Privacy, locally.
ENQRYPT is built so that the sensitive work happens on your device. This notice says what stays local, what is sent where, and what we never collect.
What stays on your device
- Everything you encrypt or decrypt, every passphrase and every key generated in the labs.
- Your Sign-In with Ethereum session, early-access code and daily usage counters, stored in your browser's IndexedDB.
- Scan history and saved reports, stored in your browser until you delete them.
- Your theme preference, stored in local storage.
Clearing your browser's site data removes all of it. We have no copy.
What is sent where
| Recipient | Sent from | What |
|---|---|---|
| Vault, Crypto Lab, Post-Quantum Lab | Nowhere | Text, files, passphrases and keys are processed in your browser and never leave your device. |
| Alchemy (blockchain RPC) | Through our server, which adds the API key and stores nothing | Addresses you scan or connect, transaction hashes and read-only calls needed to answer your question. |
| Public RPC providers (Robinhood Chain, BNB Chain and others) | Directly from your browser, only when Alchemy does not answer | The same read-only calls. |
| Blockscout explorers (RobinScan and others) | Directly from your browser, or through our server | Addresses and transaction hashes you look up, to read history, approvals and contract verification. |
| Sourcify | Directly from your browser | BNB Chain contract addresses you look up, to read verified source and contract names. |
| BscScan (Etherscan API) | Through our server | BNB Chain addresses you look up, for verification, history and approvals that Sourcify and the RPC cannot answer. Our server adds its API key and keeps nothing but a short cache. |
| CoinGecko and GeckoTerminal | From our server | Only coin identifiers and the $ENQRYPT contract address. No information about you. |
| Threat intel sources (NVD, GitHub, RSS feeds, arXiv) | From our server | Nothing about you. Our server fetches public feeds on a schedule. |
| Your wallet | Your wallet extension or app | Signature requests you approve. Sign-In with Ethereum is a free message signature, never a transaction. |
Public blockchain data is public: anything you look up can already be seen by anyone. The third parties above have their own privacy policies and may log the requests they receive, including your IP address.
ENQRYPT Guard browser extension
ENQRYPT Guard processes supported EVM wallet requests to display transaction and signature risk checks. It reads the request method, wallet and contract addresses, network, transaction parameters, and any message or typed data submitted for signing. It also reads the requesting page's origin, URL and title to identify the site in the review. This is limited to wallet requests; the extension does not maintain a general browsing-history log or read unrelated page content.
Pending requests are held in Chrome's session storage until a decision is recorded or the browser session ends. The on/off setting and up to 30 recent review summaries are kept in local extension storage. Each summary contains the requesting origin, request method, time, network, risk level, summary and your decision. These records are not synced through Chrome Sync. Uninstalling the extension removes its locally stored settings and history; clearing this website's data alone does not remove extension data.
For analysis, relevant wallet and contract addresses, transaction calldata, values and read-only RPC parameters are sent over HTTPS to ENQRYPT's relay and Alchemy. Public RPC providers are used as fallbacks. Contract and address checks use Blockscout and Sourcify; optional BNB Chain explorer checks use ENQRYPT's Etherscan relay. Function-name lookups send a four-byte selector through ENQRYPT to Sourcify's signature service. A read-only transaction simulation can include the proposed transaction's sender, recipient, value and calldata before that transaction is published onchain. This information is not limited to already-public blockchain records.
ENQRYPT Guard does not intentionally request private keys, seed phrases or wallet passwords, and it cannot sign for you. Raw personal-sign messages are examined locally; relevant contract fields from typed-data requests may be used for network checks. Do not include secrets in messages or transactions. The extension contains no advertising or analytics code and does not upload its recent-check history. ENQRYPT does not sell this extension data, use it for advertising, or use it to determine creditworthiness or lending eligibility. Data is used to provide the displayed security checks and maintain their reliability, in accordance with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Hosting and API providers receive connection metadata, including IP addresses, and may retain operational logs under their own policies. The relay application does not create a database of wallet requests. Local extension storage is not an encrypted vault; protect access to your browser profile. You can turn checks off in the toolbar popup or remove the extension in Chrome's extension settings.
What we never collect
- Seed phrases, private keys or keystore files. ENQRYPT will never ask for them.
- The contents of anything you encrypt.
- Wallet addresses in analytics. If usage analytics are enabled, they are cookieless and count events only; addresses are never sent in plain text.
Our servers
Our server routes fetch market data and threat intel and cache the public responses. They hold no user accounts and no database of users. Our hosting provider keeps standard request logs (such as IP address, time and requested page) for security and reliability.
Questions and requests
Because we do not hold personal data about you beyond standard request logs, most requests can be met by clearing your browser's site data. For anything else, contact the ENQRYPT team through the channels listed on the home page.