Who we are and what this policy covers
This policy covers the Monero Wallet · Standalone extension, version 2.4.0, and this website, published by the Monero Wallet Standalone project and its contributors. This is an independent MIT-licensed project, not affiliated with or endorsed by the Monero Project.
This publication describes the referral edition and builds without Exchange. The optional developer API implementation in the source is not the published referral feature; distributing that mode requires separate validation and matching disclosures. Your encrypted wallet vault is not sent to the project.
Effective date: 2026-10-17. Contact: [email protected].
What is stored locally
| Information | Storage and protection | Retention |
|---|---|---|
| Wallet keys and cache, addresses, balances, history, labels, contacts, notes, custom nodes and wallet settings | Local IndexedDB vault, AES-256-GCM encrypted with a password-derived PBKDF2-SHA256 key, 600,000 iterations, fresh salt and IV per save | Until the wallet, extension or its data is deleted |
| Vault ID, name, network, timestamps and revision | Unencrypted metadata in IndexedDB so wallets can be listed while locked; accessible to someone with browser-profile access | As long as the vault |
| Uncertain-transfer hash and timestamp | chrome.storage.local, unencrypted recovery record | Until a successful relay and save or explicit resolution after checking the outcome |
| Latest public-node monitor status, reported height and check time per bundled node | chrome.storage.session; no wallet data and no sample histories | Replaced by the latest sample; cleared on browser restart |
| Unfinished add-node form | chrome.storage.session, memory only while a permission prompt is open | Until completion, cancellation or browser shutdown |
| Theme, selected account and wallet IDs, last page and hidden-balance preference | Extension local storage, unencrypted; no addresses, amounts, seed or password | Until preferences or extension data are cleared |
| Unlocked wallet key material | Offscreen document and WebAssembly worker memory | Until lock, session failure, deletion or browser shutdown; auto-lock waits for active operations to finish |
| Encrypted backups, CSV history and QR images | Files saved by the user; CSV and QR exports are not encrypted | Until the user deletes them |
| Copied addresses, payment links, transaction IDs or other copied text | System clipboard, accessible to other software under operating-system rules | Until overwritten or cleared; clipboard history may retain copies |
The password is not saved. Recovery material is not stored in plaintext. Revealing the recovery phrase or view key requires the wallet password, except the initial new-wallet backup step. JavaScript memory wiping is best-effort, not a guarantee against a compromised device.
Referral mode does not create or store external exchange orders. Backups imported from an earlier API build may retain historical order records inside the encrypted vault; the referral link does not transmit or update them. Exported backups keep the password used when they were created. Treat CSV files like sensitive financial records.
Monero node connections
Wallet operations connect to one node you select after a privacy notice: a built-in public node or a custom node you add. Built-in nodes are XMRtab Node (https://node.monero-tab.com, mainnet, HTTPS, vendor/community operated), Cake Wallet (mainnet, HTTPS), Seth for Privacy (mainnet, HTTPS; stagenet and testnet, HTTP), and HashVault (mainnet, HTTP).
Automatic public node monitoring: independently of wallet operations, the extension sends a fixed public get_info POST to every bundled mainnet, stagenet and testnet node. Chrome alarms schedule it every four hours and shortly after browser startup/install. It runs with the popup closed, while locked and without a wallet. No opt-in or toggle is provided. Each contacted operator, including the vendor node, can see your IP address and request timing. HTTP is unencrypted. Selecting your own node does not stop these requests.
The monitor sends no wallet data, addresses, balances, keys or history and uses no telemetry collector. Each request is limited to 8 seconds and 256 KiB, with no retries, cookies/credentials, redirects, referrer or cache. Only the latest status, reported height and check time per node are retained in chrome.storage.session, cleared on browser restart; no sample histories are kept. Node operators may retain their own access logs; local cache retention is not a promise about those logs.
Monitoring never chooses or changes your node, polls custom nodes, starts synchronization or wakes the wallet engine, and does not count as activity for auto-lock. Availability is only the latest sample, not continuous uptime, node honesty or wallet/network synchronization proof. Browser sleep and alarm delays can leave samples stale.
Manual wallet operations remain separate: manual node checks, selection and wallet synchronization still require explicit privacy consent and user action. Manual checks request network information. Synchronization and rescanning download blockchain data. Preparing and confirming a send fetch required transaction data and relay the locally signed transaction. Unlocking does not automatically sync, and ordinary local UI polling does not itself contact nodes.
During explicit wallet operations, the selected node also sees requested block ranges and signed transactions you submit, along with your IP address and timing. The wallet does not send its password, seed, private keys, addresses, balance, labels or contacts to the node. Scanning happens locally. Monero conceals plaintext amounts and recipients on-chain; this is not a guarantee of anonymity against malicious nodes or network analysis.
Public nodes are untrusted and may be unavailable, return misleading data, censor requests or harm privacy. Plain HTTP exposes traffic to network observers and modification. Prefer HTTPS and consider a node you control. The extension has no integrated Tor or proxy support. For custom nodes Chrome requests permission for one exact origin on your gesture; addresses are stored encrypted in that wallet.
External exchange referral and commission
In referral-enabled builds, the mainnet-only Exchange screen offers a link to Trocador, an independent exchange website. After the affiliate/privacy disclosure and your explicit consent, it opens https://trocador.app/?ref=CODE in a new browser tab. The extension does not embed the website, call an exchange API or connect the wallet to the page. Builds without a referral code do not offer the shortcut.
What the link sends: only the referral code in the URL. No wallet address, balance, amount, history, seed, key or password is automatically attached. As with any website visit, the destination can see your IP address and browser/network information. It may use cookies and process any addresses, amounts, order details or identity information you enter there under its own policies and those of its providers. The extension cannot control that website's scripts, redirects, storage or retention.
Affiliate disclosure: the developer may earn referral commission when you use the link. The service may make referral attribution or commission reports available to the project under its referral program. Their content and retention are governed by the service's program and policies; the extension does not send your wallet vault to support this reporting. We do not sell information received for commission accounting or use it for unrelated advertising, creditworthiness or lending.
Fees and provider rules: referral mode does not set a custom 3% markup, enforce A/B provider filters or guarantee no KYC. Review current quotes, all fees and provider terms on the external site. Any provider may require identity verification, hold funds, delay or refuse service. Completion, release of funds and refunds are not guaranteed.
Manual workflow: rates, provider selection, orders and status are on the external site. Copy a mainnet receiving address from Receive yourself; a fresh subaddress is recommended. When paying XMR, manually enter and verify the external deposit address and amount in Send, sync and review before confirming. The wallet does not create an order subaddress automatically, validate an external order, save its reference or track its status. Keep order references yourself and use the external service for support. Never enter a recovery phrase or private key on that site.
No extension analytics or remote code
The extension has no wallet sign-up, analytics, telemetry, crash reporting, content scripts or remotely loaded executable code. All extension scripts and the WebAssembly engine are bundled locally. Referral attribution on the external site is separate from the wallet and is disclosed above; no promise is made that third-party sites are free of tracking.
The extension does not upload your encrypted vault or check for updates itself. Chrome manages updates for store installations. External websites open only after the user's action; Exchange also requires the disclosed consent.
Chrome Web Store Limited Use: wallet information is handled for the wallet's stated purpose, including local financial and authentication data. Node connections and optional referral navigation are described above. We do not sell user information or use it for unrelated advertising, creditworthiness or lending.
Browser permissions
- storage: recovery markers, temporary add-node state and the latest public-node status, reported height and check time in session storage, cleared on browser restart without sample histories. Wallet vaults themselves use local IndexedDB.
- alarms: schedule always-on catalog monitoring every four hours and shortly after startup/install, including without a wallet or open popup; no opt-in or toggle. Sleep and alarm delays may postpone checks.
- unlimitedStorage: reduce quota problems as encrypted wallet caches grow. It is not a backup.
- offscreen: host the local wallet worker so requested sync and confirmed payments can continue after the popup closes. The public node monitor does not wake this engine.
- Built-in node host permissions: permit automatic fixed public
get_infomonitoring of every bundled node, including the required vendor originhttps://node.monero-tab.com/*, plus explicit selected-node checks, blockchain requests and signed transaction relay after privacy consent. - Optional host permissions: permit a user-chosen custom Monero node, one exact origin at a time, with Chrome's permission prompt.
Referral mode needs no exchange API host permission. Opening an external link does not grant the extension access to that site's pages. It requests no browsing-history access, injects no content scripts and exposes no website wallet API.
Control and deletion
We cannot unlock or recover your local wallet. There is no password reset. Preserve an offline recovery phrase and an encrypted backup with its password before deleting anything.
- Lock the wallet to end the unlocked session.
- Delete the wallet or remove the extension or its browser data to erase local vaults and preferences.
- Delete exported files and clipboard history separately where appropriate.
Locking or deleting a wallet and selecting your own node do not stop catalog monitoring; there is no in-extension monitor toggle. Disabling or removing the extension stops its monitor. Restarting the browser clears local session samples, but startup schedules new checks. These actions do not delete node operators' access logs.
Deleting extension data does not remove browser history or cookies belonging to an external site, third-party exchange records or commission-accounting records. Use browser controls for website data; contact Trocador and your chosen provider about records they hold. Contact [email protected] about referral-accounting information available to the project. Do not send wallet secrets with a request.
This website
This project website is static and uses locally served fonts, scripts and images. It sets no cookies and runs no analytics. A theme choice is saved in localStorage after you use the theme switch. Hosting providers may keep ordinary access logs such as IP address, time, requested page and user agent for operation and security.
This description does not apply to Trocador or other linked websites. Their own policies govern your visits there.
Age requirements
This software and website are not directed to children under 13 or a higher minimum age required locally. Do not use a third-party exchange unless you meet its age, regional and other eligibility requirements.
Policy changes
Material changes will be reflected in this policy and its effective date.
- 2026-10-17: version 2.4.0 referral release with always-on catalog monitoring: fixed public requests to all bundled networks, vendor-node IP/timing exposure, alarms and latest-only session samples; manual wallet operations remain explicit. Exchange remains an explicitly consented external link, with no automatic wallet-data sharing, external-site order handling and possible referral commission. Integrated API claims do not apply to this release.
- 2026-09-24: version 2.3 added custom nodes and wallet-management settings.
Contact
Privacy questions: [email protected]. Never include a real recovery phrase, private key, password or wallet backup. See the Terms and Security pages.