Privacy Policy

1. Who this policy covers

This policy covers the Portage browser extension (“the extension”) and this website. “Portage”, “we” and “us” mean the developer of Portage, who can be reached at [YOUR CONTACT EMAIL].

2. What Portage doesn't collect

Portage does not collect, store, sell or share personal data. There is no Portage account, no sign-up and no email address requested. The extension contains no analytics, telemetry, crash reporting, advertising or tracking of any kind.

We never receive your recovery phrase, private keys or password. Apart from the bridge requests described in section 4, nothing about your wallet or activity passes through any server we run.

3. What stays on your device

The extension keeps the following in your browser's extension storage (chrome.storage.local), on your computer only:

• Your encrypted recovery phrase. It is encrypted with AES-256-GCM using a key derived from your password with PBKDF2. Your password itself is never stored.
• Your accounts: their names and public addresses.
• Settings, such as theme, slippage, quick-buy amounts and a custom RPC address if you set one.
• History of the trades, orders and bridges you make in Portage, used for the Activity list and for profit-and-loss figures.
• Cached data, such as the list of networks available for bridging, so the panel loads faster.

Your theme choice is also kept in the panel's local storage so it can be applied before the panel draws. None of this is sent to us. Parts of it are used in requests only where a feature needs them, for example your public address when fetching balances.

Removing the extension deletes this data from your browser. Make sure your recovery phrase is backed up first: without it, your wallet can't be restored.

4. Services the extension contacts

To show prices and balances, get quotes and send transactions, the extension talks to outside services. Requests go directly from your browser to each service, except bridge requests, which pass through a Portage proxy (described below).

Every request reveals your IP address and ordinary request details (such as browser type) to the service receiving it, as any web request does. Each service handles that data under its own privacy policy and terms, which we don't control.

• Husher, through the Portage proxy

  Used for

  Bridge quotes, creating bridge orders and checking their status.

  Receives

  The source and destination networks and tokens, amounts, your receiving address and refund address, and order IDs.

• Jupiter

  Used for

  Solana swap quotes and execution; limit, take-profit and stop-loss orders; token information.

  Receives

  Your wallet address, tokens, amounts, order details, transactions you have signed, and, for orders, a sign-in message signed by your wallet that proves you control the address.

• LI.FI

  Used for

  Swap quotes and the transactions to sign on EVM chains.

  Receives

  Your wallet address, the chain, tokens and amounts.

• DexScreener

  Used for

  Token prices, market data and the price chart in Pro mode.

  Receives

  The token and pool addresses you look up. The chart is DexScreener's own web page, loaded inside the panel only when you open it; that page may use cookies or similar technologies under DexScreener's policy.

• GeckoTerminal

  Used for

  Holder counts and, for some tokens, the price chart.

  Receives

  Token and pool addresses. As with DexScreener, its chart is loaded only when you open it.

• DefiLlama

  Used for

  Token prices and token icons.

  Receives

  Token addresses.

• Blockchain RPC providers

  Used for

  Reading balances and transaction status, and broadcasting transactions you sign.

  Receives

  Your wallet addresses and signed transactions. By default these go to public RPC endpoints for each network. If you set a custom RPC in Settings, requests for that network go to the provider you chose instead.

• Token image hosts

  Used for

  Token logos.

  Receives

  A request for the image. Logos are loaded from the addresses that token data sources supply, which can include GitHub, IPFS gateways, Robinhood's image server or a token project's own website.

The Portage proxy

Bridge requests go through a small server function run by Portage. It exists so that Portage's Husher API key never ships inside the extension: the proxy adds the key and forwards your request to Husher. It receives the request details listed for Husher above, plus the extension's version number. It never receives your keys or recovery phrase, and we don't use these requests to identify or profile you.

Links you open

Links to block explorers (such as Solscan or Etherscan) open in a new browser tab only when you click them.

5. Blockchains are public

Transactions you make are recorded permanently on public blockchains. Anyone can see the addresses, amounts and timing involved. Portage can't change or delete on-chain data.

6. This website

This website uses no cookies, analytics, advertising or tracking, and loads nothing from third parties: its scripts, styles and images are all served from this site, and it uses your device's own fonts. If you use the light/dark switch, your choice is saved in your browser's local storage on your device and is never sent to us.

The company that hosts this site may keep standard server logs, such as IP address, browser type and the pages requested, to run and protect its service.

7. Extension permissions

• Side panel, to open Portage in Chrome's side panel.
• Storage, to keep your encrypted wallet, settings and history on your device.
• Alarms, to check on bridges in progress in the background.
• Host access, limited to the specific services and RPC endpoints the extension calls. The extension has no content scripts: it can't read or change the web pages you visit.

The use of information received by the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

8. Your choices

Because we hold no personal data about you, there is nothing for us to access, correct or delete. The data on your device is under your control, and removing the extension deletes it. For data held by the third-party services above, contact them directly.

9. Children

Portage isn't directed to children. We don't collect personal data from anyone, including children.

10. Changes to this policy

If this policy changes, we'll update this page and the date at the top.

11. Contact

Questions about this policy: [YOUR CONTACT EMAIL].