Privacy

Stored in this browser only

• the encrypted vault and the wallet's public metadata;
• your accounts list, saved contacts and watchlist;
• recent searches;
• display preferences and a cached market snapshot;
• a local log of TON Connect approvals.

None of this is transmitted anywhere. Clearing site data removes all of it, including the vault.

Sent to third parties

Looking something up sends the public address or hash you asked about to a TON indexer. Prices come from CoinGecko. Swap quotes go to STON.fi. Collectible images are loaded from an image proxy, which therefore sees that a browser requested them. Requests reach these providers with your IP address, as any web request does.

Your seed phrase, password, backup file and contact names are never sent to any of them.

Hosting

The site is served by Cloudflare Pages, which sees ordinary request metadata. Chain reads go through a small proxy on the same infrastructure so an API key can be kept server-side instead of shipped in the page.

Analytics

The app loads no third-party analytics, no session recording and no advertising tags. The content security policy blocks any script the host tries to inject, so no outside measurement beacon runs even if the hosting platform attempts one.

It does count its own usage: which screen was opened and which kind of action happened — a page view, a wallet created, a transfer signed, a swap quoted. That goes to the same server that proxies chain reads, not to anyone else.

What is deliberately absent from those counts: addresses, amounts, token and collection names, search terms, transaction hashes, and of course seed phrases and passwords. A page is recorded by its kind — address — never by its path, because the path of an address page is the address. The server checks every value against a fixed list and discards anything else, so a mistake in the app cannot put a new field into storage.

No cookie is set and no identifier is stored on your device or in the data. Repeat visits are counted with a hash of your IP address and browser mixed with a secret and the current date; the IP address itself is never written down, and tomorrow's date produces an unrelated hash, so nobody can follow a visitor from one day to the next. Turn the whole thing off in Profile → Usage data, or by switching on Do Not Track in your browser, which this app honours.

Within one day those events are also grouped under that same hash, so the operator can read a visit as a sequence — arrived from a search, opened the wallet — instead of only totals. The grouping is made of the same fixed event names and nothing else, and it dies with the hash: it cannot be joined to yesterday, to a wallet or to you.

Cloudflare also keeps the ordinary server-side request logs any hosted site produces.

There is one diagnostic mode, used while the app is being tested. It records only a fixed set of events — which screen was opened, the type of a search (address, transaction or domain, never the query itself), and whether a wallet was created, imported or unlocked. It never records addresses, amounts, transaction hashes, comments, seed phrases or passwords, and the page it happened on is stripped of any address or hash before anything is sent.

Its resting position is off for visitors: it records only a browser that has been given the operator's token by hand. The operator can switch it on for everyone during a test — a deliberate act with a visible control, not the default.

Telegram

Inside Telegram the app reads the client's theme and viewport so it looks native, and uses the client's back button and haptics. Telegram's own identity data is deliberately unused: it never unlocks a wallet or authorises a transfer.

Operator

The legal operator and a contact address are not published yet. This page will name them rather than a placeholder once they exist.