Privacy Policy

Last Updated: May 2026

Chrome Web Store User Data Policy Compliance

DenVault adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Specifically:

We do not collect or transmit user data to DenVault-owned servers. The extension communicates with third-party blockchain APIs (Hiro / Stacks nodes) to fetch balances and broadcast signed transactions.
All sensitive data (seed phrases, keys) remains locally on the user's device.
We do not sell, share, or transfer user data to third parties.
We do not use user data for advertising or marketing purposes.
We do not use user data for creditworthiness or lending purposes.

Overview

DenVault is a browser extension that enables users to manage Stacks blockchain wallets, view token balances, and authorize transactions for decentralized applications (dApps).

      Privacy Summary (TL;DR)
      Local Storage Only: Your seed phrase is stored in an encrypted vault (AES-256-GCM) on your device. We never have access to it.
Third-Party Queries: We only query Hiro API and Stacks nodes to fetch your balance and transaction history. Only your public wallet addresses are sent (no private data).
No Data Sales: We do NOT sell, share, or monetize any user data. Period.
No Tracking: We do NOT track your browsing history or behavior across websites.

    

Data Storage

The following data is stored locally on your device using Chrome's secure storage API:

Data Type	Storage Location	Encryption
Mnemonic seed phrase	chrome.storage.local (local only)	AES-256-GCM with PBKDF2
Wallet addresses	chrome.storage.local (local only)	Not encrypted (public data)
Network preferences	chrome.storage.local (local only)	Not encrypted
Transaction history	Not stored	Fetched on-demand

Encryption Details

Your seed phrase is protected using industry-standard encryption:

Algorithm: AES-256-GCM (authenticated encryption)
Key Derivation: PBKDF2 with SHA-256, 600,000 iterations (OWASP 2023)
Salt: 16 bytes, cryptographically random per wallet
IV: 12 bytes, cryptographically random per encryption

External Communications

The extension communicates only with the following services:

Service	Purpose	Data Sent
Hiro Stacks API (api.hiro.so)	Fetch blockchain data	Wallet addresses only (public)
Stacks blockchain nodes	Broadcast transactions	Signed transaction data
blockstream.info, falling back to mempool.space	Fetch Bitcoin balances, UTXOs and fee estimates	Wallet addresses only (public)

No personal information is transmitted in these requests.

Permissions Used

Permission	Purpose
storage	Store encrypted wallet data locally
sidePanel	Provide persistent wallet view option
clipboardRead	Paste a recipient address, a token contract identifier or a recovery phrase, only when you press Paste

Host Permissions

The extension declares host permissions for the official Stacks blockchain API endpoints:

api.hiro.so - Stacks mainnet blockchain API (balance queries, transaction broadcasts)
api.testnet.hiro.so - Stacks testnet blockchain API (for developers)

The wallet also holds Bitcoin, and reads Bitcoin balances, UTXOs and fee estimates from a public block explorer API. These are CORS requests, so they need no host permission, but the extension does contact them and they are listed here for that reason:

blockstream.info - Bitcoin balances, UTXOs and fee estimates
mempool.space - the same queries, used only when blockstream.info cannot be reached

Every one of these requests carries only public blockchain addresses and signed transactions. No personal data, no recovery phrase and no private key is ever sent.

dApp connectivity is handled via content scripts that inject a minimal relay for standard WBIP wallet communication. The content script does NOT access or modify page content.

Single Purpose Declaration

This extension's single purpose is to enable users to manage Stacks blockchain wallets and interact with decentralized applications. The extension:

Does NOT read or collect browsing history
Does NOT track user behavior across websites
Does NOT inject content unless the user initiates a wallet connection
Only responds to explicit wallet RPC requests from dApps
Requires user confirmation for all transactions

What We Do NOT Do

We do NOT collect analytics or telemetry
We do NOT track your browsing history
We do NOT share any data with third parties
We do NOT store your seed phrase on any server
We do NOT have access to your wallet or funds
We do NOT use your data for advertising

Data Deletion

You can delete all wallet data at any time:

Open the extension
Go to Settings (menu icon)
Select "Delete Wallet"

This permanently removes all stored data from your browser.

Open Source

This extension is open source. You can review the code at:
GitHub Repository

Contact

For privacy concerns or questions:
Email: wolfcito.learn+privacy@gmail.com

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date.