of your country of residence. You can opt out of arbitration within 30 days of accepting these Terms by emailing louis@stealf.xyz.

20. App Store and Google Play

If you got the app from Apple's App Store, these Terms are between you and Stealf only, not Apple. Apple isn't responsible for the app, its content, support or maintenance, or for any claim about it, including product liability, legal compliance, consumer protection or intellectual property claims. If the app fails to meet a warranty that applies by law, you can notify Apple, which may refund the app's price (zero, since it's free); Apple has no other warranty duty. Your use must also follow the App Store's Usage Rules. Apple and its subsidiaries are third-party beneficiaries of these Terms and can enforce them against you. Similar terms apply to Google if you got the app from Google Play.

21. Suspension and Termination

We may suspend or end your access to our interface at any time, including for a breach of these Terms or for legal, security or fraud reasons. You may stop using the Service whenever you want. Either way, your funds stay in your wallet, and you can reach them with your keys through any compatible wallet software. Sections 6, 13, 15 to 19 and 23 survive termination.

22. Changes to These Terms

We may update these Terms. We'll post the new version with a new "Last Updated" date, and for material changes we'll tell you in the app at least 15 days before they take effect. If you keep using the Service after that, you accept the new Terms; if you don't agree, stop using it.

23. General

If a court finds part of these Terms unenforceable, the rest stays in force. If we don't enforce a right right away, we haven't given it up. You can't transfer these Terms without our consent; we may transfer them as part of a merger, acquisition or sale of assets. We aren't liable for delays or failures caused by events outside our reasonable control, such as network outages, protocol failures or government action. These Terms and the Privacy Policy are the whole agreement between you and us about the Service. If we translate them, the English version controls.

24. Contact