How it works
A token launchpad on Solana that gives creator trading fees a job: they become money on a card you can spend in the real world.
- Launch. Your coin deploys onchain. At launch you name the cardholder. That name is locked permanently, enforced by a database trigger, not just the interface — nobody can later point your coin's fees at someone else's card.
- Trade. People buy and sell your coin on pump.fun. Creator fees accrue in SOL in a fee vault belonging to a creator wallet derived for your coin alone, so the balance is yours by construction.
- Sweep. Every 15 minutes the executor collects those fees, swaps them to USDC on Jupiter, and settles the USDC to the card balance. Below the minimum sweep it skips, so transaction fees never eat the fee.
- Issue, then top up. The first sweep whose settled amount clears the issue minimum creates the card. Every later sweep tops the same card up. A coin that never trades never costs an issuing fee.
- Spend. Use the card anywhere the issuer's network is accepted. Authorisations are pulled back within a minute and published next to the fees that paid for them.
- Receipt. Every run publishes what it claimed, what it settled, what it loaded, the balance after and every transaction hash. Public for every coin.
- Dashboard. From your launch wallet you can reveal the card number, freeze it, or close it. You cannot change the cardholder.
Where the money is at each step
| on the curve | creator fees accruing in SOL, not yet collected |
| creator wallet | collected SOL, for your coin only, forwarded to the ops wallet in the same run |
| ops wallet | in-flight only: it claims, swaps and settles in one sweep and is designed never to hold a balance between runs |
| card balance | settled USDC. The amount attributed to your coin but not yet loaded is shown as waiting on your coin page |
| the card | spendable balance at the issuer |
Guardrails and risk
- The cardholder is locked at launch by a database trigger, checked on every update.
- A minimum load, a per-sweep cap and a lifetime cap per card. Anything a cap holds back is kept as waiting and loaded by a later sweep — never dropped.
- The executor never calls a load the issuer account cannot cover. If the float runs out, the money waits and a receipt says so.
- A frozen card still collects fees; they are held and loaded once it is active again. A closed card stops receiving loads entirely.
- The operations wallet holds funds only while a sweep is in flight. A kill switch pauses all sweeps without losing state, and unfinished sweeps resume where they stopped.
- Pillow is not a bank. Cards are issued and balances held by a third-party issuer under its own terms, and acceptance is up to the merchant. A card is funded only by the fees your coin actually earns; no amount and no return is promised.
What is public and what is not
Public pages show the cardholder name, the last four digits, amounts loaded and spent, and merchant names. They never show the card number, expiry, CVV, your email or your date of birth.
The card number is returned by one route, POST /dev/card, only to a live signature from the launch wallet. It is sent with no-store, is never written to the database and never appears in a log or a receipt.
Security: what this site asks your wallet
Pillow never asks for token approvals, permits, spend allowances or setApprovalForAll. There is no hidden transaction. The complete list of wallet requests the site can make:
| eth_requestAccounts | connect, only when you click Connect wallet |
| signMessage | sign a plain text message starting with pillow to prove you own the launch wallet. Signing costs nothing and moves nothing. |
| signAndSendTransaction | your opening buy on the launch page: spends the SOL you typed on your own coin, on pump.fun. Nothing else, ever. |
| wallet_revokePermissions | when you click Disconnect |
Public API
| GET /tokens | all coins with their card state |
| GET /tokens/:id | one coin: card, fees, schedule, spending and balance snapshots |
| GET /spend/:token | real-world card transactions for a coin |
| GET /receipts/:token | receipts for a coin, newest first |
| GET /api/health | halted state, minimums, totals across all cards |
| POST /launch | launch a coin with a locked cardholder |
| POST /dev/:action | coins · status · sweeps · spend · card · freeze · unfreeze · terminate, signed by the launch wallet |
Unauthenticated reads are cached for 30 seconds; /dev/* is never cached. Chain: Solana mainnet-beta. Launchpad: pump.fun. Settlement asset: USDC. Card currency: USD.
Security contact: @PillowDotFun.