Privacy policy
1. Summary
OPEQ has no user accounts, no analytics, no advertising and no tracking. Your recovery words, password and keys are created and kept on your device and are never sent to OPEQ or anyone else. The only server OPEQ runs for the wallet is a pass-through connection to the Solana network, and OPEQ keeps no logs of it. The only personal data OPEQ stores is what you choose to enter on the waitlist.
2. Who is responsible
OPEQ is an independent project run by an individual developer. For any privacy question or request, write to hello@opeq.io.
3. Data that stays on your device
- Recovery words. The 24 words are generated in your browser and shown to you once. They are never stored in plain form and never transmitted.
- Encrypted wallet. The wallet secret is encrypted with your password (PBKDF2-SHA256, 600,000 rounds, then AES-256-GCM) and saved in the browser's IndexedDB, together with public data: the wallet address, the public key tree, a counter of used one-time keys and a list of one-time keys already used for moving the wallet to this device.
- Unlocked session. While a wallet is unlocked, the extension keeps the decrypted key in the browser's in-memory session storage, readable only by the extension's own pages. It is deleted when you lock the wallet, after 10 minutes without activity (a background timer removes it even when the extension is closed), or when the browser closes.
- Activity history. The last 40 wallet events (time, a short description such as "sent 0.1 SOL to Gud4…8rk", and the transaction signature) are kept in the browser's local storage so you can see them next time. They are public blockchain data and are deleted when you remove the extension.
- Preferences. The address of the wallet you used last, and the RPC address if you enter your own, are kept in local storage.
- Password. Your password is never stored. It is used only to derive the encryption key.
Removing the extension, or choosing "Remove from this browser", deletes the wallet from the browser. Funds stay on the Solana blockchain and can be recovered with the 24 words.
4. Data sent over the network
- Solana RPC, mainnet build. To show balances and send transactions, the extension calls rpc.opeq.io. This is a small service run by OPEQ on Cloudflare Workers that forwards each request to Helius (helius.dev), a Solana RPC provider. It only passes the requests the wallet needs, and OPEQ keeps no logs and stores nothing from them. Requests contain public blockchain data: your wallet address, your fee key address, the accounts being looked up and the transactions you sign. Cloudflare and Helius can see your IP address and the request, under their own privacy policies.
- Solana RPC, test build and website wallet. These call the public devnet node https://api.devnet.solana.com, operated by the Solana Foundation, with the same kind of data.
- Swap prices. When you use the Swap tab, the extension asks Jupiter (jup.ag) for a price and a route. The request contains the two tokens, the amount and your wallet address. Jupiter can see your IP address and the request, under its own privacy policy. The wallet checks every instruction Jupiter returns before it signs, and it only signs swaps that go through Jupiter's program and a fixed list of known pools.
- Your own RPC. If you enter your own RPC address in the Keys tab, the extension sends these requests there instead, and that provider's privacy policy applies.
- The blockchain. Transactions you confirm are published on the Solana blockchain. Blockchain data is public and permanent and cannot be deleted by anyone, including OPEQ. Your fee key signs every transaction as the fee payer, so transactions of one wallet can be linked to each other.
- Links you open. Explorer, faucet, website and X links open third-party sites only when you click them.
- The extension sends nothing else. It contains no analytics, crash reporting or remote code.
5. The website and the waitlist
- opeq.io is hosted on Cloudflare. Cloudflare processes connection data such as IP addresses to deliver and protect the site. OPEQ does not use cookies, analytics or tracking scripts on the website.
- If you join the waitlist, OPEQ stores the X handle, the link to your X post and the email address you enter, the time you joined, and a one-way hash of your IP address used only to limit abuse. The legal basis is your consent.
- This data is used only to contact you about OPEQ. It is kept until the waitlist closes, or until you ask for removal, whichever comes first.
6. Browser permissions
The extension requests two permissions: "storage", for the data described above, and "alarms", for the timer that deletes an unlocked session after 10 minutes. It does not read web pages, does not run on websites and has no access to your browsing history, tabs or other extensions.
7. Transactions the wallet signs
Every payment is shown to you in a confirmation window before it is signed: recipient, amount, token mint, network fee, and any SOL moved to your fee key. Three kinds of transaction are signed without a separate window, and none of them sends funds to anyone else:
- Activation. After you press Activate, the SOL left on the activation address is moved into your own wallet.
- Separate fee top-up. When the confirmation window says a top-up goes as a separate transaction, it is signed just before your payment.
- Burn after a failed send. If a payment fails after it was signed, the wallet uses up that one-time key with an empty transaction, so the failed signature can never be replayed. It costs only the network fee.
8. Security and how the program is governed
Keys are generated and used only inside your browser, and the extension's content security policy blocks remote code. OPEQ on mainnet is a beta: start with small amounts. If you lose both your password and your 24 words, nobody can recover the wallet.
The OPEQ program on mainnet can be upgraded. The upgrade key is itself an OPEQ wallet, protected by hash-based signatures, held by the developer. An upgrade can change how the program behaves, including how it handles funds in OPEQ wallets. Upgrades are used only to fix problems and will be announced on @opeqio. The program that holds this key cannot be changed by anyone.
9. What OPEQ never does
- Sell, rent or share user data with third parties.
- Use data for advertising, profiling, credit scoring or lending decisions.
- Use data for any purpose unrelated to the wallet.
- Ask for your recovery words. Only type them into an OPEQ Recover screen.
10. Your rights
Depending on where you live, including the EU, EEA and UK, you may have the right to access, correct, delete or export your personal data, to withdraw consent, and to complain to a data protection authority. Since OPEQ holds personal data only for the waitlist, write to hello@opeq.io and we will answer within 30 days. Wallet data on your device is under your control and can be deleted at any time.
11. Children
OPEQ is not intended for anyone under 18 and does not knowingly collect data from children.
12. Changes
If this policy changes, the new version will be published on this page with a new date. Material changes will also be announced on @opeqio.
13. Contact
Email hello@opeq.io or message @opeqio on X.