LightNode Wallet - Privacy Policy

Nothing. There is no backend we operate, no analytics, and no telemetry. We do not collect, store, or transmit any personal information, addresses, balances, or activity to any server we control.

Your recovery phrase is encrypted on your device (AES-256-GCM with a scrypt-derived key) and stored only in your browser's local extension storage. It never leaves your device, and only your password can decrypt it - we cannot recover it.

Settings (selected network, added tokens, your local activity list) are stored locally in your browser.

To show balances and broadcast transactions, the extension talks directly to public blockchain RPC endpoints (LightChain, Ethereum, Base, Arbitrum, Optimism, Polygon) and, on LightChain, the public worker-registry contracts. To show USD values it also requests coin and token prices from CoinGecko's public API (which sees the token contract addresses, not your wallet address). Block-explorer APIs (Blockscout, Etherscan) are queried to build your activity list and discover tokens. These requests go from your browser to those public endpoints. Public providers may log requests under their own policies.

The optional AI chat feature additionally contacts the LightChain consumer gateway through a stateless pass-through proxy at lightnode.app (needed because the gateway does not allow direct browser requests). Your prompts and replies are end-to-end encrypted on your device before they leave it; the proxy and gateway relay ciphertext and routing metadata only and store nothing. Streamed replies arrive over LightChain's public relay WebSocket and are decrypted locally. If you never open AI chat, none of these requests happen.

storage keeps the encrypted vault and settings on your device. alarms auto-locks after inactivity. The page content script injects the standard wallet provider so sites can request to connect; it holds no keys.

You can reveal your recovery phrase (password-gated) or remove the wallet from your device at any time in Settings. Removing it deletes the encrypted vault from your browser.