Privacy policy.
What the extension sends, what stays on your device, and what we never touch.
[NOTE]Draft. This policy takes effect when the closed beta opens. Retention periods below are proposals and can change before then. If they do, this page changes first.
Scene 1Short version
- We never see your recovery phrase or private keys, and we never sign anything.
- When you sign, the extension sends three things to check the transaction: the site's domain, the unsigned transaction and your public wallet address.
- Your check history and settings stay in the browser on each device. There is no account and no sync.
- No ads, no selling data, no tracking of the sites you visit.
Scene 2What the extension sends
Only when a site asks your wallet to sign something. One request per check:
jup-ag.claim-rewards.app. Not the full URL, not the page. Used to check its age and our blocklists.We keep these for up to 30 days to fix false alarms and improve rules, then delete them. They aren't linked to a name, an email or any account.
Scene 3What stays on your device
- Your history of checks, your settings and the sites you marked as trusted.
- Blocklists of known phishing domains. The extension downloads them about once an hour and compares sites locally, so the sites you visit aren't sent to us for this.
Removing the extension removes this data.
Scene 4Pages that look like scams
Planned for a later version. When a page shows signs of a scam (a fake airdrop, a “sync your wallet” form) and isn't on any list, the extension may send its visible text for a second opinion, including to a language model provider. Text you type into fields is never included.
Scene 5Beta sign-up and reports
To get the beta you give us an email. We keep it until the beta ends or you ask us to delete it, and use it only to send the download link and beta news. No newsletter, no sharing. Scam reports are kept as long as the reported site or address matters for protection. A contact in a report is optional.
Scene 6Who else sees data
- An RPC provider runs the simulation, so it receives the transaction and your public address.
- A language model provider (Anthropic) may receive the details of unusual cases to write an explanation in plain words. It never receives keys, because we never have them.
- Our hosting provider (Vercel) stores the data listed above.
- This site loads its fonts from Google Fonts.
Scene 7What we never do
- Ask for, store or see your recovery phrase or private keys.
- Sign or send transactions for you.
- Sell data, show ads or let anyone pay to be marked as safe.
- Record your browsing history or the full URLs you visit.
Scene 8Your choices
You can turn off the one-line summaries for normal transactions, mark sites as trusted, or remove the extension at any time. To delete what we hold about you, write to us. A contact address will be listed here before the beta opens.