Privacy Policy

1. Who this covers

This policy applies to the Locker Protocol Wallet browser extension for Chrome, Brave, Microsoft Edge and Firefox, and to this website (lockerprotocol.com). The extension is free of charge and published by the Locker Protocol project under the Locker Protocol Proprietary Non-Commercial License. Its source code is not public: the source of each version is given to the reviewers of the browser stores that ask for it. The smart contracts it works with are public.

2. We never handle your wallet keys

Locker is an air-gapped wallet. Signing happens on a separate device (the Locker Vault), and signatures are carried back to the extension as QR codes. The extension holds no wallet key: no seed phrase, no private key of your accounts, and no password able to derive them.

The one exception is the Perps trading key. If you turn on Hyperliquid perps trading, the extension generates a trading-only key for that account, which your vault approves for 30 days. By Hyperliquid's rules it can place and cancel orders but can never withdraw or transfer funds: deposits, withdrawals and every approval stay signed on the vault. It is stored encrypted in the extension's storage, protected by your wallet password when you set one, never leaves your browser and is never sent to us. Someone who takes over this extension could place orders with your perps balance; no key in it can move funds out.

3. What the extension stores, and where

Everything below is kept locally in your browser (the extension's own storage.local area). None of it is transmitted to us, except your public addresses, which the usage measurement of section 5 declares by network with whether each came from your vault. You can erase all of it at any time by removing the extension.

• •Public account addresses you import from your vault (public data by nature).
• •Contacts / address book labels you choose to save.
• •Preferences: selected network, display currency, language, and which sites you have connected to.
• •A local lock password you set to lock the extension, kept only as a salted PBKDF2 hash. It protects access to the interface and, if you trade perps, encrypts the Perps trading key.
• •The Perps trading key of section 2, encrypted, only if you turn perps trading on.
• •What the usage measurement needs (section 5): the key made for your install, which the browser keeps and never lets out; what waits to be sent; and the last batches the server accepted, which Settings shows you.
• •A random value in the browser's synced extension storage (storage.sync), so that the measurement can tell whether this browser profile held an earlier install. The value itself is never sent; only "created now" or "found" is. If you turn on your browser's own sync, the browser may copy it to your other devices.

4. Network requests

To show balances and broadcast the transactions you have already signed, the extension talks to public infrastructure. This is the complete list, and what each one can see:

• •RPC nodes for the networks you use, to read balances and submit signed transactions. Public endpoints by default; you can point a network at your own. For the EVM networks these are the public endpoints of PublicNode, dRPC, MEV Blocker and 1RPC, and the networks' own: Arbitrum (arb1.arbitrum.io), Optimism, Base, Linea, Avalanche (api.avax.network), BNB Chain with Binance and Defibit, Robinhood Chain, Hyperliquid with Hypurrscan, and Injective.
• •The dApps you visit, which receive your public address once you connect, exactly as with any other web3 wallet.
• •CoinGecko, for the fiat prices shown next to your balances, and for the public token list (tokens.coingecko.com) the wallet uses to name and draw the tokens of a network: on the token list of your balances, in Manage tokens and in the swap picker. Only token identifiers and the network are sent, never your address. Turn off Show fiat values in Settings and no price request is made; the token list is fetched for the network shown and then kept for a while.
• •Block explorers (Etherscan and Optimistic Etherscan, BscScan, Arbiscan, BaseScan, PolygonScan, LineaScan, Snowtrace, HyperEVMScan, the Blockscout explorers of Robinhood Chain and Injective, Blockstream, mempool.space, Tronscan, Solscan, Suiscan, Stellar.Expert, ordinals.com, Mintscan, the Injective explorer, Runescan, the Aptos explorer, XRPScan, litecoinspace and Blockchair), only when you tap a link to open one.
• •DefiLlama, for the price chart on an asset's card when Hyperliquid's own market data does not cover that coin. Only coin identifiers are sent, never your address, and like every price request it stops when Show fiat values is off.
• •Token logo hosts. For a coin you hold that we do not ship a logo for, the extension fetches the logo once from the https host the public token catalogue names for it (typically CoinGecko's image CDN or the token list's own host), then caches it locally forever. One request per token, ever; it carries the token's identifier, never your address.
• •LI.FI and Jupiter, when you ask for a swap or bridge quote. They receive the pair, the amount and the address the funds move between. While a bridge you sent is under way, LI.FI also receives its transaction hash and the two networks, to say where the funds are; and the swap picker reads LI.FI's public token list for the network shown (no address). SunSwap quotes on Tron are read on-chain through the Tron node and send nothing to SunSwap.
• •Hyperliquid, if you open the Perps tab. It sees your address and IP. Nothing is sent to Hyperliquid until you accept the risk warning the tab shows first.
• •The Xverse ordinals indexer (api-3.xverse.app), to tell ordinary bitcoin from inscriptions before a Bitcoin send, and to list the inscriptions of your Ordinals address when its row shows them. It receives the Bitcoin address it is asked about and your IP address.
• •Public token logos in lists. The swap picker and the Manage tokens list show the public logos of the tokens they list. These load as ordinary images when the list is displayed, from CoinGecko's image CDN, raw.githubusercontent.com (GitHub) and app.hyperliquid.xyz, the only image hosts the extension allows. The request carries no address and no referrer; the host sees your IP address and which public logos were shown.
• •TronGrid, Solana, Sui and Bitcoin nodes, and Stellar's Horizon and Soroban RPC servers, for the balances, swap paths and broadcasts of those chains, on the same terms as the EVM RPC nodes. On Sui, the nodes of Mysten Labs (graphql.mainnet.sui.io, fullnode.mainnet.sui.io), Triton (rpcpool.com) and Nodeinfra; on Stellar, the Horizon servers of the Stellar Development Foundation (horizon.stellar.org) and Lobstr, and the Soroban RPC servers of sorobanrpc.com, Gateway.fm, Lightsail and Creit Tech. On Tron, when TronGrid is unavailable, imToken's public node (tron-mainnet.token.im) and the public full nodes of PublicNode, TronStack and Pocket Network take over; on Solana, the reads and broadcasts go to the public nodes of Helium, Ledger, Atomic Wallet and PublicNode; on Bitcoin, when Blockstream and mempool.space are unavailable, the public Bitcore and BlockCypher indexers take over.
• •Cosmos, Aptos, XRP Ledger, Litecoin and Dogecoin nodes, for the balances and broadcasts of those chains, on the same terms as the EVM RPC nodes: the public REST gateways of the Cosmos chains (cosmos.directory, publicnode, polkachu, Ecostake, the Osmosis LCD at lcd.osmosis.zone, the Injective sentry), the Aptos Labs fullnodes and Sentio, the XRPL cluster nodes (xrplcluster.com, xrpl.ws, xrpl.link, s1/s2.ripple.com), for Litecoin the public Blockbook indexers of Zelcore, Atomic Wallet and NOWNodes (litecoinblockexplorer.net), the public Bitcore and BlockCypher indexers and litecoinspace's Esplora, and for Dogecoin the public Blockbook indexers of Atomic Wallet and Zelcore, and the public Bitcore and BlockCypher indexers. Each sees the public address it is asked about and your IP address.

These third parties may observe your public address and IP address as an inherent part of how any blockchain wallet works. Their handling of that data is governed by their privacy policies, not ours.

The requests that reach us

The usage measurement sends to api.hyperkeel.com, our server at hyperkeel.com: section 5 says exactly what, and how you switch it off.

The optional on-device AI assistant downloads its model from lockerprotocol.com (about 550 MB, once). It is opt-in: nothing is fetched until you accept it, and never before you have accepted the Terms of Use. The download is a plain file transfer of a public model, the same bytes for everyone, and our host records no more than any web server does for a static file. Once downloaded, the assistant runs entirely on your device: what you sign is analysed locally and never leaves the browser. You can delete the model at any time from Settings.

Apart from the usage measurement, that download and the vault web app you choose to install, the extension makes no requests to any server operated by Locker Protocol.

5. Usage measurement

From version 2.7.0, which ships the Terms of Use 1.5 that announce it, the extension measures how it is used. It is on by default. We use it to see which features work, how reliable the wallet is, and to tell real installs from fake ones when we pay for campaigns that bring installs; for nothing else.

Who receives it

It is sent to api.hyperkeel.com, a server we run at hyperkeel.com. Two providers handle it on our behalf: Cloudflare, the network in front of that server, which sees the IP address of every request in transit, keeps nothing for us, and tells the server the country, network operator and time zone of that address; and OVH, which hosts the server in Roubaix, France. Nobody else receives it.

Two levels

• •The anonymous count: the install, an update, the acceptance of the Terms, the switching off of the measurement, and one active day for an install whose measurement is off, each counted without any identifier. You can turn it off on its own.
• •The full measurement: a random install number, the setup steps you reach (each once), the days you open the wallet or it runs, your public addresses by network, and the signals that tell a real install from a fake one, listed below.

Everything that is sent

The tables below are generated from the same declaration the extension enforces before sending and the server enforces after decrypting (schema version 1): a field not listed here is dropped by the extension and refused by the server. A body never exceeds 8192 bytes; a batch carries at most 50 steps and 50 address changes.

Added by the server, never sent by the extension

• •The IP address as seen by the server (Cloudflare CF-Connecting-IP), kept as it is for at most 30 days, as the Terms and the privacy policy say, and as an HMAC (an IPv6 address by its /64) after that.
• •An HMAC of the network (/24 for IPv4, /48 for IPv6).
• •The country (two letters, from Cloudflare), the autonomous system number, the operator name and the time zone of the IP (set by a Cloudflare Worker).
• •The time the batch was received.
• •For the anonymous count: The country of the IP (two letters, from Cloudflare) and the day, added to a daily counter; the IP itself is not kept.

Never sent

• ✓Amounts, balances, tokens, swap pairs and routes, perps markets and sizes.
• ✓Transaction hashes, and the content of anything signed.
• ✓Origins and URLs of the sites visited or connected.
• ✓Contacts, account labels, settings.
• ✓The vault's master fingerprint, its public keys and derivation paths, or anything else from the vault.
• ✓Exact EVM chain ids.
• ✓Anything at all from a Firefox that refused data transmission.

The signals, in plain words

• •A fingerprint of your device, computed in your browser at most once a day: a SHA-256 of its brand and platform, processor architecture and model, number of cores, memory, screen size, graphics renderer, time zone and language. The browser's version is left out. Only the hash is sent, and the server keeps only a keyed hash of it.
• •Whether the browser is driven by a program (navigator.webdriver), read once.
• •Whether this browser profile held an earlier install, from the random value described in section 3. We measured it on 21 October 2026: Chrome, Edge and Firefox, with no browser account signed in, erase it together with the extension, so it is found again only when something else kept it, such as the browser's own account sync.
• •The campaign that brought you, if any: when a tab is open on https://hyperkeel.com, the extension reads there the two values our campaign page stored in that site's own storage (hk-lw:campagne, the campaign code, and hk-lw:visiteur, a random visitor number), and nothing else. The code is sent as it is, the visitor number only as its SHA-256. The anonymous count reads the campaign code alone.
• •The news cards of the home (from version 2.7.1): each card presents one of our own applications, Hyper Agentic Trader or Hyperkeel, and ships inside the extension, so nothing is loaded to show it. The measurement records that a card was shown (at most once a day), opened or closed. Opening one opens the site in a new tab with a random single-use number of 128 bits in the part of the address after #, which your browser never sends to any server with the page; the page reached sends it back to api.hyperkeel.com when you arrive and again if you sign in there, so that we can tell that the click led to a visit or a sign-in. The number is never your install number, and no account is ever recorded next to an install. The cards can be turned off in the extension's Settings, under Locker Protocol news.
• •The uninstall page: when you remove the extension, the browser opens a page of hyperkeel.com through our server, which records the removal. While the full measurement is on, that address carries your install number, signed; otherwise only the version and the browser.

How it is protected

Each send is encrypted to our server's key (an ECDH exchange on P-256, then AES-GCM) and signed with a key made for your install, which your browser keeps, never lets out, and which signs nothing else. Each request also carries a single-use number from the server and a small proof of work. No cookie and no referrer travel with it.

How long it is kept

• •Your IP address: 30 days; after that only keyed hashes of it and of its network remain, with the country, network operator and time zone derived from it. The server's rate limiter holds it in memory for about two minutes.
• •The install record, its steps and its addresses: at most 25 months after the install was last active.
• •The days of use: 13 months.
• •The anonymous count: daily totals only, 25 months.
• •The single-use numbers: 30 days; a refused request: 90 days.

Your choices and your rights

Open the extension, then Settings, Usage measurement. See what is sent shows this install's values today and the last batches the server accepted, field by field. Turning the measurement off erases it: the extension sends a request signed with your install's key, the server erases that install's records, and nothing more of the full measurement leaves. Turning it on again starts a new install number. Anonymous counts has its own switch. You need no account to see, stop or erase anything; for any other request, including to object or to complain, write to the address in section 12, or to your data protection authority.

On Firefox, nothing of the measurement is sent unless Firefox allows it. The package declares personally identifying information, financial and payment information and location as required and technical and interaction data as optional: Firefox 140 and later show these at install, and without technical and interaction data nothing at all is sent. On Firefox 128 to 139, the wallet's own consent window carries a separate usage line, never ticked in advance, and a no there sends nothing.

Where a store distributes a build that asks for your agreement first, nothing of the full measurement is sent before you agree; where it distributes a build that only counts anonymously, only the counts without any identifier are sent.

The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

6. What is sent to third parties, and your consent

A wallet cannot show a balance or send a transaction without talking to the network. To do so the extension sends financial information to the third-party services listed in section 4: your public addresses and the balances looked up for them, the transactions you sign so they can be broadcast, and the pair, amount and addresses of a swap or bridge quote you request. Each of those services also sees your IP address. None of this goes to Locker Protocol (the usage measurement of section 5 declares your public addresses, never a balance, an amount or a transaction), and none of it includes a key or a recovery phrase: no wallet key or recovery phrase ever exists in the extension, and the Perps trading key of section 2 never leaves it.

On Firefox this is declared to the browser as the financial and payment information data category (section 5 says what the usage measurement declares there). Firefox 140 and later ask for your consent themselves when you install the extension. On Firefox 128 to 139 the extension asks you itself, in the tab that opens after installation and again in its popup, before its first request: until you accept, no request leaves your browser. Declining is a real answer: it is kept, and the extension then sends nothing at all.

You can withdraw this consent at any time: open the extension, then Settings, Data sent to third parties, Withdraw. Every request stops at once and the question is asked again. Removing the extension also ends all transmission and erases what it stored.

7. Broad host access, explained

The extension requests access to all websites (http://*/* and https://*/*) for four things, and nothing else: to expose the standard wallet providers (window.ethereum and the equivalent interfaces of the other networks) so that any dApp you visit can request a connection, the same model every general-purpose web3 wallet (e.g. MetaMask) uses; to show its signing card over the page that asked for a signature; on our own site only, when a tab is open on https://hyperkeel.com, to read the two values our campaign page stored there (section 5), and nothing else of that page; and to read public blockchain nodes and indexers that do not let ordinary web pages read them (section 4). It is not used to read the content of the pages you visit or to track your browsing.

8. What we do NOT do

• ✓No advertising in the extension, and no third-party analytics service or tracker in it: the usage measurement of section 5 goes to our own server only. (This website is covered by section 11.)
• ✓No selling, renting, or sharing of any data, and no use of it for anything but measuring how the wallet is used, its reliability, and telling real installs from fake ones.
• ✓No amounts, balances, tokens, transaction hashes, signed content, sites visited or connected, contacts, account names, or anything from your vault, ever sent to us.
• ✓No link between the measurement and an account on hyperkeel.com: they are stored apart and never matched.
• ✓No accounts, sign-ups, or emails required to use the extension.

9. Children

The extension is not directed at children under 13 and does not knowingly collect any data from them.

10. Changes to this policy

If this policy changes, we will update the date at the top of this page and, for material changes, note it in the extension's release notes.

11. This website

lockerprotocol.com is a set of static pages served by GitHub Pages, which, like any web host, receives your IP address and the address of each page you request.

Audience measurement, only if you accept it. We measure the website's audience with Google Analytics 4, a service of Google Ireland Limited and Google LLC. Nothing of Google Analytics is loaded until you choose in the banner at the bottom of the page: if you refuse, or do not answer, no Google script runs and no cookie is set. If you accept, the page loads Google's tag, which sets two cookies on your device, _ga and _ga_P029LN8NTN, kept 13 months at most, and sends Google the pages you visit, the buttons and links to other sites you click, your language, the type of device and browser, and your IP address, from which Google derives an approximate location and which Google Analytics 4 does not store. Google signals and ad personalisation are switched off, and no advertising signal is granted. Google processes this data for us; its transfers to Google LLC in the United States rely on the EU-US Data Privacy Framework. The statistics are kept for the retention period set on our Google Analytics property, 14 months at most.

Your choice. It is kept for 6 months in your browser's local storage (lp-consent-analytics), not in a cookie, after which the banner asks again. You can change it at any time with Cookie settings at the bottom of every page; refusing after accepting stops the measurement at once and deletes the Google Analytics cookies. The legal basis is your consent (article 82 of the French Data Protection Act, which transposes article 5(3) of the ePrivacy Directive, and article 6(1)(a) of the GDPR).

Wallet connection. On the pages that offer it, connecting a wallet uses a wallet picker (Reown AppKit) that keeps the connection and the last network in your browser's local storage and, if you choose WalletConnect, relays the connection through Reown's servers. Nothing else is stored by the website.

12. Contact

Questions about this policy or your privacy can be sent to contact@lockerprotocol.com. The source code of the smart contracts is public in their GitHub repository; the source code of the extension is not public.