96 lines
4.2 KiB
Markdown
96 lines
4.2 KiB
Markdown
# Contractless Web3 Wallet Privacy Policy
|
|
|
|
Effective date: August 2, 2026
|
|
|
|
Contractless Web3 Wallet is a browser extension for creating and managing
|
|
Contractless blockchain wallets, connecting to compatible Web3 applications,
|
|
and reviewing, signing, and broadcasting Contractless transactions.
|
|
|
|
## Information Contractless Does Not Collect
|
|
|
|
Contractless Web3 Wallet does not include advertising, analytics, telemetry,
|
|
tracking, or behavioral profiling. The developer does not collect or sell:
|
|
|
|
- names, email addresses, telephone numbers, or other identifying information;
|
|
- browsing history or general website activity;
|
|
- health information;
|
|
- personal communications;
|
|
- precise or approximate location information; or
|
|
- wallet encryption keys or private keys.
|
|
|
|
## Information Processed Locally
|
|
|
|
The wallet must process financial and authentication information to provide its
|
|
requested functionality. This processing occurs locally inside the browser
|
|
extension and does not make the information available to the developer.
|
|
|
|
Locally processed information may include:
|
|
|
|
- encrypted Contractless wallet files;
|
|
- wallet addresses, public keys, and vanity addresses;
|
|
- private keys and wallet encryption keys while the wallet is unlocked;
|
|
- balances, assets, NFTs, RWAs, loans, and transaction history;
|
|
- unsigned and signed Contractless transactions;
|
|
- website connection approvals and temporary application access keys; and
|
|
- wallet labels, network selection, API endpoints, and automatic-lock settings.
|
|
|
|
Private keys are encrypted before being placed in persistent extension storage.
|
|
Decrypted private keys exist only while the wallet is unlocked. Locking the
|
|
wallet clears decrypted wallet material and expires active website sessions.
|
|
|
|
## Contractless API Communication
|
|
|
|
The extension communicates with the Contractless API selected in the wallet's
|
|
settings. Testnet defaults to `https://api.contractless.dev`. Users may replace
|
|
the API endpoint, and mainnet uses a separately configured endpoint.
|
|
|
|
The extension sends only the information required to perform a user-requested
|
|
blockchain operation. Depending on the request, this may include:
|
|
|
|
- a wallet address, public key, and authentication signature;
|
|
- an address, asset identifier, transaction identifier, or block identifier
|
|
required for a blockchain lookup; or
|
|
- a complete signed transaction submitted for validation and broadcast.
|
|
|
|
Private keys and wallet encryption keys are never sent to a Contractless API,
|
|
website, blockchain node, or the extension developer.
|
|
|
|
An API endpoint chosen by the user is operated independently and may have its
|
|
own privacy and logging practices. Users should only configure API endpoints
|
|
they trust.
|
|
|
|
## Website Connections
|
|
|
|
Contractless-compatible websites may request access to the wallet through the
|
|
Contractless Web3 provider. A website does not receive the active wallet address
|
|
until the user explicitly approves its connection request.
|
|
|
|
After approval, the website receives a temporary access key associated with
|
|
that website, application identifier, wallet, and unlock session. The access
|
|
expires when the wallet locks or the user disconnects the application.
|
|
|
|
Websites may request message signatures or transactions. The wallet displays
|
|
the request for review and requires user approval before signing. A connected
|
|
website receives only the address, signatures, transaction information, and
|
|
other results required to complete the approved request. Websites never receive
|
|
the wallet private key or encryption key.
|
|
|
|
Contractless does not control third-party websites. Their handling of
|
|
information received after user approval is governed by their own privacy
|
|
policies.
|
|
|
|
## Browser Permissions
|
|
|
|
Contractless Web3 Wallet uses the following browser permissions:
|
|
|
|
- **Storage:** Stores encrypted wallets, wallet settings, labels, and temporary
|
|
application sessions.
|
|
- **Alarms:** Enforces the user-configured automatic wallet lock timeout.
|
|
- **Clipboard write:** Copies information only after the user selects a copy
|
|
action, such as copying an address or transaction identifier.
|
|
- **Host access:** Makes the Contractless provider available to compatible
|
|
websites and communicates with the configured Contractless API. The extension
|
|
does not read or collect general webpage content.
|
|
|
|
## Data Retention and Deletion
|