Privacy Policy

1. Plain-English summary

If you only have ten seconds, this is what you need to know:

• The Extension does not require an account and does not ask you for your name, email, phone number, or any other personal identifier.
• The Extension does not contain advertising, analytics, fingerprinting, or tracking code.
• The only piece of information you may enter is a public blockchain address (e.g. an Ethereum or Solana address). That address is stored on your own device so you don't have to re-type it next time.
• When you click “Fetch Balance”, that address is sent to a public blockchain RPC endpoint (by default https://cloudflare-eth.com) so a balance can be read from the public ledger. This is the same kind of request any block explorer makes.
• The Extension does not send the address, your browsing history, your IP address, or any other data to us, to our servers, or to any advertising or analytics network.
• Because the Extension is a popup-only Chrome extension (Manifest V3) with no background service worker and no content scripts, it is fully inert the moment you close the popup.

2. Who is responsible for your data

The controller responsible for your personal data within the meaning of Article 4(7) of the EU General Data Protection Regulation (GDPR) and the UK GDPR is the operator of the Extension's distribution website, reachable at vtracker.icu.

We do not maintain a registered office in the European Union, the United Kingdom, or the European Economic Area. If you are located in one of those jurisdictions and require a representative under Article 27 GDPR, please contact us at privacy@vtracker.icu and we will provide the relevant contact.

3. What information we handle

3.1 Information you may actively enter

• Public blockchain addresses (e.g. 0x… for EVM chains, Base58 strings for Solana) that you choose to look up. A blockchain address is a public identifier — it is published on the public ledger of the relevant chain and is visible to anyone. Whether an address is “personal data” under GDPR depends on whether it can be linked to a specific individual; we treat it as potentially personal data and protect it accordingly.
• ENS, SNS, or other human-readable name you type instead of a raw address, treated identically to a raw address.

3.2 Information generated automatically when the Extension does what you ask

• Your IP address, which is necessarily transmitted to the RPC endpoint when your browser makes the JSON-RPC request to read a balance. The Extension does not see, store, or transmit your IP address — the browser's networking stack handles it directly, exactly as it would for any other HTTPS request.

3.3 Information we do not collect

We do not collect, store, or transmit:

• your name, email address, postal address, telephone number, or any other contact detail;
• your date of birth, gender, nationality, or any other identifying personal attribute;
• your private keys, seed phrases, mnemonic words, or any other secret that could be used to sign transactions or control funds — the Extension has no code to request or process such secrets and structurally cannot do so;
• your browsing history, the URLs you visit, the content of pages you view, your search queries, your form inputs on other websites;
• your Chrome profile, Google account identifier, advertising identifier, device identifier, or any other persistent cross-site identifier;
• your precise or coarse geographic location;
• any information about other applications installed in your browser;
• biometric, health, sexual-orientation, ethnic, political, religious, trade-union, or any other “special category” data under Article 9 GDPR.

4. How that information is handled

• You type an address into the Extension's popup. The Extension stores it on your device using chrome.storage.local. This storage is scoped to the Extension and is not accessible to other extensions or to the websites you visit.
• You click “Fetch Balance”. The Extension makes an HTTPS POST request to the configured RPC endpoint (by default Cloudflare's Ethereum gateway at https://cloudflare-eth.com). The request body is a standard JSON-RPC payload (e.g. {"method":"eth_getBalance","params":["<address>","latest"],"id":1,"jsonrpc":"2.0"}). The response is the balance, rendered in the popup.
• You close the popup. Because the Extension is popup-only (Manifest V3 with no background service worker and no content scripts), no code continues to run. No further network requests of any kind are made.
• You uninstall the Extension. Everything the Extension stored on your device is deleted by Chrome as part of uninstallation.

5. Why we handle it and the legal basis

We do not process your personal data for profiling, automated decision-making, marketing, or any purpose unrelated to the single purpose of the Extension.

6. Third parties who may see your data

When you click “Fetch Balance”, the blockchain address you typed is necessarily sent to the public RPC endpoint the Extension is configured to use. By default this is:

• Cloudflare Ethereum Gateway — https://cloudflare-eth.com — operated by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.

Cloudflare, as the RPC provider, may log the request, including the originating IP address and the queried address, in accordance with its own privacy policy. We do not control Cloudflare's logging practices. If you prefer not to send your queries to Cloudflare, the Extension allows you to change the RPC endpoint (see the Extension's options page or settings).

Other than the operator of the configured RPC endpoint, we do not share your personal data with any third party. Specifically, we do not share with:

• advertising networks, demand-side platforms, or data brokers;
• analytics providers (Google Analytics, Mixpanel, Amplitude, PostHog, Plausible, Fathom, etc.);
• social networks;
• law-enforcement or government bodies, except where compelled by a valid legal process directed at us — in which case we would, where lawful, notify you;
• any other extension, application, or website.

We never sell your personal data. We never transfer your personal data to third parties for their own purposes.

7. How long information is kept

• The public blockchain address you last entered is stored on your device until you either clear it via the Extension's settings, clear Chrome's extension storage, or uninstall the Extension (which removes it automatically).
• We do not retain your address, your IP address, your RPC query parameters, or any other data on any server under our control. There is no server-side log, database, or analytics store.
• The RPC endpoint operator (e.g. Cloudflare) may retain request logs according to its own retention policy, which we do not control.

8. International transfers

Because the Extension makes HTTPS requests to a public RPC endpoint, your IP address and the queried address will necessarily be transmitted to the operator of that endpoint, which may be located outside your country of residence and outside the European Economic Area.

By default, the RPC endpoint is operated by Cloudflare in the United States. Transfers of personal data from the EEA, the UK, or Switzerland to the United States are made under the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework (and the equivalent UK and Swiss extensions). Cloudflare participates in the Data Privacy Framework as a certified organisation; you can verify its certification at dataprivacyframework.gov.

If you configure the Extension to use an RPC endpoint operated by a different provider, please review that provider's privacy policy for information on international transfers.

9. Security

The Extension implements the following security measures:

• Least-privilege permissions. The Extension requests only the storage permission. It does not request permissions for tabs, cookies, history, webRequest, webNavigation, scripting, identity, debugger, or any host-access permission that would let it read or modify the websites you visit.
• Hardened Content-Security Policy. The Extension's manifest declares script-src 'self'; object-src 'self'; connect-src <declared RPC hosts>. This means that, even if a future vulnerability in a bundled library allowed an attacker to inject code, the injected code could not execute (because script-src is restricted to the Extension itself) and could not contact an arbitrary server (because connect-src is pinned to a declared list).
• No remote code. The Extension loads all of its executable code from its own bundled files. There are no eval calls, no Function() constructors, no dynamic import() of remote modules, and no <script src="https://…"> references. Reviewers can verify this by unpacking the published .zip package.
• Popup-only architecture. The Extension has no background service worker, no content scripts, and no side panel. When the popup is closed, no Extension code is running.
• Read-only by design. The Extension's bundled code contains no signing primitives. It cannot request a transaction signature, cannot call personal_sign, cannot connect to a wallet extension such as MetaMask, and cannot move funds.
• Public-key verification of dependencies. All third-party libraries bundled into the Extension are pinned at build time and their integrity is verified against the public npm registry.

If you believe you have discovered a security vulnerability in the Extension, please contact us at security@vtracker.icu. We ask that you give us a reasonable window to respond before public disclosure.

10. Children

The Extension is not directed at children under the age of 16 and does not knowingly collect any personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete such data.

11. Cookies and similar technologies

The Extension does not set, read, or modify cookies, localStorage, sessionStorage, IndexedDB, the browser's HTTP cache, or any other client-side storage on the websites you visit. The only client-side storage the Extension uses is its own chrome.storage.local, scoped to the Extension itself and inaccessible to websites and to other extensions.

12. Your rights

If you are located in the European Union, the European Economic Area, Switzerland, or the United Kingdom, you have the following rights under the GDPR and the UK GDPR:

To exercise any of these rights, email us at privacy@vtracker.icu. We will respond without undue delay and in any event within one month of receipt of your request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests; in that case we will inform you within one month of the extension and the reasons for it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top of this page and, if the change is material, we will note it in the Extension's release notes on the Chrome Web Store listing. We encourage you to review this page periodically.

14. How to contact us

If you have any question, request, or complaint regarding this Privacy Policy or the Extension's data practices, you can reach us at: