Privacy Policy
This Privacy Policy describes how information is handled when the user uses Sigma Wallet. It reflects the actual technical architecture of the tool: a static front end with no user-account system and no third-party analytics vendors. A small first-party visit signal (described below) may be sent to the maintainers' support tooling so the support team can measure usage; the user may turn that signal off.
User data belongs to the user. The maintainers do not own, sell or centrally store the user's keys, browser data, vault contents or on-chain history. The user assumes all risk associated with use of the Service and should conduct independent due diligence and research before transmitting personal or financial information to any party — including public blockchains, on which records cannot be erased.
1. No application backend for vaults or accounts
Sigma Wallet is primarily a static website (HTML, JavaScript and CSS). The maintainers operate no user-account database and do not custody keys or vault funds. The web host that delivers these files may retain standard access logs (IP address, time, requested file, browser type) for security and abuse-prevention purposes. Any access logs retained by the static-file web host (Cloudflare Pages) are used solely for security and abuse prevention and are retained only in accordance with that host's standard rotation practice. Separately, first-party visit hashes described in the Privacy Policy may be written to Cloudflare Analytics Engine.
2. First-party visit analytics (support team)
To help the support team understand how the site is used (for example rough visit volume and which paths are opened), the front end may:
- Derive a one-way hash from a timestamp and coarse device signals available in the browser (such as screen size, timezone and language);
- Place that hash in the page URL as a query parameter (
v) so successive visits can be distinguished without sending the raw fingerprint; - Optionally POST only that hash and the current path to a first-party endpoint on the same site, which may write the hash, path, coarse country (from the CDN edge) and a time value into Cloudflare Analytics Engine.
The user may refuse to reveal this signal to the backend. A control in the site footer ("Share visit analytics with support") can be turned off. When off, the application still may keep a local URL hash in the browser address bar, but it will not POST the hash or path to the first-party endpoint. The preference is stored only in the user's browser (sigma_visit_analytics in localStorage). No marketing cookies are used for this purpose. Raw fingerprint material is not sent to the maintainers.
3. Browser storage — owned and controlled by the user
The application stores a limited set of values in the user's own browser. Such data belongs to the user, remains on the user's device, is never transmitted to the maintainers (except the optional visit hash described above when the user has not opted out), and is deleted when the user clears site data:
sigma-lang(localStorage): interface language preference.legalAcceptedVersion(localStorage): the version of these documents accepted by the user.sigma_visit_analytics(localStorage): whether the user allows the optional first-party visit POST (1= allow,0= do not reveal to backend).deployedContracts,factoryAddresses,factoryDeploymentBlocks,nftContracts(localStorage): addresses of contracts deployed or loaded by the user, for subsequent display by the application.sigma_ledger_session_v1and owner-signature entries (sessionStorage): evidence that the user signed in with a wallet during the current browser session; deleted when the tab is closed.
The wallet-connection library (Reown AppKit / WalletConnect) also retains its own connection state in browser storage in order to maintain the session.
4. On-chain data is public and resides under the user's addresses
When the user submits a transaction, the user's wallet address, transaction contents and any contract deployed by the user are recorded permanently on a public blockchain. Such data is visible to any person. The maintainers do not collect it, do not own it, and cannot alter or delete it. Rights such as erasure do not apply to public blockchain records. Smart-contract source verified on Polygonscan is public so that the user may inspect the object of interaction; such verification is not a privacy or safety warranty.
5. Third-party services
To connect a wallet and read blockchain data, the user's browser communicates directly with the services listed below. Each is subject to its own privacy policy, and the maintainers do not control how such services process data:
- Reown (WalletConnect): wallet-connection protocol and relay. The user's wallet address and connection metadata pass through its network. Reown's optional analytics are disabled in this application.
- Public blockchain RPC endpoints: polygon-rpc.com, polygon.llamarpc.com, 1rpc.io, rpc.ankr.com, polygon-bor-rpc.publicnode.com and poly-rpc.gateway.pokt.network. Such endpoints may observe the user's IP address and queried addresses.
- Etherscan / Polygonscan API: used only if the user invokes contract-verification or explorer features.
- The user's wallet (for example MetaMask), which is subject to its own privacy policy.
- Cloudflare (when the site is served via Cloudflare Pages): edge delivery, optional standard host logs, and — only if the user has not opted out — the first-party visit endpoint described above.
6. Practices not undertaken by the maintainers
- No accounts. The maintainers do not request name, email address or identity documents.
- No marketing cookies and no third-party analytics or advertising trackers. The only optional usage signal is the first-party visit hash for the support team, which the user may disable.
- No KYC; accordingly, no identity-document data is held.
- No claim of ownership over the user's keys, browser storage, vaults, funds or on-chain records.
7. Security
Because vault keys and balances are not stored on the maintainers' side, the principal privacy risks arise from the user's own device, browser and wallet, and from the third-party services described above. The user should keep such components up to date and assumes all risk associated with use of the Service.
8. Minors
The Service is not directed to persons under eighteen (18) years of age.
9. Additional regional rights
Because the Service is a static, non-custodial interface without user accounts or a backend database, the application of regional privacy regimes (including GDPR and CCPA/CPRA) may be limited. The user should seek independent counsel regarding any rights that may apply in the user's jurisdiction.
10. Amendments
The maintainers may update this policy from time to time. Material changes will be displayed prominently in the interface.
11. Contact
No public contact channel is designated. There is no registered entity for correspondence.