GHOSTNET browser extension — privacy policy
Last updated: November 5, 2026.
GHOSTNET ("we") publishes the GHOSTNET extension for Chrome. This policy covers what the extension handles and what our server receives from it. The extension is built to work with as little of your data as possible.
What the extension reads
| Where | What it reads | When |
|---|---|---|
| x.com / twitter.com | The handle in the address of the page you are on. If you turn on timeline chips, also the handles of post authors visible on screen. | Always on X (profile badge can be turned off) |
| The tab where you click the GHOSTNET toolbar button | That tab's address, once, to show what it is | Only when you click the button |
| Any website | The hostname and whether it was loaded over http or https | Only if you turn on the site lens and grant access to all sites |
| Supported block explorers (Etherscan, Basescan, Arbiscan, Polygonscan, Blockscout) | The wallet address in the page address | Only if you turn on the explorer lens and grant access to those sites |
| GhostSign | The transaction data you paste | Only when you paste it |
| Any website (GhostSign guard) | Wallet signature requests the site sends to your wallet (transactions, typed data, messages), the site's hostname, and the chain ID | Only if you turn on the GhostSign guard and grant access to all sites |
The extension does not read page content, form fields, passwords, cookies, or your browsing history. It never asks for a seed phrase or private key. The guard sees requests on their way to your wallet, but it never signs, changes or sends anything; your wallet still asks you to confirm.
What is sent to the GHOSTNET server
Requests go only to the GHOSTNET server configured in the extension (the default GHOSTNET server, or a server you set yourself in Settings).
- X handles from the cases above, to fetch scores and reports, and the handle you ask to analyze.
- Hostnames (never full addresses or paths) when you click "Check threat lists", or for every site you open if you turn on automatic threat-list lookups.
- Wallet addresses you look up or open on an explorer, and addresses in a pasted transaction when you click "Check addresses".
- A transaction and the sending address, when you click "Simulate" in GhostSign, or when the GhostSign guard checks a transaction. The server runs it through a public blockchain node's simulation method and does not store it.
- Your API key, if you add one, in a request header.
Pasted transaction data is otherwise decoded inside the extension. Typed-data and message signatures are decoded only inside the extension and never sent.
The server keeps standard request logs (time, route, status, IP address) for up to 30 days for security and rate limiting. GHOSTNET's own application logs leave out queried handles, hostnames, addresses and transaction contents. The hosting provider's access logs may include request paths (which contain the handle, hostname or address looked up) and are kept for up to 30 days. Results are cached on the server so repeated lookups are fast; cached results are public data (public X posts, public threat lists, public blockchain data), not information about you.
The server, in turn, queries public sources: the official X API, phishing lists (MetaMask, ScamSniffer, Polkadot.js), domain registries (RDAP), Google Safe Browsing or Web Risk (if configured), Blockscout, public blockchain RPC nodes (PublicNode, dRPC, Robinhood Chain), GeckoTerminal and CoinGecko. It sends them only the handle, hostname, address, token or transaction being looked up.
What is stored in your browser
- Settings and your API key (if you add one) in the extension's local storage. Web pages can't read it; GHOSTNET's in-page scripts are denied access to it where Chrome supports that.
- Cached results in session storage, which Chrome clears when you close the browser. "Clear cached results" in Settings clears them immediately.
Accounts and deletion
GHOSTNET has no user accounts beyond optional API keys. A key is stored on our server only as a one-way hash, with a label and an optional linked wallet address.
- Sign out removes the key from this browser.
- Revoke key and delete account (Settings) disables the key everywhere and deletes its label and linked wallet. The credit ledger (amounts, dates and report references) is kept for accounting and is no longer linked to any personal detail.
- Uninstalling the extension deletes everything it stored in your browser.
To ask for anything else to be deleted, open an issue at https://github.com/ironiamison/ghostnet/issues (do not include your API key).
What we don't do
- No selling or sharing of data with advertisers or data brokers.
- No analytics, ads or third-party tracking code in the extension.
- No use of data for credit-worthiness or lending decisions.
- No remotely hosted code: everything the extension runs ships inside it.
About the results
GHOSTNET reports are statistical signals computed from public data. A Ghost Score is not a finding that a person is a bot, a scammer, or acting in bad faith. Website and wallet checks report what the listed sources say. Not being listed does not make a site or wallet safe.
Changes and contact
We will update this page and the "Last updated" date when this policy changes. Questions: https://github.com/ironiamison/ghostnet/issues.
Chrome Web Store User Data disclosure
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.