Kasmos Wallet

Privacy Policy

Last updated: May 30, 2026

Kasmos Wallet (the “Wallet,” “Extension,” “we,” “us”) is a non‑custodial, self‑hosted browser wallet for the Kaspa network and KCC20 tokens, part of the Kasmos suite. This policy explains exactly what the Wallet does — and does not do — with your information.

In short: We run no accounts, no servers that collect your personal data, and no analytics. Your keys, wallet data, and settings stay on your device. The Wallet contacts only public blockchain infrastructure (a Kaspa node and a KCC20 indexer) so it can show your balances and broadcast the transactions you approve.

1.We do not collect personal data

There is no sign‑up, no user account, and no developer backend that stores information about you. The Extension contains no analytics, telemetry, advertising, cookies, or third‑party tracking SDKs of any kind. We do not build profiles of you and we do not track your browsing.

2.Data the Wallet stores — locally, on your device

The following is stored only in your browser’s local extension storage (chrome.storage.local), on your own computer. None of it is transmitted to us:

• Encrypted key vault — your seed phrase and/or private keys, encrypted with AES‑GCM using a key derived from your password. The vault is decrypted only momentarily, inside an isolated extension document, to sign a transaction you have approved. Your password, seed phrase, and private keys are never sent off your device and never travel over the network.
• Account metadata — the public addresses, public keys, and account names/labels you create.
• Local transaction history — records of transactions you submit from the Wallet, kept so the Wallet can show your recent activity.
• Settings — your chosen Kaspa node (RPC) and indexer endpoints, and the auto‑approve preference (which is off by default).
• Connected‑site list — the origins (e.g. https://example.com) of the websites you have connected the Wallet to, so it can recognize them.

You can erase this at any time by removing accounts within the Wallet or by uninstalling the Extension; uninstalling deletes the local storage. Your seed phrase is your only backup — we cannot recover it or your funds for you.

3.Network connections the Wallet makes

To work, the Wallet connects to public blockchain infrastructure. It sends only the information needed to read the chain and broadcast transactions you approve — never your keys, seed phrase, or password:

• Kaspa node (wRPC over WebSocket) — to read balances/UTXOs and broadcast signed transactions. By default this is the project’s node; you can change it to any node, including your own, in Settings.
• KCC20 indexer (HTTP API) — to list your KCC20 token holdings and to assemble covenant transactions. The endpoint is configurable in Settings.

As with any internet service, these endpoints necessarily receive your IP address and the request data needed to answer you — for example, the address or public key whose balances/holdings you are viewing, and the signed transactions you choose to broadcast. When you use the default endpoints, they are operated by us or our infrastructure providers; we do not use this request data to build advertising or identity profiles, and we do not sell it. If you prefer, you can point the Wallet at your own node and indexer.

Public‑blockchain note: Kaspa is a public ledger. Any transaction you broadcast — and the addresses involved — becomes a permanent, public part of the blockchain, visible to anyone and outside our control.

4.Connecting to websites (dapps)

When you choose to connect the Wallet to a website, and only after you approve the request, that website can see your public wallet address and public key. It cannot see your seed phrase, private keys, or password. The Extension injects a connection interface (window.krc20) into web pages so they can request a connection or ask you to approve a transaction; it does not read, collect, or transmit the content of the pages you visit. Every signature or transaction a website requests is shown to you for explicit review and approval before anything is signed.

5.Permissions the Extension requests, and why

• Storage — to keep your encrypted vault and settings on your device.
• Side panel — to display the Wallet’s interface.
• Offscreen document — to run the cryptographic signer in an isolated context, so your decrypted keys never touch a web page.
• Access to websites (http://*/*, https://*/*) — so the connection interface can be offered to dapps on whatever site you choose to use. This access is used solely to provide that interface and relay messages you initiate; it is not used to monitor your browsing.

6.Data sharing and selling

We do not sell, rent, or trade your information, and we do not share it with third parties for their own purposes. We serve no advertising. The only data that leaves your device is the blockchain request data described in Section 3, sent to the node/indexer endpoints you have configured, solely to operate the Wallet. Our handling of data is consistent with the Chrome Web Store User Data Policy, including its Limited Use requirements.

7.Security

Your keys are encrypted at rest with AES‑GCM and are only ever decrypted inside an isolated extension context — never inside a web page. We never receive your password or seed phrase. No software is perfectly secure, however: you are responsible for safeguarding your password and seed phrase and for the devices on which you run the Wallet. Anyone who obtains your seed phrase can control your funds.

8.Children

The Wallet is not directed to children under the age of 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect data from them.

9.Changes to this policy

We may update this policy as the Wallet evolves. Material changes will be marked with a new “Last updated” date and published with the Extension. Your continued use of the Wallet after an update constitutes acceptance of the revised policy.

10.Contact

Questions about this policy or your privacy: kasmoslabs@gmail.com