What QuantBase, an AI agent for trading Solana meme coins, stores, why, and what it deliberately does not collect. You own the wallet.

Last updated 2026-10-01. Operated by Avasis (avasis.ai), contact abhay@quantbase.live.

QuantBase is an AI agent for trading Solana meme coins, not an advertising business. The short version: it stores what it needs to run your account, watch the coins you ask it to watch, deliver your alerts and bill you, and nothing else.

What is stored#

Your account. A tenant handle, your plan, and the SHA-256 digest of each API key. Keys are never stored in a form we could read — a database dump of this service is not a set of working credentials, which also means a lost key can only be replaced, never recovered.

If you sign in with email (through Clerk), your email address, also in a canonical form (lowercased, +tag removed, dots removed for Gmail). That is what one-account-per-mailbox is enforced on.
If you sign in with a Solana wallet, your wallet's public address, and the sign-in message and nonce for the few minutes it takes to verify. We never receive or store a private key or seed phrase, and a sign-in signature cannot move funds.

Sessions. For each console session: a SHA-256 digest of the session token and of its anti-forgery token, how you signed in (wallet or email), when it was created, last seen and expires (30 days), a salted hash of your network address, and your browser's user-agent string. They exist so you can be signed in, so you can end every session at once, and so sign-in can be rate limited.

Coins you ask the agent to watch. Each coin you add: its address, the entry price and optional amount you entered, any note, the exit rules it was added with, the prices the agent saw, and the sales you record. Also your watchlist, your exit-rule defaults and your alerts (their text, when they were created, read and delivered). These are the substance of the meme product and are kept for the life of the account, so your trade history and "peak kept" figures stay correct.

Telegram, if you link it. The Telegram chat ID that sent your link code, when it was linked, and which alert kinds you chose. The link code itself is kept for at most an hour. Alerts sent to your chat are delivered through Telegram and are then also subject to Telegram's own privacy policy. Unlink at any time from the console; the chat ID is removed.

Your research. Strategy specifications, registered splits, backtest results, rule-lab trials and the trial ledgers. These are retained for the life of the account because the trial count is the product: a ledger that forgets is a ledger that lies.

Billing. Payments are processed by Dodo Payments as merchant of record. If you buy QuantBase on Whop instead, Whop processes that payment. We never see or store your card details. What we keep is a customer identifier, a subscription identifier, the plan they grant, the billing email the processor reports, and the amount, currency and status of each payment (including refunds and disputes).

Referrals. If you arrived through an affiliate link, a qb_ref cookie holds that affiliate's code for 60 days and, if you sign up, your account is attributed to them. Affiliates see counts (clicks, sign-ups, paying customers) and commission amounts, never who you are.

Waitlist. If you join a waitlist (live trading, or Pilot), your email address and the product you asked about.

Site visits. Path, timestamp, referrer, and a salted hash of address plus user agent plus date. That hash cannot be reversed to an address, and because the date is inside it, it deliberately does not link one day to the next. It exists to count whether anyone visited, nothing more.

Lens (the browser extension)#

Lens sends only the coin address on the page you have enabled and the order size you chose, to quantbase.live/lens/<address>. No page content, browsing history, account, cookies or identifiers. The server keeps standard request logs (client IP address, time, the address requested) for at most 14 days, for rate limiting and abuse prevention only. Lens settings stay in your browser's extension storage. The full Lens policy is at quantbase.live/lens/privacy.

Cookies#

The site and console set only the cookies they need to work:

Cookie	Purpose
`__Host-qb_session`	Your signed-in session (wallet sign-in)
`__Host-qb_csrf`	The anti-forgery token for that session
`__Host-qb_link`	A short-lived cookie for an emailed sign-in link, when that is enabled
`qb_ref`	The affiliate who referred you, for 60 days
Clerk's cookies	Your session, if you sign in with an email account

There are no advertising or third-party analytics cookies, and no tracking script on any page.

What is not collected#

No third-party analytics or advertising script on any page.
No tracking across sites, and no data sold, rented or shared for marketing.
No card details.
No private keys, seed phrases, wallet balances or transactions. You own the wallet. QuantBase does not custody keys and holds none of your coins. When live trading opens, the agent will trade meme coins inside limits you set. Today it trades paper money. Customer MCP keys stay read-only and cannot place trades.
No exchange credentials. If you ingest research data from another venue you give this server a URL, not an account.

Isolation between accounts#

Every account-scoped table carries an owner and is protected by Postgres row-level security, ENABLED and FORCED. Isolation is enforced by the database rather than by query filters, so a bug that forgets to scope returns nothing rather than another account's rows.

Market data — launch records, coin prices, OHLCV bars — is deliberately shared, because a price is the same fact for everyone. What you did with it is not.

Sub-processors#

Who	What they handle
Amazon Web Services (us-east-1)	Hosting, database and object storage
Dodo Payments	Payments and tax, as merchant of record
Whop	Payments and memberships, only for purchases made on whop.com
Clerk	Email-account sign-in
Telegram	Delivering alerts to a chat you linked
Anthropic	Messages you send to the agent in the app's chat, to generate its answers
Coinbase, DexScreener, GeckoTerminal, pump.fun, PumpPortal, Solana RPC providers	Public market data requests made by the server; when the agent watches a coin, the server asks for that coin's price, not for anything about you

Retention and deletion#

Account, trade and research data are kept for the life of the account. Sessions expire after 30 days and are pruned after that. Lens request logs are kept for at most 14 days. Site-visit rows are aggregated and carry no recoverable identifier.

To delete your account and its data, email abhay@quantbase.live from the address on the account, or, for a wallet account, say which wallet address it is (we may ask you to sign a message to prove it). We remove it within 30 days. Billing records are kept where tax law requires it. The console's own export and delete buttons are not available yet.

Your rights#

Ask for a copy of your data, correction, or deletion at abhay@quantbase.live.

Changes#

Material changes will be noted here with a new date. The service does not sell data, and any change to that would be announced rather than quietly edited in.

Privacy