Privacy Policy
Opaque is a self-custodial wallet for private payments. This page describes what it keeps on your device, what leaves it, and who can see what. Accepting it, with our Terms of Use, is part of using Opaque. Opaque has no user accounts. It asks for no name, email or phone number, sets no tracking cookies, and runs no analytics, ads or trackers.
What stays on your device
- Your recovery phrase. Your 12 words, and any account key you import, are kept in this site's or this extension's local storage, encrypted under your wallet password. While Opaque is unlocked, the key that opens them is kept for that tab (in the extension, in memory only), until 15 idle minutes pass, the tab closes, or you lock it. A wallet made before passwords asks you to set one the next time it opens.
- Your Arc account keys. The post-quantum keys that sign for your Arc accounts are drawn from your phrase and kept in IndexedDB, encrypted under a key the browser does not let the page export and again under your wallet password, with a log of what they have signed.
- Your notes. The secrets of your private notes are kept in local storage, encrypted under your wallet password. A note secret never leaves your device: the proof that spends it is built on your device.
- Your records. Payments you sent, your deposit addresses and tags, your balances and the accounts you use with each app, encrypted under your wallet password; and settings such as your network, which updates you have read and that you accepted these terms, which are not.
- Backups are files you export yourself, encrypted with a passphrase you choose. They go wherever you save them.
Clearing the site's data or removing the extension deletes all of this from that browser. Your recovery phrase, or your passkey backup if you made one, brings your accounts and notes back; an account made before recovery phrases comes back only from a backup file or a passkey backup.
What leaves your device
The wallet talks to Opaque's services, which the Opaque team operates on Railway: one for Arc testnet, one for Arc mainnet and one for the XRP Ledger testnet.
- Configuration. The wallet downloads the list of relays and the public keys it needs.
- Relayed requests. Payments, and every read about your accounts or notes, travel through three relays, encrypted in three layers. The first relay sees your IP address but not the content. The service at the far end sees the content but not your IP address. When a reply is ready, your device collects it from the last relay, which sees your IP address but cannot read the reply.
- Arc account operations. Deposits, withdrawals and key rotations are operations your account's key signs. They reach the service through the relays, and it forwards them to the network, so the service sees your Arc account address and what each operation does.
- XRP Ledger deposit tags. To receive, the wallet registers a deposit tag with the pool service through the relays, with the commitments of the notes it will become and, for a reusable address, a hash that proves the tag is yours. The service learns which tags exist and how many notes each holds, not who you are.
- A credential for each recipient. Before your first payment to an address, the wallet asks the service's credential authority for a credential for that address. This request goes through the relays, like the wallet's other reads, so the credential authority sees the recipient's address but not your IP address. It never learns which payment, if any, later uses the credential.
- The payment itself. A payment is sealed on your device to a payment key. Whoever holds that key opens it to check the recipient's credential and settle the payment, so it sees the recipient and the spend. It never sees a note secret, and the spend does not say which of the eight notes in its ring was yours. On Arc, payments are opened inside a Chainlink CRE workflow running in a secure enclave. On the XRP Ledger testnet, they are opened by an ordinary server process, so the Opaque team could read what it opens.
- A passkey backup, if you make one. Your device encrypts your recovery phrase, any imported account keys, and notes kept only in this browser, under a key that only your passkey can produce. The encrypted copy goes through the relays to Opaque's Arc mainnet service, which keeps it for every chain, under an identifier only your passkey can work out. We cannot read it or tell whose it is. Your device updates it when what it holds changes, and Remove backup in Accounts deletes it. The passkey itself stays with your device or password manager (such as iCloud Keychain, Google Password Manager or 1Password), never with Opaque.
- Testnet faucets. When you ask for test funds, the request goes through the relays, and the service asks the network's faucet to pay your deposit address.
Apps you connect
- The extension and websites. So that XRP Ledger apps can find Opaque, the extension adds the GemWallet and Crossmark connection interfaces to the websites you visit. It does not read or change their content, or record which sites you visit. A site learns only what you approve in Opaque's own window: the address of the account Opaque keeps for that site (a separate one for each site), and the transactions and messages you sign.
- WalletConnect. When you pair with an app, messages travel through WalletConnect's relay, reached through Opaque's service, so the relay sees our server rather than your IP address. The messages are encrypted between Opaque and the app.
- Buying crypto. Buy opens MoonPay in a new tab with your deposit address. MoonPay collects what it needs under its own privacy policy; the wallet page does not contact MoonPay.
- Sweeping in another wallet. The wallet reads that wallet through the relays. Its secret signs on your device and is never stored or sent.
Who else is involved
To answer your requests, Opaque's services contact, from their own servers: Arc's RPC nodes, Pimlico's ERC-4337 bundler (which receives your Arc account's operations), The Graph, Chainlink CRE, XRP Ledger nodes and faucets, and WalletConnect's relay. These providers see Opaque's servers, not your device.
What is public on the blockchain
Deposits are public. On Arc, anyone can see that your account address deposited into a pool, and how much. On the XRP Ledger, anyone can see the sending account, the pool, the deposit tag and the amount. Settlements are public: anyone can see that a pool paid an amount to a recipient. Payments into one reusable address can be linked to each other. What Opaque hides is the link between deposits and payments: which deposit paid which recipient. Blockchain records cannot be deleted.
Compliance and legal requests
The credential authority may check recipient addresses against sanctions lists before it issues a credential. If we receive a valid legal request, we can only provide what we hold, which is described above. We do not hold your recovery phrase, keys or note secrets.
What we do not do
- We do not sell, rent or share information about you with anyone, except as described on this page.
- We do not use it for advertising, profiling or creditworthiness, or for anything but running Opaque.
- We do not collect names, emails, contacts, browsing history or the content of the websites you visit.
Your choices
Almost everything Opaque keeps is on your device, under your control: clear the site's data or remove the extension to delete it, after making sure you have your recovery phrase. A passkey backup is the one thing we keep for you, encrypted; remove it from Accounts whenever you like. For anything held in our services' or hosts' logs, contact us and we will help where we can, including under data protection laws that apply to you.
Children
Opaque is not for anyone under 18.
Changes and contact
If this policy changes, this page will say so with a new date, and if the change is material, Opaque will ask you to accept it again. Questions or requests: x.com/Opaquecredit.