Privacy Policy

Who this covers

This policy applies to the Wonder Wallet browser extension and the Wonder Wallet web app ("Wonder Wallet", "the wallet", "we"). Wonder Wallet is self-custodial: you, and only you, hold your keys.

Data we do NOT collect

We do not collect or have access to any of the following:

• Your private keys, seed phrase, or password — these are generated and encrypted (Argon2id + AES-GCM) locally in your browser and never transmitted anywhere.
• Personal information — no name, email, phone number, or account is required or collected.
• Analytics, behavioral tracking, advertising identifiers, or cookies for tracking.
• Your balances or transaction history tied to your identity — we store none of it.

How your keys are handled

• Keys are created and used entirely on your device. Transactions are signed locally (or, with a hardware wallet, on the device itself).
• Your encrypted wallet is stored in your browser's local storage on your machine. It never leaves it.
• When you use a hardware wallet (Ledger), keys stay on the device; Wonder Wallet only reads public addresses and builds transactions for you to approve on-device.

Public blockchain data we read

To show your balances and assets and to broadcast transactions, the wallet reads public blockchain data through a stateless proxy and public providers (for example mempool.space, Counterparty Core, stampchain, and public RPC endpoints). In doing so:

• Only public information is requested — such as the balance of a public address you are viewing. This is the same information anyone can look up on a block explorer.
• The proxy is a stateless reader: it forwards these public reads and caches responses briefly (about 30 seconds) to reduce load. It stores no keys, no personal data, and no identity-linked records.
• These third-party providers may process the request (e.g. an address lookup) under their own privacy policies. We do not send them any personal data or keys.

No sale or sharing of data

Because we do not collect personal data, we have nothing to sell or share. We do not sell data, and we do not share personal data with advertisers or data brokers.

Permissions the extension requests

• storage — to save your encrypted wallet and preferences locally on your device.
• alarms — to run the idle auto-lock timer.
• sidePanel — to let the wallet open in the browser's side panel.
• Access to the wallet's own proxy host — to read public blockchain data and broadcast the transactions you sign. The extension does not read or modify the web pages you visit.

Children

Wonder Wallet is not directed to children and does not knowingly collect data from anyone, including children under 13.

Changes to this policy

If this policy changes, we will update the "Last updated" date above. Material changes will be reflected in the extension's listing.

Contact

Questions about privacy or security? Please reach out through the project's GitHub repository. For security vulnerabilities, follow the responsible-disclosure process in our SECURITY.md.