# Contractless Web3 Wallet Privacy Policy

Effective date: August 2, 2026

Contractless Web3 Wallet is a browser extension for creating and managing
Contractless blockchain wallets, connecting to compatible Web3 applications,
and reviewing, signing, and broadcasting Contractless transactions.

## Information Contractless Does Not Collect

Contractless Web3 Wallet does not include advertising, analytics, telemetry,
tracking, or behavioral profiling. The developer does not collect or sell:

- names, email addresses, telephone numbers, or other identifying information;
- browsing history or general website activity;
- health information;
- personal communications;
- precise or approximate location information; or
- wallet encryption keys or private keys.

## Information Processed Locally

The wallet must process financial and authentication information to provide its
requested functionality. This processing occurs locally inside the browser
extension and does not make the information available to the developer.

Locally processed information may include:

- encrypted Contractless wallet files;
- wallet addresses, public keys, and vanity addresses;
- private keys and wallet encryption keys while the wallet is unlocked;
- balances, assets, NFTs, RWAs, loans, and transaction history;
- unsigned and signed Contractless transactions;
- website connection approvals and temporary application access keys; and
- wallet labels, network selection, API endpoints, and automatic-lock settings.

Private keys are encrypted before being placed in persistent extension storage.
Decrypted private keys exist only while the wallet is unlocked. Locking the
wallet clears decrypted wallet material and expires active website sessions.

## Contractless API Communication

The extension communicates with the Contractless API selected in the wallet's
settings. Testnet defaults to `https://api.contractless.dev`. Users may replace
the API endpoint, and mainnet uses a separately configured endpoint.

The extension sends only the information required to perform a user-requested
blockchain operation. Depending on the request, this may include:

- a wallet address, public key, and authentication signature;
- an address, asset identifier, transaction identifier, or block identifier
  required for a blockchain lookup; or
- a complete signed transaction submitted for validation and broadcast.

Private keys and wallet encryption keys are never sent to a Contractless API,
website, blockchain node, or the extension developer.

An API endpoint chosen by the user is operated independently and may have its
own privacy and logging practices. Users should only configure API endpoints
they trust.

## Website Connections

Contractless-compatible websites may request access to the wallet through the
Contractless Web3 provider. A website does not receive the active wallet address
until the user explicitly approves its connection request.

After approval, the website receives a temporary access key associated with
that website, application identifier, wallet, and unlock session. The access
expires when the wallet locks or the user disconnects the application.

Websites may request message signatures or transactions. The wallet displays
the request for review and requires user approval before signing. A connected
website receives only the address, signatures, transaction information, and
other results required to complete the approved request. Websites never receive
the wallet private key or encryption key.

Contractless does not control third-party websites. Their handling of
information received after user approval is governed by their own privacy
policies.

## Browser Permissions

Contractless Web3 Wallet uses the following browser permissions:

- **Storage:** Stores encrypted wallets, wallet settings, labels, and temporary
  application sessions.
- **Alarms:** Enforces the user-configured automatic wallet lock timeout.
- **Clipboard write:** Copies information only after the user selects a copy
  action, such as copying an address or transaction identifier.
- **Host access:** Makes the Contractless provider available to compatible
  websites and communicates with the configured Contractless API. The extension
  does not read or collect general webpage content.

## Data Retention and Deletion
