Privacy Policy

Effective date: July 26, 2026

Origin Wallet is a self-custody browser extension for managing crypto and tokenized stock assets on EVM-compatible blockchains. This policy describes exactly what data the extension handles, where it goes, and what it does not do.

Data that stays on your device

Origin Wallet generates a BIP-39 mnemonic seed phrase on your machine using the browser's built-in cryptographic random number generator. The seed phrase is encrypted with AES-256-GCM using a key derived from your password via PBKDF2-SHA256 (310,000 iterations). Only the encrypted ciphertext is stored. It is saved in chrome.storage.local, which is sandboxed to the extension on your device.

Private keys are derived in memory from the decrypted seed phrase when the wallet is unlocked. They are never written to disk in plaintext and are cleared when the wallet locks (either manually or after a configurable idle timeout).

Session state (the fact that the wallet is unlocked) is held in chrome.storage.session, a memory-only storage area provided by Chrome that is never persisted to disk.

Your seed phrase, private keys, and password are never transmitted to any server.

Network requests the extension makes

Origin Wallet communicates with external services only for blockchain operations and price data. These are the destinations and why each is contacted:

• User-configured RPC endpoints (default: rpc.mainnet.chain.robinhood.com, eth.llamarpc.com, mainnet.base.org, arb1.arbitrum.io) -- to read balances, estimate gas, broadcast signed transactions, and interact with smart contracts on the networks you use.
• robinhoodchain.blockscout.com -- to retrieve ERC-20 token metadata (names, symbols, logos) and transaction history for the Activity feed.
• query1.finance.yahoo.com -- to fetch current prices and daily price changes for tokenized stock assets (TSLA, NVDA, AAPL and others).
• api.coingecko.com -- to fetch the current ETH/USD price for portfolio valuation.

These requests contain only the data necessary for the query (wallet addresses, token contract addresses, or ticker symbols). No telemetry, device identifiers, analytics tokens, or personal information is included.

DApp connections

Origin Wallet injects an EIP-1193 provider (window.ethereum) into web pages so that decentralized applications can request your wallet address and propose transactions. Every connection and every transaction must be explicitly approved by you through a popup confirmation screen. You can review and revoke connected sites at any time from Settings.

What the extension does not do

• It does not collect analytics or telemetry of any kind.
• It does not create user accounts or require registration.
• It does not transmit your seed phrase, private keys, or password.
• It does not track browsing history or page content.
• It does not display advertisements.
• It does not load or execute remote code. All extension code is bundled at build time.

Permissions and why they are needed

The extension declares the following permissions in its manifest:

• storage -- to persist the encrypted wallet vault, user settings (selected network, custom tokens, connected sites, auto-lock timer), and cached portfolio data in chrome.storage.local and chrome.storage.session.
• activeTab -- to detect the current tab's origin when a dApp requests a wallet connection, so the approval popup can show you which site is asking for access.
• sidePanel -- to allow the wallet to open as a panel docked to the side of the browser window, so you can view your portfolio and swap tokens while browsing.
• Host permissions (<all_urls> and specific API domains) -- the content script is injected into all pages to provide the window.ethereum provider that dApps use to interact with your wallet. The specific API domain permissions allow the extension to fetch price data and blockchain information from the services listed above.

Content scripts

A content script runs on every page you visit. Its only purpose is to inject the EIP-1193 wallet provider and relay messages between the page and the extension's background service worker. It does not read, modify, or collect page content.

Third-party services

Origin Wallet does not share data with third parties. The network requests described above are direct API calls to fetch publicly available blockchain and price data. No user data is sent to those services beyond the parameters required for the query.

Data retention

All data is stored locally on your device. Uninstalling the extension removes all stored data. There is nothing on a server to delete because no data is ever sent to one.

Changes to this policy

If this policy changes, the updated version will be published at this URL with a new effective date. The extension itself does not auto-update this policy -- it is a static page maintained by the developer.

Contact

If you have questions about this privacy policy or about how Origin Wallet handles data, contact us at fordbusy@gmail.com.