Multi-layer safeguards
Preview consequences, validate authority, refresh mutable state, cap exposure, and stop operations that cross hard safety boundaries.
Security & Independence
Built Like the Environment Is Hostile
Token Studio assumes providers can fail, data can be misleading, permissions can outlive their purpose, and irreversible actions deserve more than a single unexplained button.
“Assume providers can fail. Think through what could go wrong. Verify the path to the intended outcome, and warn about possible unfavorable or unintended consequences before asking for a signature.”Token Studio engineering philosophy
The creator grew up in a hostile environment where vigilance was not an aesthetic, it was how mistakes were avoided. That instinct transferred into the app. The personal origin explains the standard, the safeguards below are the evidence.
Wallet-native signing
Signing remains inside Seed Vault, Phantom, or Solflare. Token Studio cannot access private keys or wallet credentials, because the connected wallet keeps them inside its own security boundary.
Local by default
User data and transaction history live on the device. Limited first-party telemetry explicitly excludes automatic wallet and transaction identifiers.
Danger should become visible before it becomes final
The most expensive wallet mistakes are usually a bad swap, the wrong recipient, a changed domain, or a fee that grows far beyond what the user expected. Token Studio checks those risks first.
Bad swaps are stopped
A projected value loss above 10% requires a separate confirmation. A loss of 20% or more terminates the swap and cannot be overridden.
Unfamiliar recipients are called out
Before sending, Token Studio warns when the connected wallet has never interacted with the recipient, or has interacted with it only once.
Domains are checked again
A Solana domain is resolved again immediately before sending. If it now points to a different address, the app stops and asks the user to review the change.
Recovery fees have a hard ceiling
Burn and Trim charge 0.8% of estimated SOL recovery, but never more than 0.01 SOL per transaction. If the recovery cannot be estimated safely, the percentage fee is zero.
Swap quotes visibly age before they are replaced
The quote dashboard moves from green to yellow to red as the quote ages from 3 to 9 seconds. After 3 seconds, pressing Swap refreshes the route and displays the new quote before that quote is used.
Before a batch burn begins
A selection can sit on screen while the wallet changes underneath it. Burner therefore rebuilds its understanding of the selected assets before creating the final transactions.
- Checks that the wallet still has enough SOL to pay network fees
- Downloads the wallet's current Legacy and Token-2022 token accounts
- Removes selected assets the wallet no longer owns
- Skips an “empty” account if it has received tokens since selection
- Skips frozen assets that cannot be burned
- Rejects invalid addresses and removes duplicate selections
- Confirms the current token account and asset standard
- Refreshes the accounts used to calculate recoverable SOL rent
- Stops if the recovery for required NFT metadata cannot be verified
- Fetches fresh compressed-NFT proofs and validates the Merkle tree
- Checks edition, master, and collection relationships and their current supply
- Burns editions before their master, then assets before their collection
- Packs the largest safe group into each transaction without crossing Solana's limits
- Shows the final transaction count and estimated SOL returned
The burn order matters. Destroying editions first can reduce their master's supply; destroying
children before their collection can reduce the collection size. That allows eligible parent accounts to close
later in the batch and recovers more SOL than processing the selection in an arbitrary order.
Your wallet signs. Token Studio does not.
Token Studio prepares and sends the requested operation, but approval remains with the connected wallet.
1. BuildToken Studio constructs the requested operation
2. RequestThe transaction is sent to the connected wallet
3. ReviewThe connected wallet presents it for review and approval
4. SignThe wallet signs without exposing its private key
Seed Vault native
On Solana Mobile devices, transaction approval uses the wallet's hardware-backed Seed Vault security boundary.
Authority-aware controls
Ownership alone does not grant every permission. The app distinguishes update, staking, withdrawal, collection, delegate, and lookup-table authorities before offering actions.
Inspection without signing authority
Paste any valid public Solana address to inspect its public on-chain footprint without connecting that wallet.
Deep public-wallet intelligence
Explore holdings, portfolio estimates, Wallet Health, staking positions, approvals, Flight History, domains, lookup tables, Merkle trees, and asset details.
A hard capability boundary
Read-only sessions cannot send, swap, stake, burn, mint, edit, delegate, or perform another action requiring a signature.
Follow evidence without changing accounts
A recipient or counterparty found in Flight History can be opened directly as a read-only portfolio, keeping an investigation inside Token Studio without connecting another wallet.
Independent does not mean pretending the internet has no dependencies
Token Studio does not operate a backend that holds keys, authorizes wallets, or relays ordinary transactions. Signing remains inside the connected wallet, and basic transactions can be submitted through a Solana RPC. Helius, Alchemy, Jupiter, and other external services are still important to much of the app, and losing them would significantly reduce its functionality.
What does not require a Token Studio server
- Wallet connection and local signing
- Construction of basic transactions on the device
- Direct Solana RPC communication
- Basic transfers through public Solana infrastructure
Functionality that depends on service providers
- Helius, Alchemy, or other RPC/indexing services
- Jupiter routes, token metadata, and prices
- Binance, Bybit, and Birdeye market data
- Irys and IPFS storage services
If one of these providers is unavailable, the affected discovery, pricing, media, history,
signal, or swap feature may become incomplete or unavailable. Token Studio can retain a basic connection to
Solana without its full feature set being available.
Privacy means describing the boundary honestly
Token Studio has no user-account system. It cannot access wallet credentials because they remain protected by the connected wallet. It does use limited first-party telemetry and selected server-assisted features, but those are not essential.
Automatic reports exclude
- Wallet public addresses
- Asset addresses
- Transaction signatures
- Wallet balances
- Private keys and seed phrases
- User-authored content
Telemetry may include
- Random or hashed installation identifier
- App version, locale, and distribution channel
- Network and connection status
- Operation type and sanitized errors
- Collector status
- IP address and approximate country visible server-side
Feedback is different from automatic diagnostics: a wallet address or other personal detail is
transmitted if the user explicitly writes it into a feedback message. Read the complete Privacy Policy and telemetry disclosure.
Security and privacy questions
Can Token Studio see my seed phrase?
No. Token Studio cannot access a seed phrase, private key, or wallet authentication credential, even if it wanted to, because that information remains protected inside the connected wallet.
Does “local signing” mean Token Studio signs by itself?
No. Token Studio constructs the request; the connected wallet presents it for approval and performs the signature inside its own security model.
Does the app work if Token Studio's server disappears?
Yes.
Is telemetry completely anonymous?
It is intentionally limited and automatic reports exclude wallet and transaction identifiers, but “anonymous” should not be interpreted as zero technical data. A server can receive an IP address, approximate country, and a random or hashed installation identifier.
Is a read-only wallet completely private?
The address and its blockchain activity are already public. Read-only means the session receives no signing authority; RPC and data providers can still observe the public address requested by the device.
Trust should be inspectable
Connect only when you need authority. Preview before signing. Use read-only mode when observation is enough.