From 5b7cc6515aacc1c20ee04f479f711ff14491233b Mon Sep 17 00:00:00 2001 From: jwinterm Date: Sun, 27 Sep 2026 08:08:13 -0400 Subject: [PATCH] docs(privacy): align wallet data disclosures with v0.3 --- src/app/privacy/page.tsx | 113 +++++++++++++++++++++------------------ 1 file changed, 62 insertions(+), 51 deletions(-) diff --git a/src/app/privacy/page.tsx b/src/app/privacy/page.tsx index 6587e6b..f7b8517 100644 --- a/src/app/privacy/page.tsx +++ b/src/app/privacy/page.tsx @@ -27,9 +27,9 @@ export default function Privacy() {

- At Smirk, we believe privacy is a fundamental human right. Our architecture is designed - so that we never have access to your private keys, unencrypted funds, or the ability - to spend your money. + Smirk keeps your recovery phrase and private spending keys on your device. + Backend services receive the data described below to provide balances and + optional features, but do not hold the keys needed to spend your wallet funds.

@@ -55,8 +55,9 @@ export default function Privacy() { They are never transmitted to our servers.

  • - No Access: We cannot "freeze" accounts or - "seize" funds because we do not hold the keys to move them. + Service access: An operator can restrict + access to its backend, but does not hold the spending keys needed to move + your wallet funds.
    • @@ -68,9 +69,9 @@ export default function Privacy() { To facilitate social tipping and identity verification, we collect the following:

    -

    A. Monero & Wownero Private View Keys

    +

    A. View Credentials

    - To provide a fast mobile and browser-extension experience without requiring you + To provide browser-extension and desktop balances without requiring you to download the entire blockchain, Smirk collects and stores your Private View Keys for Monero (XMR) and Wownero (WOW).

    @@ -81,11 +82,17 @@ export default function Privacy() {
  • Limitation: A View Key cannot be used to spend your funds. - It only allows the server to see that a transaction has occurred. Your funds remain secure - and spendable only by your local Smirk wallet (browser extension or mobile app). + It reveals incoming transactions and their amounts. Spending still requires + the private spending key held by your wallet.
    • +

    + For Grin, the wallet sends a rewind_hash view credential so the + backend can find your outputs. A configured Grin light-wallet server can + retain this credential and continue scanning. It cannot authorize spending. +

    +

    B. Social Identity Data

    When you link a social account (Telegram, Discord, etc.), we store: @@ -98,26 +105,25 @@ export default function Privacy() {

    C. Transaction Metadata & Payloads

    D. Bitcoin & Litecoin Public Addresses

    To show your BTC and LTC balances and broadcast your transactions, our backend queries Electrum/Fulcrum servers with your public - wallet addresses. The default configuration uses public Electrum servers, the same - kind most non-custodial wallets use; a self-hosted operator can point at their own - node instead. + wallet addresses. The backend operator selects the servers and any fallback + providers. Those providers receive the requested address data and the backend's + network connection; this lookup is not anonymous.

    E. Wallet Fingerprint

    On first login your wallet derives a one-way fingerprint - (SHA-256 of your seed) and sends it to our backend as a stable, anonymous + (derived from your wallet seed) and sends it to our backend as a stable, pseudonymous identifier. It is used to associate your wallet with social handles and tip history across devices, and is the value our backend joins on internally. It is not reversible back to your seed and cannot be used @@ -130,12 +136,13 @@ export default function Privacy() { smirk.cash, claim pages, and merchant sites can request a connection or a signature from your wallet. Connections are per-origin and require an explicit approval prompt the first time a site asks; you can revoke any - origin at any time from Settings. You can also globally disable the - window.smirk surface from Settings — when off, pages cannot - detect that Smirk is installed. + origin at any time from Settings. Scoped permissions can authorize later + requests without another approval screen. Optional password confirmation + applies to each send or signing request. You can disable provider injection + in Settings; this takes effect when each page next loads.

    @@ -172,24 +179,28 @@ export default function Privacy() {

    Smirk v0.3 supports end-to-end encrypted direct messages over the Nostr protocol (NIP-17 "gift-wrapping"). Messages are encrypted on your device - before they leave it. They travel through Nostr relays — public - relays and, optionally, one operated by Such Software — which carry only ciphertext - they cannot read. + before they leave it. They travel through the configured Nostr relays, + which receive encrypted message content and routing metadata.

    +

    + Feed posts and published Nostr profiles are public. Relays and other readers + can retain and redistribute them; they are not encrypted direct messages. +

    +

    J. IP Addresses

    Like any internet server, our backend receives your device's IP address with - each request. We store only a salted, one-way hash of it, and only - for rate-limiting and abuse prevention (for example, throttling automated signups). - We do not use it to track you or link it to your wallet, and self-hosting avoids - sharing it with us at all. + each request. The backend application uses a keyed hash in + rate-limit and abuse-prevention records. This does not describe separate + reverse-proxy, hosting or third-party logs. Requests to a self-hosted backend + go to that operator; other services you use still receive their own requests.

    @@ -232,16 +243,16 @@ export default function Privacy() {

    🛡️ Quick-Glance Summary

    @@ -250,16 +261,16 @@ export default function Privacy() {

    4. Third parties you choose to enable

    Some features connect you to independent third parties operated by others, - not by us — Trocador for swaps, the Electrum/Fulcrum servers noted above, - the public Nostr relays that carry optional messaging, the block explorers - opened by "view on explorer" links, and any site you connect to - through the window.smirk interface. Because your device contacts - these endpoints directly, each can see your IP address alongside whatever the - interaction entails — for a swap, the asset pair, amounts, and your - destination and refund addresses; for an explorer, the transaction or address - you open. Each has its own privacy policy. We neither control nor monitor - those connections, and we are not responsible for how those parties handle - your data. + not by us: Trocador for swaps, Nostr relays, block explorers opened from + transaction links, and sites you connect through window.smirk. + Direct connections reveal your device's IP address and the data needed + for that interaction: for swaps, the asset pair, amounts, and destination + and refund addresses; for explorers, the transaction or address you open. + Electrum/Fulcrum requests instead pass through the selected backend, which + shares the requested addresses and transaction data with its configured + providers. Each provider has its own privacy policy. We neither control + nor monitor those connections, and we are not responsible for how those + parties handle your data.

    @@ -269,9 +280,9 @@ export default function Privacy() {

    Smirk is not directed to people under 18, and we do not knowingly collect data from minors. If you believe a minor has used Smirk and you want to - delete any associated state, uninstalling the extension or app on the - relevant device removes all local data; contact us at the address below to - remove associated backend records. + delete associated backend records, contact us at the address below. + Removing local wallet data is a separate action; uninstalling a desktop + application may leave its data directory in place.

    @@ -280,9 +291,9 @@ export default function Privacy() {

    6. Your rights

    Your seed phrase and private spend keys never leave your device, and - uninstalling removes all local state. For the limited data our backend does - hold (Monero/Wownero view keys, your wallet fingerprint, linked social - handles, and encrypted tip metadata), residents of the EU/UK (GDPR Articles + deleting local wallet data does not remove backend records. For the data + backend services hold (Monero/Wownero view keys, Grin view credentials, + your wallet fingerprint, linked social handles, and tip records), residents of the EU/UK (GDPR Articles 15–22) and California (CCPA / CPRA) may request access to, correction of, or deletion of that data by emailing{' '}