Privacy Policy

We do not collect names, email addresses, or any other personal identifiers. We never see your private keys or seed phrases. We never see your decrypted balances: user decryption happens entirely in your browser, using a throwaway keypair generated for that session, and the cleartext is never transmitted to or stored on any server we operate.

When you connect a wallet, your address is used in your browser to read balances, build transactions, and show your portfolio. The application does not send your address to our servers as part of any account or profile; there is no server-side record tied to you.

Remember that everything you do on-chain is public by nature. Transactions you sign, including wraps, unwrap requests, and finalizations, are permanently visible on the Sepolia blockchain to anyone, independent of Obscura.

Obscura runs an indexer that listens to public registry and wrapper events and stores them in a database so the app can serve fast lists and statistics. It holds only public, on-chain-derived data: pair addresses and metadata, event types, the addresses involved, transaction hashes, block numbers, timestamps, and the amounts that are public by nature (wrap amounts and finalized unwrap amounts). Anyone could derive the same data from the public blockchain. Encrypted amounts are never stored; confidential transfer events are recorded without any amount.

Obscura keeps a small amount of state in your browser's local storage so the app works well across reloads: the live state of your pending unwrap requests (so an interrupted unwrap can be resumed), and the connection state your wallet tooling caches. This data never leaves your device through us, and you can remove it at any time by clearing site data in your browser.

Obscura sets no advertising or analytics cookies and runs no behavioral tracking. Our hosting providers may keep standard, short-lived server logs (such as IP addresses and user agents) for security and operations, under their own policies.

Using Obscura necessarily involves services we do not operate, each governed by its own privacy policy:

• Your wallet and its connection infrastructure (Reown AppKit / WalletConnect) handle your keys and connection requests.
• RPC providers receive the read and write requests your browser makes to the Sepolia network.
• The Zama relayer receives ciphertext handles, encrypted inputs, and signed decryption requests when you encrypt amounts or decrypt balances. It does not receive your private keys.
• Block explorers such as Etherscan, when you follow an outbound link.
• Hosting providers (currently Vercel for the web apps and Render for the API) serve the Service and keep their own operational logs.

The protocol requires exactly one value to become public: finalizing an unwrap publicly decrypts the unwrap amount, and that amount is then permanently visible on-chain. The interface says so before you start an unwrap. No other confidential value is ever disclosed by the Service.

Because we hold no personal data, there is nothing personal to delete on request. The indexer's copy of public blockchain events mirrors what the chain already exposes. Anything stored in your browser is under your control and can be cleared at any time.

The Service is a developer-focused testnet application and is not directed at children.

If this policy changes, the update appears on this page with a new date at the top. Questions are welcome as issues on the GitHub repository. For the rules that govern using the app, see the Terms of Service.