Noir extension privacy policy

In short

Noir does not collect, sell or share personal data. There is no Noir account, no analytics and no tracking. Noir has no server that receives your data.

What is stored on your device

• Your recovery phrase, encrypted with AES-256-GCM under a key derived from your password (PBKDF2-SHA256, 600,000 iterations). The password itself is never stored.
• Your public Stellar address and selected network (Testnet or Mainnet).
• The websites you connected, so they don’t have to ask again until you disconnect them.
• While unlocked, the signing key is held in the browser’s session memory only, is cleared when the browser closes, and is removed after 15 minutes without use.

This data stays in your browser’s extension storage. Removing the extension or choosing “Remove wallet” deletes it.

What is sent over the network

To show balances and your Noir cards, the extension sends your public address to public Stellar infrastructure run by the Stellar Development Foundation:

• Horizon (horizon.stellar.org, horizon-testnet.stellar.org) for balances.
• Soroban RPC (soroban-testnet.stellar.org) to read Noir’s on-chain card contracts.
• Friendbot (friendbot.stellar.org), only when you press “Fund with Friendbot” on Testnet.

Your recovery phrase, password and private key are never transmitted. Signed transactions are returned only to the website that asked for them, after you approve.

Websites you use

The extension makes a window.noir.stellar interface available to web pages so Stellar apps can request your address and signatures. A site learns your address only after you approve the connection, and every signature requires your approval in a Noir window. What a website does with that data is governed by that website’s own policy.

Children

Noir is not directed to children under 13.

Changes and contact

Changes to this policy are published on this page and in the GitHub repository. Questions: open an issue on GitHub.