Privacy Policy

GHOSTSIG is a self-custodial wallet for the XRP Ledger and Stellar that runs entirely in your browser. There is no backend, no account, and no server that belongs to us. We hold no keys, and nothing of ours receives your balances or your transactions. What you send is public on the ledger, as it is for everyone.

Controller

Consulting Manao GmbH, Köppling 35, 8565 Söding-Sankt Johann, Österreich. For anything in this policy, including a request under Arts. 15 to 21 GDPR, write to legal@consulting-manao.com. Company details are in the Impressum.

Keys

Your signing keys, one per ledger, are derived in the page from the WebAuthn PRF output of a passkey you control. A key is derived for a single signature and overwritten immediately afterwards, with two exceptions you choose. A backup holds the PRF output as SLIP-39 shares for as long as its stage is open, and a session restored from shares holds it in memory until you disconnect or the session locks after ten minutes idle. In every case it is never written to storage and never transmitted. We never receive it, and neither does any third party. If you use the copy button, the share goes to your device's clipboard, which your operating system may keep in a history or synchronise to your other devices.

Overwriting has a limit. Every byte array this code owns is zeroed, but the derivation passes through immutable values inside the cryptography library that JavaScript does not allow anyone to erase. A memory dump of the page taken after a payment can still contain the key. Taking such a dump needs a compromised device.

Data stored on your device

Your browser's local storage holds the entries the Cookies page lists, key by key: the records of the passkeys you created or signed in with here, the ledger and network you chose, the contract tokens you watch, for each asset you hold, the list's logo or that it has none, and whether sound is on. The tab's session storage holds one address of the passkey account open in it, so a reload opens that account again without a sign-in. None of it is key material.

This stays on your device. Use Disconnect to end the session, which removes the session storage entry, or clear site data in your browser to remove it entirely. Removing it does not delete the passkey itself, which lives in your authenticator or password manager.

The passkey itself holds a label, so you can tell your accounts apart: the account name you chose followed by a short random tag. The page writes it when it creates the passkey and does not change it afterwards. If your passkeys are synchronised by iCloud Keychain, Google Password Manager or another manager, that label is synchronised with them.

Data we do not collect

No account, email address or password.
No private keys, seed phrases, recovery phrases or backup shares.
No analytics on this site, no advertising, no cross-site tracking, no fingerprinting. The source tag described below is public, and it is the only count of use we have.
No server-side logs: we operate no server and collect no logs, and we do not enable or receive any traffic analytics.

Hosting

The site is static files served by a hosting provider, Radicle Garden, operated by Monadic Works GmbH, Berlin, Germany, on servers of Scaleway. Delivering the page to you necessarily discloses your IP address and the request to that provider. It processes them to serve the page and keeps access logs as its privacy policy states. We do not receive those logs and have not enabled analytics on them.

Third-party network requests

Your browser contacts the following services directly. Each request exposes your IP address, and where noted your address on that ledger, to that provider under its own privacy policy:

XRP Ledger public nodes (xrplcluster.com on mainnet, a shared cluster run by several operators and listed on xrpl.org; s.altnet.rippletest.net and s.devnet.rippletest.net on the test networks, run by Ripple) for account balance, sequence, the account's transaction history, read when the console opens and again at each refresh, and transaction submission. These receive your address, the addresses the page looks up for you (a destination, an asset's issuer), your signed transactions, and, before each signature, the unsigned transaction you are about to approve, so that the node can say whether it would succeed. At each sign-in or restore they also receive your first ten addresses, which the page checks for accounts.
XRP Ledger test faucets (faucet.altnet.rippletest.net, faucet.devnet.rippletest.net), only on test networks and only when you ask for funding or for a test destination. A funding request sends your address.
Stellar Horizon (horizon.stellar.org, horizon-testnet.stellar.org, horizon-futurenet.stellar.org, run by the Stellar Development Foundation) for the Stellar account, its balances, fees, its operations and transactions, read when the console opens and again at each refresh, and transaction submission, and the Stellar RPC (rpc.lightsail.network on mainnet, run by Lightsail Network; soroban-testnet.stellar.org on the testnet and rpc-futurenet.stellar.org on the futurenet, run by the Stellar Development Foundation) for contract tokens. These receive your Stellar address, the addresses the page looks up for you (a destination, an asset's issuer), your signed transactions, and, before each signature of a contract call, the unsigned transaction. The RPC also receives the contract ids you watch: it is asked their name, symbol and decimals once and your balance on every refresh. At each sign-in or restore Horizon also receives your first ten addresses, which the page checks for accounts.
Friendbot (friendbot.stellar.org, friendbot-futurenet.stellar.org, run by the Stellar Development Foundation), only on the Stellar test networks and only when you ask for funding or for a test destination. A funding request sends your address.
StellarExpert (api.stellar.expert, meta.stellar.expert), a community asset list, only on the Stellar mainnet and testnet. The list is asked for when you click Browse the list, and once when your account holds an asset this browser has no logo answer for. The request asks for the list and names no account or address of yours. A logo in that list is loaded from meta.stellar.expert when its row in the list scrolls into view, and for each listed asset you hold: the request names the logo, so it shows which listed assets you hold or looked at. While the list is open, a pause in your typing sends the text in the field to its asset search.
XRPL Meta (s1.xrplmeta.org), a community token directory, only on the XRP Ledger mainnet. The list is asked for when you click Browse the list, and once when your account holds a token this browser has no logo answer for. The request asks for the tokens with the most trust lines and names no account or address of yours. A logo in that list is loaded from the same host when its row in the list scrolls into view, and for each listed token you hold, once per version of the app: the request names the logo, so it shows which listed tokens you hold or looked at. The host sees the origin of this site and no referrer. While the list is open, a pause in your typing sends the text in the field to its token search.
A node you set, only when you set one in the panel the line under the card head opens. The page then asks that host, not the public node, for that network. It receives what the public node would: your address, the addresses the page looks up for you, your signed transactions and the unsigned transaction before each signature. You chose the host: its privacy policy is not ours.
Sites you choose to open from here, only when you follow a link: the xrpl.org and stellar.expert explorers from a transaction, and the pages linked in the footer and these notices.
Apps you connect, only when an app opens this page as a popup and you approve its request. The app learns your address on the ledger it named, your public key, and the signature you approved, with the transaction, authorization or message it asked for. The app's origin is on the card before you approve. Nothing about the app is stored.

The page loads no fonts or scripts from any other host, and no images but the logos above. Its content security policy allows connections to this site and to any host over https or wss, so that you can set a node. The page contacts only the hosts above and a node you set.

Anything you submit to the XRP Ledger or to Stellar is written to a public, permanent ledger that anyone can read. That is a property of the network, not of this site.

Every XRP Ledger transaction this page builds, and every JSON transaction of your own account it signs without a SourceTag, carries the source tag 379826498. The tag is the same for every user. It marks a transaction as made with GHOSTSIG, and anyone can list the transactions that carry it and the accounts that sent them. Indexers and explorers read it to count how GHOSTSIG is used. It is public with the rest of the transaction. A transaction that already has a source tag keeps it, and serialized hex and co-signed transactions are signed as they are.

Transfers outside the EU

Your browser sends each request above directly to the provider. We have no contract with these providers and receive nothing from them. Ripple and the Stellar Development Foundation are established in the United States. For the United States, the European Commission's adequacy decision covers only organisations certified under the EU-US Data Privacy Framework. The other providers (the operators of xrplcluster.com, XRPL Meta, StellarExpert and Lightsail Network) may process your IP address in any country, outside the EU and the EEA included, where the level of data protection can be lower.

Legal basis

Delivering the page rests on our legitimate interest in operating the site and keeping it available (Art. 6(1)(f) GDPR). The page's code decides which of the services above your browser contacts for what you ask it to do. Those requests are needed to provide the wallet under its terms (Art. 6(1)(b) GDPR). Each provider processes what it receives under its own terms and legal bases. Nothing here relies on your consent.

Retention

We receive no personal data, so we keep none. The hosting provider and the services above keep what they receive for as long as their own policies say. Data held in your browser stays there until you clear it, as the Cookies page lists.

Whether you must provide data

No law or contract requires you to provide personal data. Without your IP address the page cannot be delivered. Without the requests above, the send and assets tabs cannot read or reach a ledger. Signing in and the raw tab work without them.

Automated decisions

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection under Arts. 15 to 21 GDPR. In practice we hold no personal data about you, so there is generally nothing for us to disclose, correct or erase, and requests about server logs should go to the hosting provider. For anything else, contact us through the details in the Impressum.

You may also complain to a supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority for Consulting Manao GmbH is the Österreichische Datenschutzbehörde, https://www.dsb.gv.at.

Changes

This policy changes when the page changes what it processes. The version published here applies.