Seedelf-Wallet

Seedelf Wallet privacy policy

Effective 12 October 2026 (updated for mainnet, the network switch, Lovejoin, a privacy review, what removing the wallet keeps, NFT images, being your own DRep, several public accounts, the language, a governance action’s text, pages already open when sites can connect, the links to GitHub, Chrome’s Translate, a swap’s orders read from Koios, nothing kept in your browser’s cache, the DEX order scripts the wallet runs, our own server for mainnet, what made your Lovejoin boxes asked of Koios alone, finding private sessions’ money after a restore, your collateral payments named in Activity, and the Koios-only switch kept when the wallet is removed: see Changes). This policy covers the Seedelf Wallet browser extension, published by Logical Mechanism LLC.

In short: no accounts, analytics, crash reports or ads. Two services the wallet uses are ours. On mainnet, it reads Cardano and sends your transactions through our server, mainnet.seedelf.logicalmechanism.io, which sees your IP address, your public account and each transaction you send, and logs neither your IP address nor what you ask. giveme.my receives your IP address and each private transaction you send, to add its collateral. Neither ever gets your recovery phrase or your keys. To work, the extension also talks to Koios, a public Cardano API: on preprod for everything, and on mainnet for anything our server can’t answer, or for everything if you turn our server off in Settings. On mainnet it also talks to CoinGecko, for ADA’s price. When you swap, it also talks to Minswap, and when you ask to see an NFT’s image, to Blockfrost’s IPFS gateway. Nothing else: Lovejoin, the mixer, is a contract on the Cardano blockchain, reached through those servers. Sites see your public account, or a private session’s account, only if you turn on connecting sites and connect them.

The extension runs on Cardano mainnet, and can switch to preprod, Cardano’s test network, on the welcome screen or in Settings. Everything below applies to both; each network has its own services’ addresses, listed below. The Cardano server, below, is the one the wallet reads the blockchain and sends transactions through: on mainnet ours, and Koios for anything ours can’t answer, or for everything if you turn ours off; on preprod, Koios.

What the extension handles

Data	Why	Where it stays or goes
Your recovery phrase	It holds your keys.	On your device only. It’s encrypted with your password (Argon2id and ChaCha20-Poly1305) in the browser’s storage for this extension. While the wallet is unlocked, the key material sits in memory-only session storage, which is cleared when you lock the wallet or close the browser. It is never sent anywhere.
Your password	It unlocks the wallet.	Never stored or sent.
Your addresses, balances and transactions	To show your balance, and to build, check and send your transactions.	Sent to the Cardano server, to read the Cardano blockchain and to submit the transactions you approve, all from your IP address. Seedelf spends also go to giveme.my, which adds shared collateral.
Which Seedelf UTxOs are yours	To show your Seedelf balance.	Worked out on your device. On mainnet, which are yours, as of your last reading, also stays on your device across a lock, encrypted like your contacts, so an unlock reads only what changed since; otherwise it’s kept in session storage and cleared when you lock. Nobody is told until you spend one: the Cardano server and giveme.my see each one you spend.
Your contacts, your Seedelf history, who paid for each Seedelf you create, the UTxOs you lock, the payments that set your collateral, and the list of your public accounts, with the names you give them	To name who you pay, list what you sent and received, keep money with different histories apart, remove a Seedelf to the side that paid for it, keep the UTxOs you chose out of your payments, name your collateral payments in Activity, and offer your public accounts by name.	On your device only, encrypted with a key derived from your recovery phrase, so they can’t be read while the wallet is locked. Removing the wallet deletes them.
A payment you send	To hold other payments back while one the network may still take is unsettled, so the same money isn’t paid twice: the wallet keeps it from just before it goes out until it’s settled.	On your device only, encrypted like your contacts: the signed transaction, what it spends and what it pays. It’s deleted once the network takes or refuses it, or once one the Cardano server didn’t answer lands or can no longer land. Removing the wallet, or restoring it after a forgotten password, keeps one that may still go through, encrypted, until a wallet is next created or restored in this browser: the same recovery phrase’s watches it again, and any other deletes it.
An ADA Handle you withdraw to	To find the address it belongs to.	Sent to the Cardano server, which looks up who holds the handle. Pasting an address instead asks it nothing.
Your staking: your pool, where your voting power goes, your rewards	To show them, and to build the staking changes you approve.	Sent to the Cardano server, as your stake address. A pool or a DRep you look up is sent to it too. Like every transaction, a staking change is public once it’s on the blockchain.
Your public account’s DRep: its ID, whether or not you make the account one, and if you do, its votes and a profile if you give it one	To show where it stands and how it voted, and to build the registration, votes and changes you approve.	Sent to the Cardano server, as the DRep’s ID, each time you open Staking or the governance actions, even if you’ve never registered it. A DRep and every vote are public once they’re on the blockchain, and tied to your public account. A profile is a file you publish yourself, at an address you choose: the wallet writes it on your device and never sends or fetches it.
Your settings (whether payments spend your staking rewards, hiding the balances, how long the wallet stays unlocked, the currency, which is US dollars unless you change it, whether sites can connect, which of your public accounts they use, and whether signing for one needs your password, whether private sessions come back through Lovejoin, how deep it mixes and how long its boxes wait, whether the wallet reads Cardano through Koios only, where the wallet opens, which network and which public account it’s on, and its language) and the list of stake pools, and the open governance actions	To remember your choices, and to browse pools and governance actions without asking the Cardano server each time.	On your device only. The pool list and the governance actions are the same for everyone. ADA’s price is kept in memory-only session storage, for five minutes. Your settings aren’t encrypted, so anyone who can read this browser’s storage can see them. Removing the wallet, or restoring it after a forgotten password, deletes your settings, the pool list and the governance actions, except where the wallet opens, which network it’s on, whether it reads Cardano through Koios only, and its language, which are the browser’s; which public account it was on stays too, until a wallet is next created or restored in this browser. Choosing a language asks no one: every language ships in the extension.
A note you add to a payment	To say what the payment is for.	Written on the transaction, where anyone can read it once it’s on the blockchain.
Your Activity, saved as a file	Only when you choose Save as CSV.	A file on your device, not encrypted. The extension doesn’t send it anywhere. Each row has its transaction’s ID, so whoever has the file can find every one on the blockchain: for your private side, that ties your private payments, your private sessions and your Lovejoin boxes to each other and to your public account.
The number of failed unlocks	To slow down password guessing.	On your device only.
An NFT’s image	Only when you press Show image on an NFT, one at a time: to show it.	Sent to the Cardano server, which NFT, to read its metadata, and when the image is on IPFS, to Blockfrost’s IPFS gateway, which file, both from your IP address. For an NFT in your private balance, either one can tie your IP address to the UTxO that holds it, and the wallet says so before you press it. The image stays in that window until you lock the wallet, and isn’t saved on your device. An image on any other server isn’t fetched: the wallet shows its address, which you can copy.
A swap you make	Only when you swap: to quote it and build it.	Sent to Minswap: the tokens and amounts, a token you search for that isn’t on the wallet’s own list, and the one-time account the swap runs from, which is funded from your private balance: your public account isn’t in the swap’s transactions, though anyone can follow its funding back into your private balance. Your IP address lets Minswap group your swaps. Half and Max round down, but still tell it roughly how much your private balance holds. The list of your swaps, their one-time accounts and their transactions, stays on your device only, encrypted like your contacts. The one-time account’s UTxOs are read from the Cardano server.
Your Lovejoin boxes	Only when ADA goes through Lovejoin (a private session’s return, which you can turn off in Settings, or a mix you start): to bring each box back later, into your private balance.	On the blockchain, as every transaction is: the deposit, the mixes and each box’s way back. Lovejoin makes the way back harder to tie to where the box went in, for people reading the blockchain. It doesn’t hide the trip from the Cardano server or giveme.my, which see your device send both ends. When each box is due back, each mix the wallet sends, and a box being brought back until it’s settled, stay on your device only, encrypted like your contacts. Removing the wallet while it’s unlocked keeps one thing of these: a mix from your public account that stopped at a transaction that may have gone through (what it spends and its ID), encrypted, until a wallet is next created or restored in this browser. The same recovery phrase’s looks for it on the blockchain before another mix from the account is built, and any other deletes it. Restoring after a forgotten password doesn’t add one. Lovejoin’s pool is read from the Cardano server; which boxes are yours is worked out on your device. For a box the wallet has no record of (after a restore, or one someone else’s mix moved), it learns what put it where it is, to tell whether it was mixed: after a restore, and before bringing such a box back or mixing it again. Our server says so for every box in the pool alike; but Koios, when it answers instead, is asked about that box’s transaction, and then knows that box is yours. What either said stays on your device, encrypted like your contacts.
The sites you connect, and what they ask for	Only if you turn on Let sites connect to Seedelf Wallet in Settings: a site can then ask to connect, and to have transactions or messages signed.	A site connected to your public account sees it: the public account you choose for sites in Settings, whichever one you’re using, with its addresses, balance and UTxOs, and what you sign for it. Changing that account shows every connected site the new one. Or, if you choose a private session when it connects, it’s given only that session’s one-time account, funded from your private balance with what you choose. Governance access (CIP-95) is given only if the site asks for it and you switch it on when it connects (it’s off by default): the site then learns your public account’s DRep public key and whether your stake key is registered, and can ask you to sign your DRep’s registration, votes and messages. It’s never given your private balance or your Seedelfs; the funding itself is public, and anyone, the site included, can follow it back into your private balance. Like any website, a site also sees your IP address and this browser. The list of connected sites, with the title each page had as it asked to connect, stays on your device only, encrypted like your contacts, and a private session forgets its site when you disconnect it, unless something it can’t bring back is still at the session’s account. Signing a site’s transaction that spends someone else’s UTxOs asks the Cardano server about those UTxOs.

The services the extension talks to

Every request goes without your browser’s cookies or a referrer, and none is kept in your browser’s cache. Chrome remembers for up to two hours, in memory, that our Cardano server accepts the wallet’s requests that send it something (a check browsers make before such a request), so later ones skip that step. It keeps each such request’s address, never what it sends, and it’s gone when the browser closes.

• The Cardano server, which the wallet reads the blockchain and sends your transactions through:
  • On mainnet, ours: mainnet.seedelf.logicalmechanism.io, run by Logical Mechanism, who publish this extension, on a DigitalOcean server in New York. It reads a Cardano node, db-sync and Kupo that Logical Mechanism runs elsewhere, which never see you: only our server reaches them. A transaction you send reaches the network from Logical Mechanism’s stake pool relay, whose address its registration already publishes.
    • Neither its web server nor its API logs your IP address or what you ask. It holds your IP address in memory only, to limit how often one address can ask, and keeps no record of it. DigitalOcean, which hosts it, sees connections to it, not what’s in them.
    • Its name is seen on your network: your internet provider, your Wi-Fi’s owner or your DNS service can tell from it that this device uses Seedelf Wallet on mainnet, and when, though not what it asks.
    • Whatever part it can’t answer, the wallet asks Koios instead, for five minutes, then ours again. Read Cardano through Koios only, in Settings → Network, turns ours off.
  • Koios (api.koios.rest on mainnet, preprod.koios.rest on preprod), a public Cardano API run by the Koios community: everything on preprod, and on mainnet whatever ours can’t answer, or everything with that switch on.
  • Whichever answers sees your IP address and what the wallet asks: your public account and its staking, one account at a time (though while a connected site uses a different public account from the one you’re looking at, it sees both, from one IP address), the whole Seedelf contract (from ours, what changed since your last reading, which tells it roughly when that was), Lovejoin’s pool when you use Lovejoin, and at times what made some of your Lovejoin boxes (below), the pools and DReps you look at, your own DRep and its votes, each NFT whose image you ask to see, and the transactions you submit, with a check of each one’s status.
  • After a restore, or when you ask, the wallet looks for your recovery phrase’s other public accounts: one request for each account, never one for all of them, but from one IP address seconds apart, so the Cardano server can still guess they’re one wallet’s.
  • After a restore, on the network you restore on, or when you press Find leftovers on the dApps page, it also looks for what your private sessions’ one-time accounts still hold: it asks the Cardano server about those accounts 20 at a time, those your next private sessions will use among them, then about the used ones’ money, transactions and orders, all from one IP address, so the server can tell they’re one wallet’s, the sessions you open next too, once they’re funded. The sessions it finds join your list of swaps, and whether it has finished looking on each network is kept with that list, on your device only, encrypted like your contacts.
  • From what the wallet reads, it can tell that your Cardano account uses Seedelf, and guess that you use Lovejoin, but not which Seedelf UTxOs are yours: that check runs on your device. Nor, from reading the pool, which Lovejoin boxes are yours. But when the wallet has no record of how one of your boxes went into the pool (after a restore, or a box someone else’s mix has moved), and Koios is answering, it asks Koios about the transaction that made it before bringing it back or mixing it again, and after a restore about all such boxes together. That tells Koios which boxes are yours, from your IP address. Ours answers that for every box in the pool alike, so it learns nothing from it. While a transaction of yours that touches your private balance or Lovejoin is on its way, ours is asked every five seconds what changed, so it can tell you’re waiting for one, not which. But every transaction goes to the Cardano server to be sent, from the same IP address that reads your public account. So it can see which private UTxOs and Lovejoin boxes you spend, and the new ones they pay into, and tie them to your public account. That includes both ends of Lovejoin.
  • Two reviews go to it before you press Send: creating a Seedelf paid by your public account, whose draft shows it the Seedelf’s tag, and a Lovejoin mix or return, whose first mix it measures.
  • The wallet asks the network it’s on. It asks the other only to finish what you started there: a payment on its way, a swap, or a Lovejoin mix or box.
• giveme.my (www.giveme.my, at /mainnet/collateral/ or /preprod/collateral/), a collateral service for Seedelf transactions, run by Logical Mechanism, who publish this extension.
  • It sees your IP address and each Seedelf transaction it adds collateral to, before it’s on the blockchain: each private payment, each private session’s funding, and each Lovejoin box you bring back. From one IP address it can group them as one person’s, including a session’s funding with its Lovejoin boxes coming back.
  • Shared collateral keeps your own address out of those transactions.
  • Its own logs leave out raw IP addresses, and the transaction’s hash whenever it adds collateral. The platform it runs on may keep its own request logs.
• Minswap (agg-api.minswap.org on mainnet, aggr.monorepo-testnet-preprod.minswap.org on preprod), only when you swap. Its aggregator quotes the swap and builds it for the swap’s one-time account. The wallet doesn’t ask it for that account’s orders, or to cancel one: it reads them from the Cardano server and cancels them itself.
  • It sees your IP address, a token you search for that isn’t on the wallet’s own list, and each swap: its tokens and amounts and the one-time account’s address.
  • It isn’t told your private balance or your public account, but your IP address lets it group your swaps, and tie them to anything else done at Minswap from that address.
• CoinGecko (api.coingecko.com), on mainnet only, for ADA’s price in the currency you chose (US dollars unless you change it).
  • It sees your IP address, and a request for ADA’s price when Home or the swap form opens, at most every five minutes. It’s told nothing about your wallet.
  • Choosing no currency in Settings stops it. On preprod it’s never contacted: test ADA has no price.
• Blockfrost’s IPFS gateway (ipfs.blockfrost.dev, on both networks), only when you press Show image on an NFT whose image is on IPFS. The first time, Chrome asks you to let the wallet reach it, unless the access you gave for connecting sites already covers it. A governance action’s full text on IPFS opens there too, as a link (below).
  • It sees your IP address and which image file you ask for, which names that NFT. It’s told nothing else about your wallet.
  • Nothing is fetched from it until you press the button, and the wallet keeps nothing it sends on your device past locking.
• Cardanoscan (cardanoscan.io on mainnet, preprod.cardanoscan.io on preprod), a blockchain explorer, only when you click a link to a transaction or an address. It opens in your browser, which then sends it your IP address and its own cookies, and keeps the page in your browser history. On a private transaction, the link says so.
• A governance action’s full text, only when you click Read its full text on one whose text is on IPFS. It opens in your browser through Blockfrost’s IPFS gateway, which then gets your IP address and its own cookies, and the page stays in your browser history. A text anywhere else isn’t opened: the wallet shows its address, which you can copy.
• GitHub (github.com), only when you open Source code, Privacy policy or Report a translation error in Settings. It opens in your browser, which then sends it your IP address and its own cookies, and keeps the page in your browser history. The link carries nothing about your wallet. An issue you open there is public, under your GitHub account.

Each service’s own policy covers what it receives. Our Cardano server and giveme.my are ours; Koios, Minswap, CoinGecko, Blockfrost, Cardanoscan and GitHub aren’t, and we don’t control them. A VPN hides your IP address, not that your requests come from one wallet: the wallet reads your account and sends your private payments through the same connection.

If you use Chrome’s Translate on the wallet, Chrome sends the page’s text to Google, your balances and addresses among it. The wallet doesn’t turn Translate off: it speaks English, Spanish and Japanese, and using it in one of those avoids it.

Lovejoin isn’t a service: it’s a contract on the Cardano blockchain, and the wallet builds and signs its transactions itself, reading the chain through the Cardano server. Lovejoin’s makers also run giveme.my, which sees each box you bring back with your IP address, and our Cardano server, which on mainnet sends each of Lovejoin’s transactions the wallet makes. Lovejoin has had no third-party audit, only its makers’ own review.

Transactions are public. Anything you submit is recorded on the Cardano blockchain, as with any wallet: amounts, tokens, timing, and which transactions spend which outputs. Seedelf hides who owns a UTxO from people reading the blockchain, and Lovejoin makes it harder for them to tell which box coming out was yours, not those. A box hides only among other people’s boxes that come back into a Seedelf around the same time, one of up to 9 at the default depth and fewer while few people use Lovejoin, and not from the Cardano server or giveme.my. Spending boxes that came back together narrows it, and so does bringing one back soon after its mixes.

Preprod and mainnet share your keys. The same recovery phrase has the same keys on both networks, so anyone comparing the two blockchains can tell your preprod account is your mainnet one. Test on preprod with a phrase you don’t use on mainnet if that matters to you.

What we don’t do

• We don’t collect, sell or share any data. Our two services receive what’s above, our Cardano server to answer the wallet and pass its transactions on, and giveme.my to add its collateral, and nothing else.
• We don’t track what you do in the extension or on other websites.
• The extension doesn’t read web pages. Only if you turn on connecting sites does it add the standard Cardano wallet entry (window.cardano.seedelf) to https pages, and nothing else: to pages already open as you turn it on, and to those you open after. Turning it off stops that; a page still open keeps the entry until it’s reloaded, and it refuses every call. While it’s on, every https site you open, and the scripts on it, can see that you use Seedelf Wallet, even sites you never connect (not your addresses or balance until you connect).
• The extension never fetches JavaScript or WebAssembly to run: its code all ships in its package. The one program it takes from outside is a DEX order’s script, read from the Cardano blockchain, which the wallet’s own evaluator runs to check that it can cancel a swap’s order. That evaluator gives the script no access to your browser, and runs it only if it matches the hash the package carries.

Your control

• Everything the extension keeps is in your browser.
• Removing the extension deletes its storage, including the encrypted wallet. Keep your recovery phrase: it’s the only way back in.
• The Chrome Web Store and Chrome itself know this extension is installed in your browser, and Chrome Sync, if it syncs your extensions, installs it in your other signed-in browsers. Only the extension is synced, never your wallet.
• While the wallet is unlocked, anyone using your browser can see your balances and history, and someone who knows Chrome’s developer tools can read your keys. Lock the wallet (or close the browser) before leaving it.

Changes

If the extension’s data handling changes, we’ll update this page and its date, and list the change under Changes below, before the new version ships.

• 12 October 2026: removing the wallet, or restoring it after a forgotten password, keeps Read Cardano through Koios only, as it keeps the network: with it on, the restore after it asks Koios alone, its look for your other public accounts and for your private sessions’ money included. Before, it went back to off, so on mainnet that restore asked our server. After a restore, the wallet also keeps, encrypted like your contacts, whether its look for your private sessions’ money has finished on each network, so the wallet can say when it hasn’t. And this page now says that the look asks about the one-time accounts your next private sessions will use too, so the server can tell those sessions are this wallet’s once they’re funded: the 11 October entry left that out.
• 12 October 2026: the wallet keeps the IDs of the payments that set each public account’s collateral, the newest 20, on your device only, encrypted like your contacts, so Activity names them Set collateral rather than Sent, or Withdrew rewards when one collected the staking rewards. Nothing new is sent.
• 11 October 2026: after a restore, on the network you restore on, or when you press Find leftovers on the dApps page, the wallet looks for what your private sessions’ one-time accounts still hold, which a restore didn’t find before. It asks the Cardano server about those accounts 20 at a time, then about the used ones’ money, transactions and orders, from one IP address, so the server can tell they’re one wallet’s. The sessions it finds join your list of swaps, on your device only, encrypted like your contacts.
• 10 October 2026: when the wallet has no record of what made one of your Lovejoin boxes, it asks Koios alone, as this page says. Before, while the wallet was reading the pool through Koios but our server’s other parts still answered, our server could be asked instead, and so learn which boxes are yours.
• 10 October 2026: on mainnet, the wallet reads Cardano and sends your transactions through our own server first, mainnet.seedelf.logicalmechanism.io, run by Logical Mechanism, and through Koios for any part it can’t answer; Read Cardano through Koios only, in Settings → Network, turns it off, and preprod still reads Koios alone. Our server sees what Koios saw: your IP address, your public account and the transactions you send. It logs neither your IP address nor what you ask, holds your IP address in memory only, to limit requests, and passes your transactions to the network through Logical Mechanism’s stake pool relay. Asked what changed in the Seedelf contract since your last reading, it learns roughly when that was, and while a private transaction of yours is on its way, that you’re waiting for one. It says what made every Lovejoin box alike, so asking which went in by a deposit no longer tells anyone which boxes are yours, unless Koios answers instead. On mainnet, which Seedelf UTxOs are yours, as of your last reading, now stays on your device across a lock, encrypted like your contacts, so an unlock reads only what changed. Its name, seen on your network, tells your internet provider or DNS service that the device uses Seedelf Wallet on mainnet. And Chrome now remembers, in memory, for up to two hours, that our server accepts the wallet’s requests that send it something, by their addresses, so each skips a check; our server’s answers still aren’t kept in your browser’s cache.
• 8 October 2026: corrects what this page said about code. The extension never fetches JavaScript or WebAssembly to run, but since the wallet builds a swap’s cancel itself, it runs a DEX order’s script, read from the blockchain, in its own evaluator, and only one that matches the hash the extension carries. Before, this page said it ran no code from outside its package.
• 7 October 2026: no request to a service is kept in your browser’s cache. Before, Chrome could keep one on the disk, including a few that name an ADA Handle you looked up or your DRep ID; only an NFT’s image was kept out.
• 7 October 2026: a swap’s orders are no longer looked up or cancelled through Minswap. The wallet reads them from Koios, which already sees the one-time account and its transactions, and builds and signs the cancel itself; Minswap is no longer sent the account’s address to list its orders.
• 6 October 2026: says that the wallet asks Koios about your public account’s DRep, by its ID, whether or not you’ve made the account one; and names GitHub, which the links in Settings to the source code, this policy and Report a translation error open in your browser, and where an issue you open is public; and says that Chrome’s Translate, used on the wallet’s page, sends its text to Google.
• 5 October 2026: turning on connecting sites now adds the wallet’s entry to https pages already open as well as those you open after, so every open page can see at that moment that you use Seedelf Wallet; turning it off stops it being added, and a page still open keeps it until it’s reloaded, refusing every call. The list of connected sites also keeps the title each page had as it asked to connect, encrypted like the rest of the list. A site you decline has to wait before it can ask again: the wallet keeps the declined site’s address and its wait in the browser’s memory-only session storage, which closing the browser clears.
• 5 October 2026: a governance action’s full text, when it’s on IPFS, opens as a link through Blockfrost’s IPFS gateway, which gets your IP address and its own cookies, and keeps it in your browser history; a text on any other server is only shown, to copy.
• 4 October 2026: several public accounts and the language. The wallet keeps the list of your public accounts, and the names you give them, encrypted like your contacts. Which public account it’s on, which one connected sites use, and the language are kept on your device unencrypted, like the network; removing the wallet keeps the language, and which public account it was on until a wallet is next created or restored in this browser. After a restore, or when you ask, it asks Koios about each public account separately, one request each, which Koios sees from one IP address seconds apart. Connected sites use the public account you choose in Settings, and changing it shows them the new one; while that’s a different account from the one you’re looking at, Koios sees both from one IP address. Choosing a language asks no one: every language ships in the extension.
• 4 October 2026: being your own DRep: the wallet asks Koios about your public account’s DRep, by its ID, when you open Staking and governance or the governance actions, and about its votes; the open governance actions are kept on your device for an hour, and removing the wallet deletes them. A DRep and every vote are public on the blockchain and tied to your public account. A profile is a file you publish yourself: the wallet never sends or fetches it. A site you give governance access (CIP-95) learns your DRep’s public key and whether your stake key is registered, and can ask you to sign with your DRep key.
• 4 October 2026: an NFT’s image, shown only when you press Show image on it: the wallet asks Koios for that NFT’s metadata and fetches the image from Blockfrost’s IPFS gateway, which both see with your IP address, and for an NFT in your private balance can tie your IP address to the UTxO holding it. Images on other servers aren’t fetched. Nothing of it is kept on your device past locking the wallet.
• 28 September 2026: removing the wallet, or restoring it after a forgotten password, keeps the encrypted record of a payment that may still go through until a wallet is next created or restored in this browser, so restoring the same recovery phrase here watches it again; removing the wallet while it’s unlocked keeps, the same way, a mix from your public account that may have gone through; and a private session’s record keeps its site only while something left behind is still at its account. For a Lovejoin box it has no record of (after a restore, or one someone else’s mix moved), the wallet now asks Koios what made it, which tells Koios that box is yours, and keeps the answer encrypted on your device.
• 27 September 2026: says that giveme.my is ours, and what it and Koios can see of your private payments and Lovejoin boxes; what Lovejoin hides and from whom; what a connected site, Minswap and Cardanoscan can still learn; the Lovejoin switch and the records of who paid for a Seedelf; and what Chrome and your device know. The wallet also stopped sending cookies with its requests.

Contact

Open an issue at https://github.com/logical-mechanism/Seedelf-Wallet/issues, or email support@logicalmechanism.io.

This site is open source. Improve this page.