Everything the mainnet listing needs, laid out by the developer dashboard’s tabs, so submitting is copy and paste. The owner of the developer account submits it by hand.
Decided for launch (2026-09-26, the launch review):
npm run package) opens on Cardano mainnet, where ADA is real money. The welcome screen, before a wallet exists, and Settings can switch it to preprod, Cardano’s test network, and a strip on every screen says so while it’s there.main.npm run package, which writes extension/release/seedelf-wallet-<version>-mainnet.zip, and refuses a build without mainnet’s hosts.main, so the release’s web-wallet/<topic> branch must be merged into main before the listing is submitted — open the URL and check it renders. The wallet’s own Settings link points at main too, and is built into the package, so the merge comes before npm run package, not after.seedelf-data/ (development.md, step 7): a wallet the store ships must never meet an API older than the one it was reviewed against.Upload extension/release/seedelf-wallet-<version>-mainnet.zip, the zip npm run package wrote.
_locales (In Spanish and Japanese).version in extension/package.json.-preprod.zip (npm run package:preprod): it’s a preprod-only build, for tests.Title (from the manifest): Seedelf Wallet
Summary (the manifest’s description, from SUMMARY in extension/src/manifest.ts through Chrome’s _locales; the store allows 132 characters):
A Cardano wallet with a private balance built in. Stake and send in public, or pay anyone privately through Seedelf.
Description:
Seedelf Wallet is a Cardano wallet with a private balance built in: Seedelf, the stealth wallet on Cardano. It's one wallet with two sides: a public account for everyday Cardano, and a private balance where no UTxO says who owns the money.
It runs on Cardano mainnet, with real ADA. To try it without real money, switch it to preprod, Cardano's test network, on the welcome screen or in Settings, with a recovery phrase you don't use on mainnet: the same phrase has the same keys on both networks, so anyone comparing them can tell they're one wallet's. ADA there is test ADA, from the Cardano testnet faucet, with no value. The wallet marks preprod on every screen.
Seedelf hides who owns money. Each payment to a Seedelf reaches its owner under a fresh copy of their key, so no UTxO says who owns it, and payments to the same Seedelf can't be linked to each other. Spending is proven with a zero-knowledge proof and a one-time key, so it doesn't reveal the spender either.
What you can do:
• Create a wallet, or restore one from a 12, 15 or 24-word recovery phrase, and lock it with a password.
• Use its public accounts: normal Cardano accounts that any wallet can pay, and that pay any address, ADA Handle or Seedelf, several at once. A phrase from Lace or Eternl opens that wallet's accounts, and the wallet finds the ones the phrase has used.
• Stake the public account with a pool, from a list of every live pool, and spend or withdraw the rewards.
• Delegate its voting power: always abstain, always no confidence, or a DRep you find by name.
• Be your own DRep: register the public account, vote on the open governance actions, and retire to get the deposit back. Governance sites such as GovTool can connect too, when you allow it.
• Create a Seedelf: a name you give out so that anyone can pay you privately.
• Make ADA and tokens private: move them from the public account into your private balance.
• Send privately to any Seedelf by its name, several at once.
• Make money public: pay any Cardano address or ADA Handle from the private balance. Or remove a Seedelf.
• Connect Cardano sites (dApps) to the public account, as with any Cardano wallet, or to a private session: a one-time account funded from your private balance, so the wallet gives the site only that account, not your public account. Its funding is public, though, and money you made private yourself leads back to your public account. It's off until you turn it on in Settings, and sites are never given the private balance.
• Swap privately through Minswap: each swap runs from a new one-time account, funded from your private balance, and everything comes back into it afterwards. Your public account isn't in the swap's transactions, though anyone can follow the money back through its funding. The wallet asks Minswap for an order with the least you'll accept, checks where the transaction Minswap builds pays, and shows what the swap will cost before you approve it.
• Mix through Lovejoin: the spare ADA a private session brings back goes through Lovejoin, a mixer of 10 ADA boxes on Cardano, so what comes back is harder to tie to the session on chain. You can turn that off in Settings, or bring any one back directly. You can also mix from the Lovejoin tile. Lovejoin has had no third-party audit, only its makers' own review, and the wallet says so where you choose it. On mainnet the wallet mixes only once Lovejoin's pool holds 30 boxes that aren't yours, so there are enough other boxes to mix with; until then a return comes back directly and says why.
• Read any transaction before it is signed, on every review and when a site asks for a signature: where the money goes, what contracts run and with what data, the certificates, the note and the metadata, and the raw bytes if you want to take them elsewhere. Nothing is looked up to show it, so reading a transaction tells nobody that you read it.
• Use it in English, Spanish or Japanese: it follows Chrome's language, and Settings changes it.
What it doesn't hide:
• Amounts, tokens, timing and which transactions spend which outputs are public, as with any Cardano wallet.
• Making money private, and making it public again, link your public account to what you move. Each screen says what it links, and the wallet warns you before a step ties your accounts together.
• The server the wallet reads Cardano through sends every transaction, and giveme.my, the collateral service we run, sees every private one, both from your IP address. So they can tie your private payments and Lovejoin boxes to your public account: Seedelf and Lovejoin hide them from people reading the chain, not from the services that carry them.
• A Lovejoin box hides only among other people's boxes that come back into a Seedelf around the same time, one of up to 9 at the default depth, and fewer while few people use it.
• Privacy grows with the number of people who use Seedelf and Lovejoin, and today there are few.
Private money earns no staking rewards: it has no staking part, which is what keeps your Seedelfs from being linked together. Money that sits can stay staked in the public account, and be made private when it should move privately.
How it works:
• Everything is built and signed inside the extension. The cryptography and the transaction building are Rust, compiled to WebAssembly and shipped in the package.
• Your recovery phrase never leaves your device. It's encrypted with your password (Argon2id and ChaCha20-Poly1305).
• The wallet talks to a few services, and each sees your IP address. On mainnet, our own server reads the chain and submits your transactions, and logs neither your IP address nor what you ask; Koios, a public Cardano API, reads and submits on preprod, and on mainnet for anything ours can't answer, or for everything if you turn ours off in Settings. giveme.my, which we run, adds shared collateral to private payments, so your own address stays out of them, and sees each one. CoinGecko gives ADA's price on mainnet, unless you choose no currency. Minswap quotes and builds your swaps, only when you swap. Blockfrost's IPFS gateway gives an NFT's image, only when you press Show image on it. Lovejoin is a contract on the chain, reached through those servers.
• It adds nothing to web pages unless you turn on connecting sites. Then it adds only the standard Cardano wallet entry (window.cardano) to https pages, so any https site can see you use Seedelf Wallet, as with any Cardano wallet, and it asks you before anything is signed.
• There's no sign-up, and no analytics or tracking.
Open source (MIT): https://github.com/logical-mechanism/Seedelf-Wallet
Category: Tools. Lace is listed there too.
Language: English. It’s the item’s own language, which the store’s search goes by. The listing in Spanish and Japanese is below.
Graphic assets (images/):
| Field | File |
|---|---|
| Store icon (128×128) | icon-128.png: the guardian artwork in 96×96, with 16 px transparent padding |
| Screenshots (1280×800) | screenshot-1.png to screenshot-5.png, in that order. Spanish’s and Japanese’s are in es/ and ja/ (below) |
| Small promo tile (440×280) | promo-small-440x280.png: the wordmark alone, with no words to translate. The store can’t localize it anyway |
| Marquee promo tile | None. It’s optional, and the store doesn’t feature crypto extensions. |
| Video | None |
The screenshots show the wallet on mainnet, as the listing’s build opens, with the MAINNET badge and no test-network strip. They’re made by e2e/store-images.spec.ts from the recorded fixtures and the public BIP39 test phrase, never a real wallet: the fake Koios answers mainnet’s requests from the same recordings, writing their addresses with mainnet’s prefix and network tag, and each test token stands in for one on the wallet’s mainnet list (USDM and DJED). So the balances, the Seedelf paid and the pool staked with are the fixtures’, not anyone’s holdings, and every screen is the real UI.
Additional fields:
https://github.com/logical-mechanism/Seedelf-Wallet/tree/main/seedelf-platform/seedelf-web-wallethttps://github.com/logical-mechanism/Seedelf-Wallet/issuesThe wallet speaks English, Spanish and Japanese, and so does its listing. The store shows a visitor the listing in their language, and the English one where it has none of theirs. Adding ?hl=es or ?hl=ja to the listing’s URL shows the others.
Seedelf Wallet in every language: it’s a name.description is __MSG_appDesc__, and each language’s text is in SUMMARY in extension/src/manifest.ts, which the build writes into Chrome’s _locales/<language>/messages.json. tests/manifest.test.ts holds each to the store’s 132 characters._locales, the Store listing tab has a language list at its top, one entry for each _locales folder. Choose Español, paste the Spanish description below, and drop the five screenshots from images/es/ into Localized screenshots. Then the same for 日本語, with images/ja/. English stays as it is above.CAPTIONS in e2e/store-images.spec.ts; npm run store:images makes each screen in all three languages, switching the wallet’s language on it as Settings does.On the dashboard: Español in the Store listing tab’s language list.
Summary (from the package, SUMMARY.es):
Una billetera de Cardano con saldo privado integrado. Haz staking y envía en público, o paga a cualquiera en privado con Seedelf.
Description:
Seedelf Wallet es una billetera de Cardano con un saldo privado integrado: Seedelf, la billetera sigilosa en Cardano. Es una sola billetera con dos lados: una cuenta pública para el día a día en Cardano, y un saldo privado donde ningún UTxO dice de quién es el dinero.
Funciona en la mainnet de Cardano, con ADA real. Para probarla sin dinero real, cámbiala a preprod, la red de pruebas de Cardano, en la pantalla de bienvenida o en Configuración. Usa allí una frase de recuperación que no uses en mainnet: la misma frase tiene las mismas claves en ambas redes, así que cualquiera que compare las dos redes puede saber que se trata de una misma billetera. Allí el ADA es ADA de prueba, del faucet de la red de pruebas de Cardano, y no tiene valor. Mientras está en preprod, la billetera muestra un aviso en cada pantalla.
Seedelf oculta de quién es el dinero. Cada pago a un Seedelf llega a su dueño bajo una copia nueva de su clave, así que ningún UTxO dice de quién es, y los pagos al mismo Seedelf no se pueden vincular entre sí. El gasto se demuestra con una prueba de conocimiento cero y una clave de un solo uso, así que tampoco revela quién gasta.
Lo que puedes hacer:
• Crear una billetera, o restaurar una con una frase de recuperación de 12, 15 o 24 palabras, y bloquearla con una contraseña.
• Usar tus cuentas públicas: cuentas de Cardano normales a las que cualquier billetera puede pagar, y que pagan a cualquier dirección, ADA Handle o Seedelf, a varios a la vez. Una frase de Lace o Eternl abre las cuentas de esa billetera, y la billetera encuentra las que esa frase ha usado.
• Hacer staking con la cuenta pública en un pool, elegido de una lista con todos los pools activos, y gastar o retirar las recompensas.
• Delegar el poder de voto de la cuenta pública: “Siempre abstenerse”, “Siempre sin confianza” o un DRep que encuentres por su nombre.
• Ser tu propio DRep: registrar la cuenta pública, votar las acciones de gobernanza abiertas y retirar tu DRep para recuperar el depósito. Los sitios de gobernanza, como GovTool, también pueden conectarse, cuando lo permitas.
• Crear un Seedelf: un nombre que compartes para que cualquiera pueda pagarte en privado.
• Hacer privados ADA y tokens: moverlos de la cuenta pública a tu saldo privado.
• Enviar en privado a cualquier Seedelf por su nombre, a varios a la vez.
• Hacer público el dinero: pagar a cualquier dirección de Cardano o ADA Handle desde el saldo privado. O eliminar un Seedelf.
• Conectar sitios de Cardano (dApps) a la cuenta pública, como con cualquier billetera de Cardano, o a una sesión privada: una cuenta de un solo uso financiada desde tu saldo privado, así que la billetera solo le da al sitio esa cuenta, no tu cuenta pública. Aun así, su financiación es pública, y el dinero que tú mismo hiciste privado lleva de vuelta a tu cuenta pública. La conexión de sitios está desactivada hasta que la actives en Configuración, y a los sitios nunca se les da el saldo privado.
• Intercambiar en privado a través de Minswap: cada intercambio arranca desde una nueva cuenta de un solo uso, financiada desde tu saldo privado, y después todo vuelve a tu saldo privado. Tu cuenta pública no aparece en las transacciones del intercambio, aunque cualquiera puede seguir el dinero hacia atrás a través de su financiación. La billetera le pide a Minswap una orden con el mínimo que aceptas, comprueba a dónde paga la transacción que construye Minswap y muestra lo que costará el intercambio antes de que lo apruebes.
• Mezclar con Lovejoin: el ADA sobrante que una sesión privada trae de vuelta pasa por Lovejoin, un mezclador de cajas de 10 ADA en Cardano, así que lo que vuelve es más difícil de vincular con la sesión en la cadena. Puedes desactivarlo en Configuración, o traer de vuelta cualquier sesión directamente, sin Lovejoin. También puedes mezclar desde el panel de Lovejoin. Lovejoin no ha tenido ninguna auditoría de terceros, solo la revisión de sus propios creadores, y la billetera lo indica donde lo eliges. En mainnet, la billetera solo mezcla cuando el pool de Lovejoin tiene 30 cajas que no son tuyas, para que haya suficientes cajas ajenas con las que mezclar; hasta entonces, la devolución llega directamente, sin Lovejoin, y la billetera dice por qué.
• Leer cualquier transacción antes de que se firme, en cada revisión y cuando un sitio pide una firma: a dónde va el dinero, qué contratos se ejecutan y con qué datos, los certificados, la nota y los metadatos, y los bytes en bruto si quieres llevarlos a otra parte. No se consulta nada para mostrarla, así que leer una transacción no le dice a nadie que la leíste.
• Usarla en inglés, español o japonés: sigue el idioma de Chrome, y se cambia en Configuración.
Lo que no oculta:
• Las cantidades, los tokens, el momento de cada transacción y qué transacciones gastan qué salidas son públicos, como con cualquier billetera de Cardano.
• Hacer privado el dinero y volver a hacerlo público vinculan tu cuenta pública con lo que mueves. Cada pantalla dice qué vincula, y la billetera te avisa antes de que un paso vincule tus cuentas entre sí.
• El servidor a través del cual la billetera lee Cardano envía cada transacción, y giveme.my, el servicio de colateral que gestionamos nosotros, ve cada transacción privada. Ambos las reciben desde tu dirección IP, así que pueden vincular tus pagos privados y tus cajas de Lovejoin con tu cuenta pública: Seedelf y Lovejoin los ocultan de quienes leen la cadena, no de los servicios que los transmiten.
• Una caja de Lovejoin solo se oculta entre las cajas ajenas que vuelven a un Seedelf más o menos al mismo tiempo: es una de hasta 9 con la profundidad predeterminada, y una de menos mientras poca gente use Lovejoin.
• La privacidad crece con el número de personas que usan Seedelf y Lovejoin, y hoy son pocas.
El dinero privado no gana recompensas de staking: no tiene parte de staking, y eso es lo que impide que tus Seedelfs se vinculen entre sí. El dinero que no se mueve puede seguir en staking en la cuenta pública, y hacerse privado cuando deba moverse en privado.
Cómo funciona:
• Todo se construye y se firma dentro de la extensión. La criptografía y la construcción de transacciones están escritas en Rust, compiladas a WebAssembly e incluidas en el paquete.
• Tu frase de recuperación nunca sale de tu dispositivo. Se cifra con tu contraseña (Argon2id y ChaCha20-Poly1305).
• La billetera se comunica con unos pocos servicios, y cada uno ve tu dirección IP. En mainnet, nuestro propio servidor lee la cadena y envía tus transacciones, y no registra ni tu dirección IP ni lo que consultas; Koios, una API pública de Cardano, lee la cadena y envía las transacciones en preprod, y en mainnet lo hace para lo que el nuestro no pueda responder, o para todo si desactivas el nuestro en Configuración. giveme.my, que gestionamos nosotros, añade colateral compartido a los pagos privados, para que tu propia dirección quede fuera de ellos, y ve cada uno. CoinGecko da el precio de ADA en mainnet, salvo que elijas no mostrar ninguna moneda. Minswap cotiza y construye tus intercambios, solo cuando intercambias. La pasarela IPFS de Blockfrost entrega la imagen de un NFT, solo cuando pulsas Mostrar imagen en él. Lovejoin es un contrato en la cadena, al que se accede a través de esos servidores.
• No añade nada a las páginas web salvo que actives la conexión de sitios. Entonces solo añade la entrada estándar de billetera de Cardano (window.cardano) a las páginas https, así que cualquier sitio https puede ver que usas Seedelf Wallet, como con cualquier billetera de Cardano, y la billetera te pregunta antes de que se firme nada.
• No hay que registrarse, y no hay analíticas ni rastreo.
Código abierto (MIT): https://github.com/logical-mechanism/Seedelf-Wallet
Screenshots: images/es/screenshot-1.png to screenshot-5.png, in that order, into Localized screenshots. Their captions, which are in the images already:
| # | Title | Line |
|---|---|---|
| 1 | Dinero privado en Cardano | Tu saldo privado está en UTxOs que no dicen de quién son. |
| 2 | Paga a un Seedelf por nombre | Pega el nombre y la billetera lo encuentra. El pago no se puede vincular con el Seedelf al que paga. |
| 3 | Recibe en privado | Crea un Seedelf y comparte su nombre. Cualquiera puede pagarle, y ningún pago lleva hasta él. |
| 4 | Te dice qué vincula | Haz público tu dinero pagando a cualquier dirección o $handle. La billetera te avisa antes de que un pago vincule tus cuentas entre sí. |
| 5 | Billetera completa de Cardano | Envía, haz staking con un pool y delega tu voto. Restaura una frase de Lace o Eternl, o crea una nueva. |
On the dashboard: 日本語 in the Store listing tab’s language list.
Summary (from the package, SUMMARY.ja):
プライベート残高を内蔵した Cardano ウォレット。公開アカウントでステーキングや送金を行うことも、Seedelf を通じて誰にでもプライベートに支払うこともできます。
Description:
Seedelf Wallet は、プライベート残高（Cardano のステルスウォレット Seedelf）を内蔵した Cardano ウォレットです。1 つのウォレットに 2 つの面があります。日常的な Cardano の利用に使う公開アカウントと、どの UTxO にもお金の持ち主が示されないプライベート残高です。
Cardano の mainnet 上で、本物の ADA を使って動作します。本物のお金を使わずに試すには、ようこそ画面または設定で、Cardano のテストネットワークである preprod に切り替えてください。その際は、mainnet では使っていないリカバリーフレーズを使ってください。同じフレーズは両方のネットワークで同じ鍵になるため、2 つのネットワークを見比べれば、誰でも同じウォレットだと分かります。preprod の ADA は Cardano のテストネット用フォーセットから受け取るテスト用の ADA で、価値はありません。preprod を使っている間は、ウォレットのすべての画面にそのことが表示されます。
Seedelf は、お金の持ち主を隠します。Seedelf への支払いは 1 件ごとに、持ち主の鍵の新しいコピー宛てに届きます。そのため、どの UTxO にも持ち主は示されず、同じ Seedelf への支払い同士を結び付けることもできません。お金を使うときはゼロ知識証明と使い捨ての鍵を用いるため、使う人も明かされません。
できること:
• ウォレットを作成するか、12 語、15 語、24 語のいずれかのリカバリーフレーズから復元し、パスワードでロックできます。
• 公開アカウントを使えます。通常の Cardano アカウントで、どのウォレットからでも支払いを受けられ、任意のアドレス、ADA Handle、Seedelf に支払えます。複数の宛先へまとめて支払うこともできます。Lace や Eternl のフレーズからは、そのウォレットのアカウントを開けます。そのフレーズで使われたことのあるアカウントは、Seedelf Wallet が見つけます。
• 稼働中のすべてのプールの一覧から選んで、公開アカウントをプールにステーキングし、報酬を使ったり引き出したりできます。
• 公開アカウントの投票権を委任できます。委任先は「常に棄権」、「常に不信任」、または名前で探した DRep です。
• 自分自身の DRep になれます。公開アカウントを DRep として登録し、投票受付中のガバナンスアクションに投票し、退任すればデポジットが戻ります。GovTool などのガバナンスサイトも、あなたが許可すればこのウォレットに接続できます。
• Seedelf を作成できます。Seedelf は、誰でもあなたにプライベートに支払えるように、人に教える名前です。
• ADA とトークンをプライベートにできます。公開アカウントからプライベート残高へ移します。
• どの Seedelf にも、名前を指定してプライベートに送金できます。複数の宛先へまとめて送ることもできます。
• プライベート残高から任意の Cardano アドレスや ADA Handle に支払って、お金を公開できます。Seedelf を削除することもできます。
• Cardano のサイト（dApps）を、ほかの Cardano ウォレットと同じように公開アカウントに接続することも、プライベートセッションに接続することもできます。プライベートセッションは、プライベート残高から資金を入れた使い捨てアカウントです。そのため、ウォレットがサイトに渡すのはそのアカウントだけで、公開アカウントは渡しません。ただし、その資金提供は公開されており、自分でプライベートにしたお金は、公開アカウントにつながります。サイトの接続は設定でオンにするまでオフで、サイトにプライベート残高が渡されることはありません。
• Minswap を通じてプライベートにスワップできます。スワップはそれぞれ、プライベート残高から資金提供される新しい使い捨てアカウントから行われ、終わるとすべてプライベート残高に戻ります。公開アカウントはスワップのトランザクションに現れませんが、資金提供をたどれば、誰でもお金の流れを遡れます。ウォレットは最低受取額を指定した注文の作成を Minswap に依頼し、Minswap が作成するトランザクションの支払先を確認し、承認の前にスワップの費用を表示します。
• Lovejoin でミックスできます。プライベートセッションが戻す余った ADA は、Lovejoin（10 ADA のボックスでミックスする Cardano 上のミキサー）を通るため、戻ってくるものをチェーン上でセッションと結び付けにくくなります。これは設定でオフにできます。また、返却ごとに Lovejoin を通さず直接戻すことも選べます。Lovejoin のタイルからミックスすることもできます。Lovejoin は第三者による監査を受けていません。受けたのは Lovejoin の開発者自身によるレビューだけです。ウォレットは、Lovejoin を選ぶ場面でそのことを伝えます。mainnet では、ウォレットがミックスするのは、Lovejoin のプールにあなたのものではないボックスが 30 件たまってからです。一緒にミックスするほかのボックスが十分にあるようにするためです。それまでは、返却分は Lovejoin を通さずに直接戻り、その理由が表示されます。
• 署名の前に、どのトランザクションも読めます。すべての確認画面でも、サイトから署名を求められたときも同じです。お金の行き先、どのコントラクトがどんなデータで実行されるか、証明書、メモ、メタデータ、そしてほかのツールで使いたい場合は生のバイト列まで表示されます。表示のために何も問い合わせないため、トランザクションを読んでも、読んだことは誰にも伝わりません。
• 英語、スペイン語、日本語で使えます。Chrome の言語に従い、設定で変更できます。
隠さないもの:
• 金額、トークン、タイミング、どのトランザクションがどの出力を使うかは、ほかの Cardano ウォレットと同じく公開されています。
• お金をプライベートにするときも、再び公開するときも、移すお金と公開アカウントが結び付きます。各画面に何が結び付くかが表示され、ある操作でアカウント同士が結び付く前には、ウォレットが警告します。
• ウォレットが Cardano のデータの読み取りに使うサーバーはあなたのトランザクションをすべて送信し、私たちが運営するコラテラルサービスの giveme.my はプライベートなトランザクションをすべて見ます。どちらのサービスも、それらをあなたの IP アドレスから受け取ります。そのため、これらのサービスは、プライベートな支払いや Lovejoin のボックスを公開アカウントと結び付けられます。Seedelf と Lovejoin がそれらを隠すのはチェーンを読む人からであって、それらを運ぶサービスからではありません。
• Lovejoin のボックスが紛れ込めるのは、同じころに Seedelf へ戻ってくるほかの人のボックスの中だけです。既定の深さでは最大 9 件のうちの 1 件で、Lovejoin を使う人が少ないうちは、9 件よりさらに少なくなります。
• プライバシーは、Seedelf と Lovejoin を使う人が増えるほど高まります。現在、使っている人はわずかです。
プライベートなお金には、ステーキング報酬がつきません。ステーク部分を持たないためで、それによってあなたの Seedelf 同士が結び付かずに済んでいます。動かさないお金は公開アカウントでステーキングしたままにしておき、プライベートに動かす必要が出たときにプライベートにできます。
仕組み:
• すべては拡張機能の中で作成され、署名されます。暗号処理とトランザクションの作成は Rust で書かれ、WebAssembly にコンパイルされてパッケージに同梱されています。
• リカバリーフレーズが端末の外に出ることはありません。パスワードで暗号化されています（Argon2id と ChaCha20-Poly1305）。
• ウォレットはいくつかのサービスと通信し、それぞれにあなたの IP アドレスが見えます。mainnet では、私たち自身のサーバーがチェーンを読み取り、トランザクションを送信します。このサーバーは、あなたの IP アドレスも問い合わせの内容も記録しません。preprod では、公開の Cardano API である Koios がチェーンの読み取りとトランザクションの送信を行います。mainnet でも、私たちのサーバーが応答できないものは Koios が担い、設定で私たちのサーバーを使わないようにすれば、すべてを Koios が担います。私たちが運営する giveme.my は、プライベートな支払いに共有のコラテラルを加えるため、あなた自身のアドレスは支払いに含まれません。また、giveme.my はその支払いをすべて見ます。CoinGecko は、設定の「通貨」で「表示しない」を選ばない限り、mainnet で ADA の価格を提供します。Minswap はスワップの見積もりと作成を行いますが、それはスワップするときだけです。Blockfrost の IPFS ゲートウェイは、NFT の「画像を表示」を押したときだけ、その画像を提供します。Lovejoin はチェーン上のコントラクトで、これらのサーバーを通じて利用します。
• サイトの接続をオンにしない限り、ウェブページには何も追加しません。オンにすると、https のページに標準の Cardano ウォレットのエントリ（window.cardano）だけを追加します。そのため、ほかの Cardano ウォレットと同じく、どの https サイトも、あなたが Seedelf Wallet を使っていることを認識できます。何かが署名される前には、ウォレットがあなたに確認します。
• ユーザー登録はなく、アクセス解析やトラッキングもありません。
オープンソース（MIT）: https://github.com/logical-mechanism/Seedelf-Wallet
Screenshots: images/ja/screenshot-1.png to screenshot-5.png, in that order, into Localized screenshots. Their captions, which are in the images already:
| # | Title | Line |
|---|---|---|
| 1 | Cardano 上のプライベートなお金 | プライベート残高は、誰のものかを示さない UTxO の中にあります。 |
| 2 | どの Seedelf にも名前で支払う | 名前を貼り付ければ、ウォレットがその Seedelf を見つけます。その支払いを支払先の Seedelf と結び付けることは、誰にもできません。 |
| 3 | プライベートに受け取る | Seedelf を作成して、その名前を伝えましょう。誰でもそこに支払うことができ、どの支払いからもその Seedelf にはたどり着けません。 |
| 4 | 結び付くものを示す | 任意のアドレスや $handle に支払って、お金を公開できます。支払いでアカウント同士が結び付く前に、ウォレットが警告します。 |
| 5 | フル機能の Cardano ウォレット | 送金、プールへのステーキング、投票権の委任ができます。Lace や Eternl のフレーズから復元することも、新しいフレーズを作ることもできます。 |
Single purpose:
Seedelf Wallet is a Cardano wallet with the Seedelf stealth wallet contract built in. It keeps the user's recovery phrase encrypted on their device, and lets them send and stake from their public account, connect it to Cardano sites (dApps), create a Seedelf, make ADA private, send it to other Seedelfs, and make it public again, while keeping who owns each UTxO in the private balance hidden.
Permission justifications:
| Permission | Justification |
|---|---|
storage |
Keeps the wallet on the user's device: the recovery phrase, encrypted with the user's password, in chrome.storage.local, and the unlocked session in chrome.storage.session, which is memory-only and cleared when the wallet locks or the browser closes. Nothing is synced. |
alarms |
Locks the wallet automatically after a time without use that the user sets (15 minutes unless changed): a one-minute alarm checks the time since the user last did something. A second one-minute alarm, while the wallet is unlocked, carries on what the user started: a swap's next step, a Lovejoin mix being sent, a Lovejoin box due back, a payment the server didn't answer, looked for and sent again until it's settled, and a Lovejoin mix from the public account that stopped at a transaction that may have gone through, looked for until it's settled. |
sidePanel |
Lets the user open the wallet in Chrome's side panel instead of a tab, a choice in its Settings. The side panel shows only the extension's own page. |
scripting |
Adds the standard Cardano wallet entry (window.cardano.seedelf, CIP-30) to https pages, those already open included, only after the user turns on "Let sites connect to Seedelf Wallet" in Settings, and stops adding it when they turn it off (a page still open keeps it until reloaded, and it refuses every call). The scripts ship in the package; the page's own content is never read. While it's on, a page can see the wallet is installed, as with any CIP-30 wallet; the user is told so before turning it on. |
Optional host https://*/*, http://localhost/*, http://127.0.0.1/* |
Asked for only when the user turns on connecting sites in Settings. It lets the wallet offer itself to Cardano sites (dApps) as a CIP-30 wallet: a site can then ask to connect, and to have transactions or messages signed, each approved by the user in the wallet's own window. localhost is for sites in development. One host under it, ipfs.blockfrost.dev, is asked for on its own the first time the user presses Show image on an NFT: Blockfrost's IPFS gateway, which the image is fetched from and which sends no CORS headers. Nothing is fetched from it otherwise. |
Host https://api.koios.rest/* |
Koios is the public Cardano API the wallet reads Cardano mainnet through whenever its own server can't answer, and always if the user chooses Koios only in Settings: the user's balances, UTxOs, activity and staking, the stake pools and DReps, the governance actions and the account's own DRep and its votes, Lovejoin's pool, and an NFT's metadata when the user asks to see its image. It also evaluates scripts (for two reviews: creating a Seedelf paid by the public account, and a Lovejoin chain's first mix) and submits the transactions the user approves. Koios's public tier doesn't answer web pages (no CORS headers), so the wallet can reach it only with this host permission. |
Host https://preprod.koios.rest/* |
The same Koios API for Cardano's preprod test network, which the user can switch to in Settings to try the wallet with test ADA. While the wallet is on mainnet, it asks preprod only to finish what the user started there (a payment on its way, a swap, a Lovejoin mix). |
Host https://www.giveme.my/* |
giveme.my, a collateral service run by the developer (Logical Mechanism), adds shared collateral to Seedelf script transactions, on mainnet (/mainnet/collateral/) and on preprod (/preprod/collateral/). The wallet sends it each such transaction to witness, so that the user's own address never appears as collateral. It sees the transaction and the user's IP address, as the privacy policy says. |
Host https://api.coingecko.com/* |
CoinGecko's public API gives ADA's price in the currency the user chooses in Settings, on mainnet only: one request for ADA alone, when Home or the swap form opens, at most every five minutes. Choosing no currency stops it. It's never told what the wallet holds. |
The dashboard has one host-permission box, not one per host, and it takes about 1,000 characters. The rows above come to 2,164 characters together, so they go in merged. This text, at 985 characters, covers every host, the IPFS gateway included:
api.koios.rest is the public Cardano API the wallet reads mainnet through when its own server can't answer (balances, UTxOs, staking, pools, DReps); it also evaluates scripts and submits transactions. Koios sends no CORS headers, so a host permission is the only way to reach it. preprod.koios.rest is the same API for the preprod test network, chosen in Settings. www.giveme.my is a collateral service run by the developer; it adds shared collateral to Seedelf script transactions so the user's address never appears as collateral, and sees each one and the user's IP, as the privacy policy says. api.coingecko.com gives ADA's price in the currency chosen in Settings, and is told nothing about the wallet. The optional hosts (https://*/*, localhost, 127.0.0.1) are requested only if the user turns on "Let sites connect" in Settings, to add the CIP-30 entry to https pages. ipfs.blockfrost.dev alone is requested when the user first presses Show image on an NFT, to fetch that image.
The per-host rows above stay: they’re the fuller answer if a reviewer asks about one. https://*/* is the one they question; the answer is that it’s optional_host_permissions, never granted at install, and asked for only when the user turns site connections on. Turning them off unregisters the content scripts but keeps Chrome’s grant: removing https://*/* would take the Koios and giveme.my hosts with it, and Koios can’t be reached without them (background/connector.ts).
The wallet’s own Cardano server needs no host permission either (1.4.0): mainnet.seedelf.logicalmechanism.io, run by the developer, answers the store’s extension ID with CORS headers, so only the pages’ CSP names it, as for Minswap below. It’s the first server the wallet reads mainnet through; Koios is the fallback, which is why the Koios host stays.
Minswap’s aggregators need no host permission. They answer extension pages with CORS headers, so only the pages’ CSP (connect-src) names them: agg-api.minswap.org for mainnet and aggr.monorepo-testnet-preprod.minswap.org for preprod. The wallet reaches them only when the user swaps. If a reviewer asks, the same words go in the description of data use below.
Remote code: No, I am not using remote code.
All code ships in the package, including the WebAssembly module (Rust compiled to wasm). The page CSP's 'wasm-unsafe-eval' is only there to compile that bundled module. No JavaScript or WebAssembly is ever fetched. The extension fetches data (JSON and CBOR) from its developer's Cardano server, Koios, giveme.my, CoinGecko (ADA's price) and, for swaps, Minswap's aggregator, and an NFT's image file from Blockfrost's IPFS gateway when the user asks to see it. One kind of that data is evaluated: a DEX order's validator, a Cardano Plutus script that, for most DEXes, is read from the blockchain through those servers. Before the wallet signs a swap, and when the user stops one, its bundled Plutus evaluator runs that script on the order's cancel, to check the cancel works and what it costs. A script is used only if it hashes to the value the package pins (orders.json), and the evaluator is a pure interpreter: a script gets no access to the browser, the network or the extension.
Why it stays No (1.3.0’s release review, C38): the dashboard asks about JavaScript or WebAssembly that isn’t in the package. A DEX’s Plutus validator is neither: it runs only in the wallet’s own evaluator, and only when its hash is the one the package pins. The text above says so rather than “never code”, which stopped being true when Stop’s cancel began measuring each order’s own script (chunk 24). It comes to 983 characters.
Data usage. Check these two, then the two under them, and leave the rest unchecked:
mainnet.seedelf.logicalmechanism.io, and Koios when it can’t answer; on preprod Koios) and giveme.my, to read the chain and to send transactions. The public account’s DRep ID and its votes are sent to that server when the user opens Staking or the governance actions. An NFT whose image the user asks to see is named to it and, for its image, to Blockfrost’s IPFS gateway. giveme.my and the mainnet server are the developer’s own services: giveme.my receives each private transaction, and the server every transaction and the public account’s reads, with the IP address. When the user connects a site, it sees the public account’s addresses, balance and UTxOs, and what the user signs for it; a site the user also gives governance access (CIP-95) gets the DRep public key. For a swap, Minswap’s aggregator gets the one-time account’s address and the tokens and amounts, and builds the swap for it. CoinGecko is asked only for ADA’s price, and gets nothing about the wallet.Two more to decide, both recommended checked. Google’s User Data FAQ answers “Do I have to disclose data handled locally?” with “Yes. Extensions are required to disclose how they handle user data, even when data is processed or stored locally on a user’s device and is not transmitted to external servers or third parties,” and defines handle as “collecting, transmitting, using, or sharing”. Over-declaring costs a fuller privacy label; under-declaring is what gets an extension pulled.
DappSite { origin, connectedAt, title } for each one: the site’s address, when it was connected, and the page’s title as it asked to connect (from Chrome’s tab, one line, at most 80 characters). It’s sealed on the device and never sent anywhere, but that’s the shape Google’s Web history covers, field for field (“the list of web pages a user has visited, as well as associated data such as page title and time of visit”), and the FAQ above says local-only doesn’t exempt it. It’s the user’s own connection list, not browsing they didn’t choose — say so in the policy rather than leaving the box clear.If either is left unchecked, write the reason here before submitting, so the next release doesn’t quietly reopen it.
Personally identifiable information stays unchecked, as the launch review left it: contact and account names are the user’s own labels, sealed on the device, and a DRep profile’s name goes into a file the user downloads and publishes, which the wallet never keeps or sends.
Then certify all three statements: no selling or transferring data outside the approved use cases, no use unrelated to the single purpose, and no creditworthiness or lending use.
Privacy policy URL:
https://github.com/logical-mechanism/Seedelf-Wallet/blob/main/seedelf-platform/seedelf-web-wallet/docs/store/privacy-policy.md
It points at main: check it renders there (200) before submitting. The wallet’s own Settings link is the same URL, so the two never drift. Use the rendered blob link, not raw.githubusercontent.com: the dashboard wants a page a person can read, and raw serves text/plain markdown source.
Paste this if the dashboard asks for test instructions:
The wallet opens on Cardano mainnet, where ADA is real money. Nothing needs an account or real funds to review: everything below works on preprod, Cardano's test network.
1. Click the toolbar icon: the wallet opens in a tab.
2. On the welcome screen, under Create and Restore, set Network to Preprod. Every screen then shows a PREPROD badge and a strip saying its ADA has no value.
3. To see a wallet with test funds: choose "Restore wallet" and paste the standard public BIP39 test phrase:
abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about
Set any password.
4. Home now shows the phrase's preprod balances. The phrase is public, so its funds are shared test ADA: never send real funds to it on mainnet.
Settings (the gear) switches the network too, under Network: it says first what the other network is.
To see an empty wallet instead, choose "Create new wallet": reveal and write down the phrase, confirm three of its words, then set a password.
The wallet contacts only its developer's Cardano server (mainnet.seedelf.logicalmechanism.io, on mainnet), Koios (api.koios.rest on mainnet when that server can't answer, preprod.koios.rest on preprod), www.giveme.my, CoinGecko (api.coingecko.com, on mainnet, for ADA's price), for a swap, Minswap's aggregator (agg-api.minswap.org on mainnet, aggr.monorepo-testnet-preprod.minswap.org on preprod), and for an NFT's image the user asks to see, Blockfrost's IPFS gateway (ipfs.blockfrost.dev).
extension/package.json (development.md, step 1), and the manifest takes it from there. Never bump it on main at upload: the zip is built from the merge commit in a clean tree.npm run build && npm run store:images in extension/. It makes the screenshots in all three languages.
e2e/store-images.spec.ts makes them from the test fixtures and the public test phrase, so no real wallet appears.