Privacy Policy

1. What this policy covers

This policy covers two things: the kivuli.xyz website and the Kivuli browser extension distributed from our GitHub repository. It explains, plainly and completely, what data each one handles.

The short version: Kivuli has no accounts and no sign-up. The extension runs entirely on your device and sends nothing to us. We do not collect, store, sell, or share personal data. The only personal information we ever receive is what you choose to type into the contact form on this website.

2. The extension: what we collect

Nothing. The extension has no server side. It does not phone home, create accounts, or transmit any data to Kivuli or its maintainers. It contains no analytics, telemetry, crash reporting, or error reporting of any kind, so there is no usage data for us to receive.

The diagnostics panel in Settings reads only local state and shows counts and timings, deliberately excluding addresses, amounts, and counterparties. Its Copy for support button copies that summary to your clipboard when you press it; nothing is sent anywhere unless you choose to paste it somewhere yourself.

3. What stays on your device

Kivuli is self-custodial and local. Everything the extension knows about your wallet lives in your browser's extension storage, on your device. Kivuli keeps no copy of any of it, so clearing the extension's data or uninstalling it removes that information, and only your recovery phrase can restore the wallet.

Your recovery phrase is encrypted under your passcode before it is written to storage, and the wallet's sensitive records, such as its record of received funds and its map of per-site addresses, are encrypted at rest and unreadable while the wallet is locked. On your device the extension stores:

• Your keys, derived from a 12-word recovery phrase generated on your device. The phrase and the keys derived from it never leave it.
• Your settings and preferences.
• Your activity history and the record of which sites you have connected.
• Imported token details and the encrypted caches the wallet builds while checking for incoming funds.

4. What the extension sends over the network

The extension's only network traffic is JSON-RPC requests to the blockchain endpoint configured for the active network. It makes these requests to do its job: reading balances, checking for incoming funds, and broadcasting the transactions you approve.

Whichever RPC endpoint is configured receives the addresses your wallet queries and, like any server you connect to, your IP address. The default endpoints are public infrastructure operated by third parties, not by Kivuli: mainnet.base.org for Base, and ethereum-sepolia.publicnode.com and sepolia.base.org for the optional test networks. Those operators' own privacy practices apply to that traffic.

In this version the extension uses one endpoint per network for every query it makes, across all of your per-site wallets. That endpoint's operator is therefore in a position to observe, at the network level, all the addresses your wallet asks about from your IP address. If that concerns you, set a custom endpoint you trust, such as your own node; the extension requests browser permission for that specific origin at the moment you set it. Install-time network permissions cover only a fixed list of public RPC endpoint hosts (mainnet.base.org, base-rpc.publicnode.com, ethereum-sepolia.publicnode.com, and sepolia.base.org), so the extension cannot contact arbitrary servers on its own.

Block explorer links, such as View on Basescan, open in a new tab only when you click them; from that point the explorer's own policies apply. The extension itself is distributed at github.com/kivuliapp/extension, so GitHub serves that download and sees the usual request data under its own privacy policy.

5. On-chain data is public

Kivuli is a wallet for public blockchains. Every transaction you send is recorded on the chain permanently and publicly, and remains traceable between its actual sender and recipient. That record is created by the network itself, is outside anyone's control, and cannot be deleted.

Kivuli's privacy model is separation between the sites you connect: each site gets its own wallet address, so one site cannot follow your activity on another. It is not concealment from the blockchain, and nothing in this policy changes what the chain records.

6. The website: what it handles

kivuli.xyz is an informational site. It runs no analytics, sets no cookies, and embeds no third-party scripts, pixels, or trackers. Fonts and other assets are bundled and served with the site itself, so viewing a page does not fetch resources from third-party servers.

Like any website, the hosting infrastructure that serves kivuli.xyz processes standard request data, such as your IP address and the page requested, for the purpose of delivering the site. We do not use that data to build profiles.

The site stores one preference in your browser's local storage: your light or dark theme choice. It stays in your browser and is not transmitted.

The contact form is the one place this website receives personal information. If you use it, we receive the name, email address, and message you type, and we use them only to read and reply to your message, keeping them no longer than that takes. Emailing support@kivuli.xyz directly works the same way.

7. No sale or sharing of personal data

We do not sell, rent, trade, or share personal data with anyone, for advertising or for anything else. Outside the contact form, there is no personal data in our hands to begin with.

8. Children

Kivuli is not directed at people under 18, and we do not knowingly collect information from anyone under 18. There is no account to create, and the website is informational.

9. International users, GDPR, and CCPA

Kivuli does not maintain user databases or process personal data in the ordinary operation of the website or the extension, so there is normally nothing held about you for us to access, correct, export, or delete. If you have written to us, you can ask us to delete that correspondence at any time.

For any privacy inquiry, including rights requests under the GDPR, the CCPA, or similar laws, contact us via kivuli.xyz/contact and we will respond.

10. Changes to this policy

If this policy changes, the updated version will be posted on this page with a new effective date. The date at the top always tells you which version you are reading.

11. Contact

Questions about privacy or this policy: reach us through kivuli.xyz/contact or email support@kivuli.xyz. A real person will reply.