Privacy Policy

Veto Wallet browser extension. Last updated 31 July 2026.

The short version: Veto has no servers, no accounts and no analytics. We do not collect, receive, store or sell any of your data, because there is nowhere for it to go. Everything the extension knows stays in your browser.

What stays on your device

Your recovery phrase, encrypted with a key derived from your password using PBKDF2-SHA256 at 600,000 iterations, then AES-GCM. Only the ciphertext, the salt and the nonce are written to your browser's local storage. The phrase itself is never stored in readable form and is held in memory only while the wallet is unlocked.
Your password is never stored, transmitted or recoverable. We cannot reset it.
Your private keys are derived from the phrase in memory when you unlock, and discarded when you lock.
Your public addresses, so the wallet can show balances without unlocking.
Websites you approved to connect, stored as a list of origins.
Transfers you made from the extension, kept as a local history with the transaction hash.

What leaves your device, and where it goes

To show balances and broadcast transactions, the extension talks directly to public blockchain nodes and explorers. Your public address is sent to these services, as it must be for any wallet to function. Your phrase, keys and password are never sent anywhere.

ethereum-rpc.publicnode.com, base-rpc.publicnode.com, polygon-bor-rpc.publicnode.com, bsc-rpc.publicnode.com
rpc.mainnet.chain.robinhood.com
solana-rpc.publicnode.com
mempool.space for Bitcoin balances
sui-rpc.publicnode.com for Sui balances
api.coingecko.com for coin prices, so balances can be totalled. This request contains no address and nothing about you, only the list of coins the wallet supports.

These are third parties with their own policies, and like any node operator they can see the address being queried and the network address it was queried from.

What websites can see

The extension adds a provider to web pages so a site can ask to connect. A site receives nothing until you approve it in the extension's own window, and approval shares only your public addresses. A website can never read your phrase or your keys, and cannot move funds: every transaction is signed inside the extension.

What we do not do

No analytics, telemetry, crash reporting or fingerprinting.
No advertising, and no selling or sharing of data with anyone.
No accounts, no email, no sign up.
No remote code. All code is contained in the published package.

Deleting your data

Erasing the wallet in Settings removes the encrypted phrase and the local history from your browser. Removing the extension deletes its storage entirely. Neither can be undone by us, and neither affects funds on a blockchain, which only your recovery phrase controls.

Children

Veto is not directed at children under 13 and collects no data from anyone.

Changes

If this policy changes, the date above changes with it, and the updated version is published at this address.

Contact

Questions about this policy can be sent to the contact listed on veto.im.

Veto is unaudited software. It reduces the ways a stolen key can cost you money, but no wallet can make self custody risk free.