What TruScan does
TruScan reads public data from the Solana blockchain for the contract you paste and shows it to you. You don’t sign up, and TruScan never asks you to connect a wallet.
Contact TruScan
TruScan is operated privately in Norway. For questions, privacy requests or scan corrections, email contact@truscan.dev.
Never send seed phrases, private keys or sensitive documents.
What we process
The contract you scan
We look it up on the public Solana blockchain through our data provider, Helius (with the public Solana RPC as a fallback), and fetch its market numbers and logo from DEX Screener. For traded tokens without a DEX Screener logo, Helius reads the token’s metadata and its image service fetches the picture; our server never visits the token’s own links.
Core scan results are reusable for two minutes; partial results have shorter cache windows. Vercel may serve a previous result for up to five further minutes while refreshing it. Website scan results are not stored in a TruScan database; TruScan Bot on Telegram has separate temporary delivery storage, described below.
A pool link you submit
For a Solana DEX Screener pool link, or when you choose “Look up pool tokens”, our server sends only the pool address to DEX Screener. Your pasted URL and referral parameters are not forwarded. The response is cached briefly. No token scan runs until you choose a token, and this lookup does not load an external chart.
Deep Dive reads you request
These run only when you choose them. Our server reads public transaction and wallet addresses through its Solana RPC provider. Results keep their original observation times and are cached for up to five minutes for launch activity, thirty minutes for funding and fifteen minutes for creator history. Creator-history market caps use a batch of public mint addresses sent to DEX Screener.
For wallets funded through the Relay bridge, our server reads public block, deposit-log and transaction records from Robinhood Chain’s RPC. Your IP address is not forwarded to these providers. If the optional Relay lookup is enabled, public bridge-request identifiers and recipient wallet addresses are also sent to Relay’s API.
Your IP address
Our host, Vercel, receives every request and may retain request and security logs, including your IP address and the requested URL. Retention depends on the host’s account settings and service terms.
TruScan uses your IP address to limit scan requests from a visitor network or address within each server instance. The rate limiter keeps a keyed hash in bounded server memory, not the IP address itself. Activity windows are one minute; expired entries are removed during later requests or when the function instance ends.
TruScan’s own page
We do not add account registration, advertising cookies, analytics or tracking pixels. Third-party charts and sites have their own policies.
TruScan Bot on Telegram
TruScan Bot (@TruScanTBot) processes token-check commands in private chats. In groups it handles its own join event and /start or /help to show a public welcome and a link to private chat. Other group conversation is ignored by our handler; Telegram may still deliver service messages, commands or additional messages depending on the bot’s group permissions. The bot needs no administrator privileges. Commands use TruScan’s existing checks and do not send your messages to an AI provider.
Temporary delivery jobs are stored in our Supabase database in Ireland. They can contain the private or group chat ID, a keyed user or group identifier, the requested token address for a private scan and a prepared reply. Group welcome jobs do not retain the inviter’s identity. We do not store whole conversations or Telegram profile names. Completed jobs clear those fields; delivery receipts and temporary usage counters help prevent duplicate work and excessive requests.
Outages or a paused database can delay cleanup; provider backups and logs follow separate retention settings. Telegram receives bot replies and processes your use of its app under its own policy. Vercel and Supabase process the service data necessary to operate the bot. You can stop sending commands or block the bot at any time, and contact TruScan about retained data.
Your watchlist and preferences
Tokens you save, your two most recent scan observations, your chart setting and your light or dark theme choice are stored only in your browser. Your saved list stays in this browser; scans and market refreshes send only token addresses. Clearing your browser data removes them.
Watchlist exports contain saved token addresses, names and save times; imports merge those tokens without importing scan results. Files stay on your device unless you share them. When you open the watchlist, the page asks our server for each saved token’s market numbers, the same way a scan does; the list itself stays in your browser. Checks update only when you request a scan.
Creator previews use names from the creation records or the existing DEX Screener batch. Pictures for up to five displayed launches load through TruScan’s logo endpoint, with the same server-side providers described above. Opening a preview does not run a full scan. Wallet links contact pump.fun or Solscan only when you follow them.
The price chart
Charts are off by default. Choosing “Load chart” connects your browser directly to DEX Screener, which receives your IP address and may use cookies or other tracking technologies under its privacy policy (opens in a new tab).
You may enable remembered automatic loading in this browser. Turn that option off, or choose “Hide chart & forget choice”, to remove the chart and stop future automatic loads. Old automatic defaults are not reused. If browser storage is blocked, charts stay off by default and a new choice lasts only for that visit.
Bubblemaps and external links
“Open this token on Bubblemaps” opens v2.bubblemaps.io in a new tab. Nothing is sent to Bubblemaps until you click it; after that, Bubblemaps handles your visit under its own privacy policy. Links to Solscan work the same way.
Sharing and report downloads
Downloaded scan images and report files are made in your browser from the scan on screen; nothing is uploaded.
Public scan links also provide a dated preview image for messaging and social platforms. Our server generates that image using the existing scan endpoint; it can run a core scan if no reusable result exists. These images contain public token data, no watchlist or visitor identity. TruScan reuses them briefly; the platform may keep its own copy for longer.
Telegram opens only when you click it, with the link and a suggested message you can edit. TruScan loads none of its scripts and never posts for you.
Who handles what
| PROVIDER | ROLE | WHAT IT RECEIVES |
|---|---|---|
| Vercel | Hosts TruScan and runs its servers. | Every request, including your IP address and requested URL. May process data outside Norway and the EEA, including in the USA. |
| Helius+ public Solana RPC when needed | Answers our blockchain lookups. | Public contracts, wallets and transaction identifiers from TruScan’s server, with our provider account where applicable. Not your IP address. |
| Robinhood Chain RPC | Records for bridge-funded wallets. | Public block, deposit-log and transaction lookups, through our server. |
| DEX Screener | Market numbers, token logos and the chart. | Token and pool addresses through our server. Your browser connects directly only after you load the chart or remember automatic loading. |
| Relayoptional | Resolves public bridge requests when the operator enables that lookup. | Public recipient addresses and request identifiers, through our server. |
| SupabaseIreland | Temporary delivery storage for TruScan Bot on Telegram. | The delivery-job fields described under TruScan Bot on Telegram. |
| Bubblemaps, Solscan | External sites. | Only see you if you follow a link to them. |
Storage and your choices
How long TruScan and its host may reuse a response:
| DATA | APP MEMORY | VERCEL CDN |
|---|---|---|
| Market data | 15 s | 15 s, +30 s while refreshing |
| Pool lookups | 1 min | 1 min, +30 s while refreshing |
| Logos | 10 min | 7 days, +1 day while refreshing Missing logo: 1 h |
| Core scan results | 2 min Partial: shorter | Previous result up to 5 more min while refreshing |
| Deep Dive | Launch 5 min Funding 30 min Other tokens 15 min Partial reads 1 min | — |
Expired in-memory entries can remain until cache cleanup, eviction or the server instance ends. Provider and hosting logs follow their separate retention settings.
Watchlist storage lasts until you remove tokens or clear this browser’s data. You can export your saved list, delete individual tokens and withdraw remembered chart loading at any time.
Your privacy rights
Where the GDPR applies, you can request access, correction, deletion or restriction of personal data we process. You can object to processing based on legitimate interests; portability and withdrawal of consent apply where their conditions are met. Contact TruScan so we can identify the relevant processing. We cannot change or erase the underlying public blockchain records.
You may complain to Datatilsynet (opens in a new tab), Norway’s data protection authority, or your local supervisory authority. TruScan shows automated observations; it does not make decisions about your legal rights or access to credit, employment or services.
Not financial advice
TruScan shows automatic checks on public blockchain data. It never tells you to buy or sell. Check the source records before you decide.