Vesta / Privacy

Privacy policy

This policy describes how Vesta (“Vesta”, “we”) handles information in the Chrome extension and on this website. Vesta is a self-custody wallet. There is no Vesta account and no Vesta cloud backup of your secret phrase or vault.

1. Who we are

Vesta is a self-custody cryptocurrency wallet for Chrome. The product lets you create or import a secret phrase, view balances, send and receive, swap along a route you confirm, and connect to websites you approve. Support and privacy questions: help@vestawallet.xyz.

We cannot restore a lost phrase or password. Anyone who asks you to type the phrase into a webpage or email is not Vesta.

2. Scope

This policy covers:

• The Vesta Chrome extension (Manifest V3 toolbar popup).
• This public website, including the privacy and support pages.

It does not control how a blockchain, a public RPC operator, a swap router, a price source, or a website you connect to handles data. Those parties publish their own policies.

3. What we do not collect

The developer does not collect, store on Vesta servers, or sell:

• Secret phrases, private keys, or unlock passwords.
• Name, email, phone, government ID, or a Vesta login. There is no Vesta account.
• A cloud copy of the vault.
• Browsing history, page content, or a record of which sites you visit, except the connected-site permissions you grant, which stay on the device.
• Advertising identifiers, location traces, or analytics events from the wallet.

We do not use wallet data for advertising. We do not sell personal information.

4. What stays on your device

After you create or import a wallet, the following stay in Chrome storage on that computer:

• The vault: secret material wrapped with PBKDF2 and AES-256-GCM.
• Settings, language, custom networks and tokens, and a local price cache.
• Local send and activity history that Vesta shows in the wallet.
• Connected-site permissions you approve or revoke.

The unlock password is used in memory to decrypt the vault. It is not written to storage in plaintext. If you forget the password or lose the phrase, Vesta cannot recover the wallet.

5. What third parties may see when you use the wallet

Blockchains are public. Vesta does not operate a backend that stores your wallet. When you take an action that needs the network, the service that answers that request can see what the request contains.

Balances, sends, and custom RPCs

Looking up a balance, broadcasting a transaction, or reading chain state uses HTTPS JSON-RPC (and similar) endpoints: the defaults shipped with Vesta, public endpoints you can switch, or a custom RPC you add. Those operators can see the addresses, methods, and amounts in that call, plus your IP address as with any HTTPS request.

Swaps

Quotes and routes use LI.FI for EVM, Tron, and Sui, and Jupiter for Solana. Those services receive the assets, amounts, and addresses needed to build a quote. You sign the transaction in Vesta. LI.FI and Jupiter have their own privacy policies.

Prices

Fiat display values come from public price sources. Those requests typically include asset identifiers, not your secret phrase.

Sites you connect

A website you approve can receive the account address you share for that session, and can ask you to sign. Vesta does not send the phrase to the site. Revoke access in Cabinet. The site’s own policy applies to anything you do there.

Email support

If you write to support, we see the address and message you send. Do not paste a secret phrase, private key, or unlock password. We keep mail only as long as needed to answer the ticket.

6. This website

The site is static files. It does not set first-party analytics cookies, does not run an advertising pixel, and does not require an account. Your browser and the host that serves the files will see ordinary web logs (IP address, user agent, requested path) as with any HTTPS site. We do not use those logs to build a marketing profile.

7. Chrome Web Store Limited Use

Vesta complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Single purpose. Vesta is a self-custody cryptocurrency wallet. It shows balances, sends and swaps assets the user confirms, and connects to websites the user approves. It is not a general page reader, not an ad network, and not a cloud backup product.

User data from Chrome APIs is used only to provide that wallet. It is not sold, not used for advertising, and not transferred except as needed for the network requests the user starts (RPC, quotes, prices) or as required by law.

8. Extension permissions

storage holds the encrypted vault and the local settings listed in section 4. It is not a developer-side database.

Host access is a fixed list of HTTPS services the wallet calls for balances, quotes, prices, and sending. It is not a grant for every website. A node on your own computer is not in that list. Chrome asks for that one address only when you save it. A content script announces the wallet on pages you open so a site can offer Connect. It only forwards connect and sign messages. The extension does not scrape pages for analytics.

declarativeNetRequestWithHostAccess lets the extension attach headers on its own HTTPS calls so public APIs that reject a chrome-extension:// origin can still answer a balance or quote request you started. It is not used to rewrite other sites you browse, and it is not used to inject advertising.

9. Legal bases (where a privacy law asks)

Where GDPR or a similar law applies to a residual processing activity:

• Contract / requested service: running the wallet you installed, including network calls you trigger.
• Legitimate interests: answering support email you send, securing the site, and keeping this policy accurate.
• Consent: not used for tracking cookies on this site. We do not set them.
• Legal obligation: if a lawful request requires a limited disclosure of support correspondence we still hold.

On-device vault data is processed on your device under your control. We are not the host of that vault.

10. Retention

• Vault and local settings remain until you remove the extension, clear site data, or delete the wallet in Cabinet.
• Support email is kept only as long as needed to handle the request.
• Ordinary web-server logs, if the host records them, follow that host’s rotation. We do not mine them.

11. Security

The vault is encrypted with PBKDF2 (600,000 iterations) and AES-256-GCM before it is written to local storage. Unlock happens in the popup. We will not ask for the phrase by email. Report a vulnerability to help@vestawallet.xyz.

Self-custody means you are responsible for the phrase. Vesta cannot freeze an account or reverse a confirmed send.

12. Children

Vesta is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child provided personal information through support email, write to us and we will delete that message.

13. Your choices and rights

• Do not create a wallet if you do not accept this policy.
• Remove the Chrome extension to delete the local vault from that computer.
• Revoke a connected site in Cabinet.
• Switch or add RPCs in network settings. Those operators then see the requests you send them.
• Write to support to access, correct, or delete personal information that may exist in email we hold. There is no phrase to export from our servers. We do not have it.

Depending on where you live, you may have rights to access, deletion, restriction, or complaint to a supervisory authority. Contact us first at help@vestawallet.xyz.

14. Changes

If this policy changes, we will update this page and the “Last updated” date. Material changes to how the extension handles user data will also be reflected in the store listing as required.

15. Contact

Privacy and product questions: help@vestawallet.xyz.

Do not send a secret phrase, private key, or unlock password. We cannot use them to help you, and you should treat any such request as hostile.