LAST UPDATED · NOVEMBER 1, 2026

Privacy policy

Our commitment

Zucchini Wallet is a self-custodial wallet maintained by the Zucchini project. This policy covers the wallet extension, zucchinifi.xyz website, api.zucchinifi.xyz gateway and registry.zucchinifi.xyz registry. We do not sell or rent user data. We do not use user data for advertising, behavioral profiling, data brokerage or training AI models. We process data only to provide, secure and maintain the features you choose, respond to support requests, and meet applicable legal obligations. We do not include advertising trackers or analytics SDKs in the wallet extension. The public website uses the limited, cookie-free measurement described below.

Public website measurement

On the public homepage, privacy page and terms page, we use a first-party script served by Crabfish to understand visits and whether people click the Chrome Web Store or public source links. Events contain a public page category, the referring website hostname, validated campaign labels, and the category and placement of a public link click. A Chrome Web Store click records download intent, not an installation or wallet activity. This shared website collector does not store full page or referrer URLs, arbitrary query parameters, wallet addresses, recovery phrases, keys, balances, transactions, payment details, email addresses, IP addresses, user-agent strings or visitor identifiers in its event records. It does not use analytics cookies, sessions or visitor profiles.

Website measurement records are deleted after 90 days. The script respects Do Not Track and Global Privacy Control. To turn it off in your browser, open the website with measurement disabled; a local browser preference remembers this choice. You can enable website measurement again in the same browser. Cloudflare processes technical connection information when serving the website and receiving events. This public website measurement does not instrument the wallet extension, gateway, registry or private application pages.

Your wallet stays on your device

Recovery phrases, passwords and wallet private keys are processed locally. They are not sent to the Zucchini gateway or registry. The extension stores an encrypted wallet vault, encrypted wallet databases and transaction records, together with settings, synchronization information and network caches. Backups are encrypted files saved where you choose. Old encrypted wallet records may be retained during upgrades to protect recovery. Keep your recovery material private; support will never ask for it.

Connected websites and local preferences

The extension provides a packaged wallet connection bridge on HTTPS pages and local development pages. The bridge does not collect your browsing history. A website must request your permission to read receiving addresses or balances or request payments. Every payment needs a separate wallet approval. Connected website origins and permissions are encrypted locally; revoke them in Settings. Websites receive approved account information and the result of their own payment requests, including a submitted transaction identifier. Connection is not an endorsement of the website. Contacts are saved only when you choose, encrypted locally, and not uploaded to the registry. Language and receiving-address preferences are stored locally. An incoming viewing key can be exported locally after password confirmation; connected websites cannot request it. Sharing a viewing key with a service exposes the incoming payment information it can decrypt, though it cannot spend funds.

Network synchronization and transactions

Your selected Zcash RPC service receives the requests needed to synchronize and broadcast transactions. The defaults are ChainSafe endpoints. Providers can observe IP addresses, timing, block ranges, transparent-address queries where applicable and broadcast transactions. Shielded scanning takes place locally. Opening a transaction explorer shares the transaction identifier and ordinary browser metadata with that explorer. Shielded payments do not hide information you separately disclose to services or publish on a blockchain.

Gateway, swaps and Buy

The gateway uses an installation public key and short-lived session to authenticate requests; these are separate from wallet spending keys. User-selected ZNS, Swap and Buy features process the requested identity, network, assets, amounts, destination/refund addresses, order identifiers, transaction identifiers and status information needed for that service. Relevant information is shared with the selected providers, including NEAR 1Click and Peer. Buy may involve Cash App, Venmo, Wise or Revolut, after you grant access. Selected payment-session material is encrypted directly for Peer’s attestation service; plaintext is not sent to the Zucchini gateway or persisted by the extension. Temporary encrypted proof or authorization material may be retained in the browser session for retries. These providers have their own terms and privacy policies. Where conversion settles to a transparent Zcash receiver, that boundary is disclosed before use.

NEAR wallet and cross-chain payments

The NEAR wallet derives a separate signing identity from your existing recovery phrase. It does not replace your Zcash, Base or Solana keys. Its confidential account and balances are read through authenticated provider services, rather than public balance queries. When you choose this feature, the Zucchini gateway and relevant NEAR Intents/1Click services process the account ID, public signing key, selected assets and amounts, recipient/refund details, deposit and transaction identifiers, and status requests needed for that operation. After your explicit approval, the bounded signed payment authorization is retained for submission and recovery. Private spending keys and recovery phrases remain on your device.

Confidential account data is not a guarantee of anonymity. Funding from shielded Zcash crosses a public deposit boundary: the deposit amount and public transaction are observable. External-chain payments disclose the payout address and transaction on that chain; Zcash payouts from this feature use transparent recipients. Providers and the gateway can process the private account information required to deliver the service. An authorization may remain executable until its stated deadline for several days, and a payment accepted before that deadline can continue settlement afterward.

The device keeps an encrypted NEAR wallet journal separately from existing wallet histories. The gateway retains operation records and account-level reservations to recover interrupted payments without silently replacing them. Removing local history does not erase gateway, provider or public blockchain records. Existing legacy public Intents records keep their original recovery semantics. Service-side retention follows the policy below.

Optional X account connections and tipping

Connecting X sends your X account ID, handle, selected receiving address and network to the registry, which stores the binding, version, verification time and revocation history. Authorized clients can resolve an active binding. This associates your social identity with a receiving address; it is not anonymous. Fresh X authorization is required to connect, update or disconnect. OAuth credentials are used to verify ownership rather than to post on your behalf.

X website access

When you enable Tip buttons, the content script identifies the author of the post you select. If necessary, a request to X’s website profile endpoint uses your existing browser session. A page-context function reads the current CSRF value transiently for that request; it does not store or export it. Browser login cookies stay in the browser. Only the matching author ID and handle, or a fixed error code, leave the page context for lookup. We do not collect your browsing history for unrelated purposes. For an unregistered recipient, the extension drafts an invitation; you decide whether to post it. Existing drafts are preserved.

Permissions, hosting and limited use

Optional browser access is requested for the X, RPC, gateway or payment-service origins needed by your selected feature. You can revoke it in the extension or Chrome settings. Cloudflare and other infrastructure providers process network metadata and operational logs to deliver and protect services. Our use and transfer of information received through Chrome APIs is limited to the disclosed wallet features and complies with the Chrome Web Store User Data Policy, including Limited Use requirements. We do not transfer this information to advertising services.

Retention and deletion

Wallet removal clears the wallet-local data described in the removal flow; separately saved backups remain where you saved them. Removing the wallet does not disconnect your X registration. Disconnect X first to stop new registry resolutions: the current implementation retains a versioned revocation record including the last address and audit history. Gateway order and security records persist for operation and recovery; there is currently no automatic deletion schedule for these records. Expired authorization records may remain stored even though they cannot be reused. Hosting logs and backups follow the infrastructure provider’s configured retention. Contact us about deletion of service-side data; we will explain any records that must remain for security, recovery or legal reasons. Public blockchain records and information held independently by third parties cannot be erased by Zucchini.

Contact and updates

For privacy, deletion or support requests, contact x@zucchinifi.xyz. Do not include recovery phrases, passwords or private keys. This policy may be updated as features change; the revision date identifies the current version. Material changes to data handling will be disclosed before the affected feature is used.