PARACYT Wallet is a Chrome browser extension developed and operated by Glewme Corp, a California C corporation (referred to as "we", "us", and "our" in this policy). "PARACYT Wallet" is the trade name of the wallet product. This policy applies to the PARACYT Wallet extension as distributed through the Chrome Web Store and to any directly-installed builds.
PARACYT Wallet's use of information received from any source, and PARACYT Wallet's transfer of information to any other application, complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Specifically:
By installing and using PARACYT Wallet, you consent to the data handling described in this policy. The wallet handles only the data necessary for its core functionality and only when you take an action that requires it. Wherever the wallet is about to share data with a third party as part of a transaction or connection, the wallet displays an explicit approval screen first; you can decline. You can withdraw consent at any time by uninstalling the extension, which removes all locally-stored wallet data from your device (see section 11).
This table maps the wallet's handling of data to the categories used in the Chrome Web Store user data disclosure. "Handled" includes any collection, storage, processing, or sharing; if a row says "No," it means the wallet does not collect, store, process, or share that category in any form.
| Data category | Wallet handles this category? |
|---|---|
| Personally identifiable information (real name, postal address, email address, government ID number, phone number, date of birth) | No. The wallet does not collect, request, store, transmit, or share any personally identifiable information. There is no account, signup, email collection, registration, or KYC. The wallet generates and operates entirely from a cryptographic seed you control. |
| Health information | No. |
| Financial and payment information (public wallet addresses, on-chain balances, transactions you broadcast) | Yes. Detailed in section 5.2. Used only for wallet functionality; never sold or shared for advertising or unrelated purposes. |
| Authentication information (master seed, private keys, password) | Yes — handled entirely on your device. Detailed in section 5.1. Encrypted with your password, stored only on your device, never transmitted, never accessible to Glewme Corp. |
| Personal communications (emails, SMS, chat messages) | No. |
| Location (precise location, IP-based location) | No. The wallet does not request, collect, store, or transmit location data. Third-party network services that the wallet contacts (blockchain RPC nodes, DEX aggregators) will independently observe the IP address of your network request as part of normal internet operation; Glewme Corp does not log or store IP addresses from your interactions with the extension or with the PARACYT backend. |
| Web history (browsing history, page visits, URLs visited) | No. The wallet does not read, record, or transmit which web pages you visit. |
| User activity on web pages (clicks, mouse movement, scroll, form input, dwell time) | No. The wallet does not include analytics, telemetry, behavioral tracking, fingerprinting, advertising SDKs, or third-party tracking pixels of any kind. |
| Website content (text, photos, videos, files extracted from web pages) | No. The wallet does not read page content. The provider script that the wallet injects into pages only forwards messages between an explicitly-approved page and the wallet's background script (Chrome service worker). |
What is handled: Your 32-byte master seed (which can also be displayed as a BIP39 24-word mnemonic for compatibility with other wallets), your Ed25519 keypair (Solana), your secp256k1 keypair (EVM chains), your post-quantum WOTS+ Merkle tree of one-time signature keys, the counter ("leaf index") indicating which one-time keys have been used, and the password you set to encrypt all of the above.
How it is used: Solely to sign the cryptocurrency transactions you choose to send and to display the keys to you when you choose to view or export them (see section 14).
How it is stored: The wallet keystore is encrypted with AES-256-GCM under a key derived from your password using PBKDF2-SHA256 with 310,000 iterations and a per-keystore random salt and initialization vector. The encrypted blob is written to Chrome's extension storage (chrome.storage.local) on your device. The decrypted keystore exists only in the wallet's background-script runtime memory while the wallet is unlocked, and is wiped after fifteen minutes of inactivity (auto-lock). Private keys, the master seed, and the password are never written unencrypted to disk and are never sent over the network.
How it is shared: Never. Authentication information is not transmitted to Glewme Corp, to any third party, or to any network service under any circumstances. Without your password, the encrypted keystore cannot be decrypted by anyone, including Glewme Corp. If you lose your password, your wallet can only be recovered using the recovery phrase (master seed) you saved at wallet creation.
What is handled: Your public wallet addresses (Solana address, EVM address, and the server-issued PARACYT "PARA" address), the tokens and balances visible to those addresses on the public blockchains, and the contents of the transactions you choose to send.
How it is used: Solely to display your balances, build the transactions you request, and submit those transactions to the relevant blockchain. These are the core operations of any cryptocurrency wallet. We do not use this information for advertising, profiling, credit determination, or any unrelated purpose.
How it is stored: Public wallet addresses and a short-lived list of in-flight transactions you initiated (so the wallet UI can show their confirmation status) are stored locally on your device in chrome.storage.local. The wallet does not maintain a server-side database of your balances or transaction history; balance and history views are queried live from public blockchain nodes when you open the wallet. The PARACYT backend (operated by Glewme Corp, see section 6.5) does store a mapping from your public wallet address to your PARACYT PARA address, so that other users sending to your PARA address can resolve it.
How it is shared: Public wallet addresses and the contents of broadcast transactions are, by the public nature of blockchains, visible to every participant on those blockchains once a transaction is broadcast. The wallet shares this data with the specific third-party services listed in section 6, each contacted only when you take an action that requires it (for example, viewing a balance contacts an RPC node; requesting a swap quote contacts a DEX aggregator).
What is handled: The contents of the cryptocurrency transactions you create using the wallet (send, swap, contract interaction, bridge, etc.) and the metadata required to construct them (token symbols, amounts, recipient addresses, slippage tolerance, etc.).
How it is used: Solely to build, sign, and broadcast the operation you requested. A short-lived in-flight transaction tracker records the transaction hash, current confirmation stage, and timestamps in chrome.storage.local so the wallet can show you the status of operations you initiated. This local tracker is automatically trimmed.
How it is shared: Transaction contents are shared with the RPC node that broadcasts them and with any DEX aggregator or PARACYT backend service required by the operation, each listed in section 6. Once a transaction is broadcast it becomes publicly visible on the chain — this is a property of public blockchains, not of this wallet.
What is handled: A list of website origins (for example https://app.example.com) that you have explicitly approved to interact with the wallet, with the timestamp of approval.
How it is used: To remember which sites you have allowed to read your public wallet address and to request transaction signatures, so the wallet does not re-prompt you on every page load on a site you have already approved.
How it is stored: Locally in chrome.storage.local only.
How it is shared: Not shared with any third party. You can revoke any origin at any time in the wallet's Settings → Connected Sites view.
This section lists every external service the PARACYT Wallet extension may contact, by named operator, purpose, and the data shared. Each service is contacted only when you take an action that requires it, with the single exception of an unauthenticated backend health probe noted in section 6.5. A complete enumeration of the network destinations the extension may contact is provided in Appendix A.
To read on-chain balances and to broadcast transactions, the wallet contacts blockchain RPC ("remote procedure call") nodes for each supported chain. The wallet uses a rotation: it tries higher-priority providers first, falls back to public providers on failure, and lets you specify custom endpoints in Settings if you prefer.
Named operators:
*.quiknode.pro) — paid primary endpoints. For Solana, the wallet uses a load-balanced rotation of three QuickNode endpoints; for Ethereum, Arbitrum, Avalanche, BSC, and Linea, QuickNode is the priority provider with public RPC fallbacks below it.*.publicnode.com) — public RPC endpoints across most EVM chains.*.drpc.org) — public RPC endpoints across most EVM chains.*.llamarpc.com) — public RPC endpoints across most EVM chains.rpc.ankr.com) — public RPC endpoints across multiple chains.cloudflare-eth.com) — public Ethereum gateway.mainnet.base.org) — public RPC endpoint for the Base chain.api.mainnet-beta.solana.com, arb1.arbitrum.io, polygon-rpc.com, forno.celo.org, rpc.linea.build, rpc.mantle.xyz, rpc.scroll.io, rpc.blast.io, rpc.soniclabs.com, rpc.apechain.com, rpc.api.moonbeam.network, rpc.hyperliquid.xyz, pacific-rpc.manta.network, mainnet.era.zksync.io, evm.cronos.org, and similar) — operated by the respective chain foundations.
Data shared with each RPC provider: the JSON-RPC method called (such as getBalance, getTokenAccountsByOwner, sendTransaction) and its parameters (typically including your public wallet address and, for transaction submission, the signed transaction bytes). RPC providers will observe the IP address of your request as a normal feature of internet protocol. Each provider's own privacy policy applies to their service. You may set custom RPC endpoints in the wallet's Settings if you prefer different providers.
lite-api.jup.ag) — used to fetch swap quotes and build swap transactions on Solana, and to fetch a verified-tokens list and token prices for Solana tokens. Receives your wallet address (so the resulting transaction can be signed by you), the swap parameters (input token, output token, amount, slippage), and the token identifiers you are viewing prices for. Jupiter's privacy policy applies to their service.api.1inch.dev and the mirror tokens.1inch.io) — used to fetch swap quotes, build swap transactions, and retrieve per-chain token lists on supported EVM chains. Receives your wallet address, the swap parameters, and the chain identifier. 1inch's privacy policy applies to their service.You can avoid contact with DEX aggregators by not using the Swap feature.
To display the names, symbols, decimals, and (where applicable) USD-equivalent prices of tokens in your wallet, the wallet fetches token-list metadata from the providers below. The token list contains general public reference data about tokens (not user data); your wallet address is included only when the provider's endpoint requires it for personalization, as noted.
lite-api.jup.ag/tokens, lite-api.jup.ag/price/v3) — verified Solana token list and price feed for displayed Solana tokens. Token-list requests carry no wallet-specific information; price requests carry only the token mint identifiers being priced (such as the mint address of SOL, USDC, or another token), not your wallet address.api.1inch.dev/token) — per-chain EVM token list. Carries the chain identifier; does not include your wallet address.The wallet does not contact Jupiter (for Solana) and 1inch (for EVM).
The wallet UI displays token icons sourced from token-list metadata. Loading these images contacts the image hosts named below. Glewme Corp does not operate or control these hosts. The HTTP request for an image carries no wallet-specific information beyond the standard headers any browser sends for any image request.
raw.githubusercontent.com — Trust Wallet's public chain and token logo repository.tokens.1inch.io) — token icons mirror.gateway.ipfs.io, operated by Protocol Labs, Inc.) — for NFT or token icons stored on IPFS.
The wallet contacts the PARACYT backend (hosted by Glewme Corp at paracyt.com and tokenchef.win) for the purposes listed below. Because the backend is operated by the same entity that publishes the wallet, using these features means sharing the listed data with Glewme Corp. The backend does not receive any private key material under any circumstance.
/api/glewme/profile/connect) — when you unlock or create a wallet, the wallet sends your public Solana address to the backend to obtain a server-issued "PARA address" identifier. The backend stores a mapping of (public wallet address → PARA address) so that other users sending to your PARA address can resolve it. No private key material is sent./api/glewme/resolve/:identifier) — when you send funds to a PARA address, the wallet contacts the backend to resolve it to the underlying public blockchain address. The backend receives the PARA address being looked up./api/wallet/register) — for wallets installed during the beta program, the wallet sends your public wallet address to record a cosmetic "beta tester" cohort number. No personal information is sent./api/glewme/wallet/:address) — the wallet contacts the backend with your public wallet address to retrieve a curated token list and metadata so the dashboard renders correctly./api/glewme/build-launch-tx and related) — if you use the Launch feature, the backend assists in building the launch transaction and recording cross-chain materialization data. The backend receives the public wallet address you are launching from and the launch parameters you supplied.
The wallet displays "Open in Block Explorer" links next to your transactions. These links point to publicly-operated block explorer websites: solscan.io (Solana), etherscan.io (Ethereum), basescan.org (Base), arbiscan.io (Arbitrum), optimistic.etherscan.io (Optimism), polygonscan.com (Polygon), bscscan.com (BNB Chain), snowtrace.io (Avalanche), lineascan.build (Linea), scrollscan.com (Scroll), blastscan.io (Blast), apescan.io (ApeChain), cronoscan.com (Cronos), celoscan.io (Celo), gnosisscan.io (Gnosis), sonicscan.org (Sonic), explorer.mode.network (Mode), explorer.zksync.io (zkSync Era), hyperliquid.cloud.blockscout.com (HyperEVM), pacific-explorer.manta.network (Manta), and paracyt.com/tx/ (PARACYT-routed transactions).
The wallet itself does not call these URLs. The wallet only renders them as clickable links. When you click one, your normal browser opens the URL in a new tab and the block explorer site receives your visit as it would for any other browser request. If you do not click these links, no data is sent to the block explorers from the wallet.
When you connect the wallet to a website (such as a decentralized exchange, NFT marketplace, or other dApp), the wallet shares your public wallet address with that website, and that website may then request that you sign transactions and messages. Each such share requires an explicit approval click from you in a separate wallet approval window. The wallet never shares wallet data with a website that has not been approved by you, and you can revoke a website's approval at any time in Settings → Connected Sites.
The extension requests only these Chrome permissions:
storage — required so the wallet can store the encrypted keystore, approved-origin list, and your settings on your device. No data leaves the device through this permission. This permission does not grant the extension any access to your browsing data.host_permissions: <all_urls> — required so the wallet's dApp provider script (which exposes window.paracyt.ethereum and window.paracyt.solana on web pages) can be injected into pages, enabling decentralized applications to request connections and signatures. This permission is not used to read page content or browsing history. The injected provider script only forwards messages between an explicitly-approved web page and the wallet's background script, and only after you have clicked Approve in the wallet's approval window. Without this permission, the wallet could not function as a dApp wallet — which is how every browser-based cryptocurrency wallet operates.
The extension does not request the tabs, activeTab, history, cookies, webRequest, webNavigation, identity, geolocation, notifications, downloads, clipboardWrite, clipboardRead, contextMenus, or any other permission beyond the two listed above.
For clarity, the wallet does not collect, store, transmit, derive, or share any of the following, in any form, ever:
We do not, and will not: sell user data to third parties; transfer user data to any third party for the purpose of advertising or marketing; share user data with data brokers; use user data to build advertising profiles; use user data to determine creditworthiness or for lending decisions; or use user data for any purpose unrelated to the wallet's core, user-initiated functionality. The wallet displays no advertising of any kind.
The extension does not include analytics SDKs (such as Google Analytics, Mixpanel, Amplitude, Segment, PostHog, or similar), telemetry beacons, crash-reporting services, behavioral-tracking pixels, fingerprinting libraries, A/B-testing frameworks, attribution SDKs, or third-party trackers. The wallet does not set cookies. The wallet does not phone home for analytics, attribution, feature flags, or growth metrics.
The only background network activity initiated by the wallet without user interaction is the backend health probe described in section 6.5, which carries no wallet-specific data.
Local device data: All locally-stored wallet data — the encrypted keystore, approved-origins list, in-flight transaction tracker, and settings — lives on your device. To delete this data:
chrome://extensions. This removes all extension-managed local data from your device.Once removed locally, this data cannot be recovered by Glewme Corp because Glewme Corp does not maintain a copy.
Backend data: Glewme Corp retains the (public wallet address → PARACYT PARA address) mapping records described in section 6.5 indefinitely, so that PARA addresses continue to resolve to the correct underlying public chain address for senders. You may request deletion of your backend-side mapping record by emailing privacy@paracyt.com from a request signed by the wallet you wish to delete; we will remove the record within thirty days. Deletion of the backend mapping does not affect the public blockchain itself, which is outside our control and outside the scope of this policy.
PARACYT Wallet protects authentication information using the following measures:
If a security vulnerability is discovered in PARACYT Wallet, we will release a fixed version through the Chrome Web Store. We encourage users to keep extension auto-updates enabled. Critical vulnerabilities will be publicly disclosed once a fix has been distributed. Vulnerability reports may be sent to security@paracyt.com.
When you create a new wallet or import an existing seed, the extension performs a local entropy check on the seed before deriving any keys, rejecting seeds that are structurally weak (for example, produced by a faulty random-number generator: all-zero, partially uninitialized, stuck or non-varying bytes, or abnormally low entropy). This check runs entirely on your device and transmits nothing. It is a safety measure and does not replace the security provided by using the browser's cryptographic random-number generator, which the wallet uses for all key generation.
PARACYT Wallet additionally maintains a Merkle tree of WOTS+ (Winternitz One-Time Signature) keypairs derived from your master seed. Each tree contains 1,024 single-use signature keys for use on the PARACYT chain materialization layer. The wallet stores a counter (the "leaf index") in chrome.storage.local indicating which keys have been used, so a one-time key is never reused. The counter is not transmitted. The WOTS+ keypairs themselves are derived deterministically from the seed at signing time; only the seed (encrypted) and the counter are persisted.
This is disclosed for transparency; from a privacy standpoint these keys are subject to the same protections as all other authentication information in section 5.1 and are never transmitted off your device.
Because the wallet does not collect personally identifiable information, most data-protection rights (access, deletion, portability) do not have data on our side to apply to — your wallet data lives on your device. You can:
privacy@paracyt.com from a request signed by the wallet you wish to delete, as described in section 11.privacy@paracyt.com. Because the only data we hold tied to wallets is the public-address-to-PARA-address mapping (which is also self-discoverable by anyone with your wallet address), the response will typically state the mapping record and nothing else.
Residents of jurisdictions that grant additional rights (such as California under the CCPA/CPRA, or the European Union/EEA under the GDPR) may exercise those rights by emailing privacy@paracyt.com. We will respond within the timeframes required by applicable law.
PARACYT Wallet is not directed at children under 13. The wallet does not knowingly collect personal information from any user, including children. We do not market the wallet to minors. If you are a parent or guardian and believe a child has installed the wallet, you can uninstall it from chrome://extensions; uninstallation removes all locally-stored wallet data.
The wallet is designed to operate without collecting personal data, so the same privacy posture applies regardless of where you are located. Third-party services contacted by the wallet (RPC providers, DEX aggregators, image hosts, the PARACYT backend) operate globally; your request to them is routed and processed by their infrastructure under their own privacy policies.
Glewme Corp's own infrastructure (the PARACYT backend) is hosted in the United States. By using the wallet from outside the United States, you consent to your interactions with the PARACYT backend being processed in the United States. We do not maintain personal information about you, so cross-border transfer regulations applicable to personal data have limited applicability to our handling.
Glewme Corp is incorporated in the State of California, United States. Any disputes regarding this privacy policy will be governed by the laws of the State of California, without regard to conflict-of-laws principles, and will be resolved in the state or federal courts located in California.
If we update this privacy policy, the "Last updated" date at the top of this page will be revised, and the new version will be the one served at this URL. Material changes that introduce a new data flow or a new third-party recipient will be communicated through the Chrome Web Store listing's update notes prior to taking effect, and the wallet UI will display a notice on next unlock prompting you to re-review the policy.
For privacy questions, deletion requests, or to report a concern:
Glewme Corp
Email: privacy@paracyt.com
Website: https://paracyt.com
For security vulnerabilities, please email security@paracyt.com.
For full transparency, this appendix enumerates every network destination the PARACYT Wallet extension may contact. The destinations are grouped by purpose; each is contacted only when a user action requires it, except for the PARACYT backend health probe described in section 6.5.
api.mainnet-beta.solana.com, solana.publicnode.com, solana-rpc.publicnode.com, rpc.ankr.com/solana, *.quiknode.pro (three QuickNode endpoints in rotation), api.devnet.solana.com, api.testnet.solana.com.
Ethereum: cloudflare-eth.com, ethereum.publicnode.com, eth.llamarpc.com, rpc.ankr.com/eth, ethereum.api.nodesmith.io.
Arbitrum: arb1.arbitrum.io/rpc, arbitrum-one.publicnode.com, arbitrum.llamarpc.com, *.arbitrum-mainnet.quiknode.pro.
Base: mainnet.base.org, base.publicnode.com, base.llamarpc.com.
Optimism: optimism.publicnode.com, optimism.llamarpc.com, rpc.ankr.com/optimism.
Polygon: polygon.publicnode.com, polygon-rpc.com, polygon.llamarpc.com.
BNB Chain: bsc.publicnode.com, binance.llamarpc.com, bsc-dataseed1.defibit.io.
Avalanche: api.avax.network/ext/bc/C/rpc, avalanche.drpc.org, avalanche.publicnode.com, *.avalanche-mainnet.quiknode.pro.
Linea: rpc.linea.build, linea.drpc.org, linea.publicnode.com, *.linea-mainnet.quiknode.pro.
Scroll: rpc.scroll.io, scroll.drpc.org, rpc-scroll.icecreamswap.com.
Blast: rpc.blast.io, blast.drpc.org, blast-rpc.publicnode.com.
Mantle: rpc.mantle.xyz, mantle.drpc.org.
zkSync Era: mainnet.era.zksync.io, zksync.drpc.org.
Cronos: evm.cronos.org, cronos.drpc.org.
Celo: forno.celo.org, celo.drpc.org.
Gnosis: rpc.gnosischain.com, gnosis.drpc.org, gnosis.publicnode.com.
Moonbeam: rpc.api.moonbeam.network.
Sonic: rpc.soniclabs.com, sonic.drpc.org.
ApeChain: rpc.apechain.com/http, apechain.drpc.org.
HyperEVM: rpc.hyperliquid.xyz/evm.
Manta: pacific-rpc.manta.network/http.
Testnets (only when you switch to a test network): api-sepolia.etherscan.io, api-goerli.etherscan.io, api-goerli.arbiscan.io, api-testnet.polygonscan.com, api-goerli-optimistic.etherscan.io, www.ethercluster.com.
lite-api.jup.ag, api.1inch.dev, tokens.1inch.io.
raw.githubusercontent.com (Trust Wallet logo repository), gateway.ipfs.io (IPFS gateway).
paracyt.com, tokenchef.win.
solscan.io, etherscan.io, basescan.org, arbiscan.io, optimistic.etherscan.io, polygonscan.com, bscscan.com, snowtrace.io, lineascan.build, scrollscan.com, blastscan.io, apescan.io, cronoscan.com, celoscan.io, gnosisscan.io, sonicscan.org, explorer.mode.network, explorer.zksync.io, hyperliquid.cloud.blockscout.com, pacific-explorer.manta.network.