Privacy

IziWallet is a self-custody wallet. Your recovery phrase and private keys are created on your device, encrypted with your password (PBKDF2-SHA256, then AES-256-GCM) and kept in your browser's extension storage.

They are never sent to us or to anyone else. We can't see them, recover them or reset your password.

Your accounts and their public addresses, settings, contacts, custom and hidden tokens, the sites you connected and your recent activity. All of it lives in the extension's local storage and leaves with it when you remove the extension.

To show balances and send transactions, the wallet has to ask public blockchain services about your public addresses. It sends nothing else about you.

• Blockchain RPC nodes: our relay at iziwallet.vercel.app, which forwards requests to our RPC providers (QuickNode, Helius) so their keys stay private, with PublicNode as a backup. Networks you add yourself use the RPC you chose. They receive your public addresses and the transactions you sign.
• Prices and charts: CoinGecko, GeckoTerminal and Jupiter receive the token contracts you hold, not your address.
• Token approvals: when you open Token approvals in Settings, GoPlus Security receives the selected address to list what it has approved.
• Scam checks (IziGuard): when a site asks you to connect, sign or send, GoPlus Security receives that site's address and the contract or wallet addresses involved, to check them against its lists of phishing sites and flagged addresses. Your own address and keys are not sent.
• Swaps and bridges: Jupiter and LI.FI receive your address, the tokens and the amount, to build the route. Your keys are not sent.
• Buying and selling: when you choose a provider (Onramper, Stripe, MoonPay, Mercuryo, Alchemy Pay, Changelly or Guardarian), it opens on its own site, and MoonPay receives your address in the link. Each provider handles payment and identity checks under its own privacy policy.
• Token search: DexScreener and GeckoTerminal receive what you type in the search, not your address.
• Perps: Hyperliquid receives your address and the orders you sign. Your keys are not sent.
• Token images load from the token's own image host.

Our Solana relay counts requests per IP address for one minute, in memory, to stop abuse; it doesn't store the requests or your address. These services have their own privacy policies.

A website sees your public address only after you approve the connection, and can ask for a signature or a transaction only with your approval each time. You can disconnect a site at any time in Settings.

No accounts, no analytics, no advertising or tracking, and no selling or sharing of data. The extension doesn't read the pages you visit; its script on websites only carries messages between a site and the wallet when the site asks for it.

If this policy changes, the new version is published on this page with its date. Questions: reach us through the community links below.