143 lines
6.1 KiB
Markdown
143 lines
6.1 KiB
Markdown
# Contractless Web3 Wallet Privacy Policy
|
|
|
|
Effective date: August 2, 2026
|
|
|
|
Contractless Web3 Wallet is a browser extension for creating and managing
|
|
Contractless blockchain wallets, connecting to compatible Web3 applications,
|
|
and reviewing, signing, and broadcasting Contractless transactions.
|
|
|
|
## Information Contractless Does Not Collect
|
|
|
|
Contractless Web3 Wallet does not include advertising, analytics, telemetry,
|
|
tracking, or behavioral profiling. The developer does not collect or sell:
|
|
|
|
- names, email addresses, telephone numbers, or other identifying information;
|
|
- browsing history or general website activity;
|
|
- health information;
|
|
- personal communications;
|
|
- precise or approximate location information; or
|
|
- wallet encryption keys or private keys.
|
|
|
|
## Information Processed Locally
|
|
|
|
The wallet must process financial and authentication information to provide its
|
|
requested functionality. This processing occurs locally inside the browser
|
|
extension and does not make the information available to the developer.
|
|
|
|
Locally processed information may include:
|
|
|
|
- encrypted Contractless wallet files;
|
|
- wallet addresses, public keys, and vanity addresses;
|
|
- private keys and wallet encryption keys while the wallet is unlocked;
|
|
- balances, assets, NFTs, RWAs, loans, and transaction history;
|
|
- unsigned and signed Contractless transactions;
|
|
- website connection approvals and temporary application access keys; and
|
|
- wallet labels, network selection, API endpoints, and automatic-lock settings.
|
|
|
|
Private keys are encrypted before being placed in persistent extension storage.
|
|
Decrypted private keys exist only while the wallet is unlocked. Locking the
|
|
wallet clears decrypted wallet material and expires active website sessions.
|
|
|
|
## Contractless API Communication
|
|
|
|
The extension communicates with the Contractless API selected in the wallet's
|
|
settings. Testnet defaults to `https://api.contractless.dev`. Users may replace
|
|
the API endpoint, and mainnet uses a separately configured endpoint.
|
|
|
|
The extension sends only the information required to perform a user-requested
|
|
blockchain operation. Depending on the request, this may include:
|
|
|
|
- a wallet address, public key, and authentication signature;
|
|
- an address, asset identifier, transaction identifier, or block identifier
|
|
required for a blockchain lookup; or
|
|
- a complete signed transaction submitted for validation and broadcast.
|
|
|
|
Private keys and wallet encryption keys are never sent to a Contractless API,
|
|
website, blockchain node, or the extension developer.
|
|
|
|
An API endpoint chosen by the user is operated independently and may have its
|
|
own privacy and logging practices. Users should only configure API endpoints
|
|
they trust.
|
|
|
|
## Website Connections
|
|
|
|
Contractless-compatible websites may request access to the wallet through the
|
|
Contractless Web3 provider. A website does not receive the active wallet address
|
|
until the user explicitly approves its connection request.
|
|
|
|
After approval, the website receives a temporary access key associated with
|
|
that website, application identifier, wallet, and unlock session. The access
|
|
expires when the wallet locks or the user disconnects the application.
|
|
|
|
Websites may request message signatures or transactions. The wallet displays
|
|
the request for review and requires user approval before signing. A connected
|
|
website receives only the address, signatures, transaction information, and
|
|
other results required to complete the approved request. Websites never receive
|
|
the wallet private key or encryption key.
|
|
|
|
Contractless does not control third-party websites. Their handling of
|
|
information received after user approval is governed by their own privacy
|
|
policies.
|
|
|
|
## Browser Permissions
|
|
|
|
Contractless Web3 Wallet uses the following browser permissions:
|
|
|
|
- **Storage:** Stores encrypted wallets, wallet settings, labels, and temporary
|
|
application sessions.
|
|
- **Alarms:** Enforces the user-configured automatic wallet lock timeout.
|
|
- **Clipboard write:** Copies information only after the user selects a copy
|
|
action, such as copying an address or transaction identifier.
|
|
- **Host access:** Makes the Contractless provider available to compatible
|
|
websites and communicates with the configured Contractless API. The extension
|
|
does not read or collect general webpage content.
|
|
|
|
## Data Retention and Deletion
|
|
|
|
Wallet information remains in browser extension storage until the user removes
|
|
it, clears the extension's storage, or uninstalls the extension. Temporary
|
|
website access information expires when the wallet locks or the application is
|
|
disconnected.
|
|
|
|
Contractless does not maintain a separate developer-controlled database of
|
|
extension wallets or user activity.
|
|
|
|
## Sharing and Sale of Information
|
|
|
|
Contractless does not sell user information. Information is not used for
|
|
advertising, credit decisions, behavioral profiling, or purposes unrelated to
|
|
the wallet's user-facing functionality.
|
|
|
|
Information is transmitted only when necessary to complete a user-requested
|
|
wallet operation, communicate with the configured Contractless API, or respond
|
|
to an explicitly approved website request.
|
|
|
|
The use of information by Contractless Web3 Wallet is limited to providing and
|
|
improving its disclosed wallet functionality. Information is not transferred
|
|
for advertising or other unrelated purposes, and humans are not permitted to
|
|
read private wallet information except when specifically requested by the user
|
|
for support, required for security, or required by law.
|
|
|
|
## Security
|
|
|
|
Contractless Web3 Wallet performs cryptographic operations locally using code
|
|
and WebAssembly bundled with the extension. API communication must use HTTPS,
|
|
except when a user deliberately configures a local development endpoint.
|
|
|
|
No system can guarantee absolute security. Users are responsible for protecting
|
|
their wallet images, private keys, encryption keys, devices, and configured API
|
|
endpoints.
|
|
|
|
## Changes to This Policy
|
|
|
|
This policy may be updated when wallet functionality or privacy requirements
|
|
change. Material changes will be reflected by updating this document and its
|
|
effective date.
|
|
|
|
## Contact
|
|
|
|
Questions or privacy concerns may be submitted through the Contractless Web3
|
|
Wallet repository:
|
|
|
|
https://contractless.dev/contractless/Contractless-Web3-Wallets
|