Privacy policy Built to know almost nothing about you.
No accounts, no cookies, no tracking. Your keys are made and kept on your device. This page lists everything that does reach us, and why, in plain language.
Last updated .
The short version
- We never get your keys. Your recovery words and private keys are created in your browser and stay there, encrypted with your password. We cannot see them, and we cannot move your money.
- No accounts. There is no sign-up, no email address and no profile. We do not know who uses Monero Pay.
- No cookies and no tracking. We use no analytics, no ads and no third-party scripts. Nothing follows you around the web.
- One honest exception. To sync, your wallet talks to the Monero network through our relay. The relay sees your IP address and what your wallet asks the network for, never your keys or your balance. You can skip it by connecting your own node.
Where your data lives
Everything Monero Pay touches, where it is kept, and who can see it.
| What | Where it is kept | Who can see it |
|---|---|---|
| Recovery words and private keys | Your browser, encrypted with your wallet password | Only you |
| 2FA secret and your own node's address | Your browser, encrypted with your wallet password | Only you |
| Contacts, payment requests and sync progress | Your browser, encrypted with a key from your wallet | Only you, while the wallet is unlocked |
| Wallet name, main address, restore height, whether 2FA is on | Your browser, not encrypted, so the lock screen can show which wallet it is | Anyone who can open this browser profile |
| Sync requests and transactions you send | Pass through our relay to a Monero node, unless you use your own node | Our relay and the node, briefly |
| Your IP address | Held in our server's memory for up to one minute, to stop floods | Our server, never written to disk |
| Emails you send us | Our inbox | The Monero Pay team |
What stays on your device
The wallet runs in your browser. When you create or restore a wallet, the recovery words and keys are made on your device and saved in your browser's storage, encrypted with the wallet password you choose. That password never leaves your device either, so we have no way to reset it or to open your wallet.
A few details are saved without encryption: the wallet's name, its main address, its restore height, when it was created, and whether 2FA is turned on. The lock screen needs them to show you which wallet it is before you type your password. They cannot be used to spend, but anyone who can open your browser profile could read them.
Using Remove wallet deletes all of this from the device. Two display preferences (whether amounts are hidden, and whether you bookmarked the wallet) stay until you clear your browser's site data. Your money is not affected: it lives on the Monero network, and your recovery words bring it back. See how to back up a Monero wallet.
The browser extension
The Monero Pay extension for Chrome and Firefox is the same wallet in a different window, and it follows the same rules. Your recovery words, keys and records are kept in the extension's own storage in your browser, encrypted in the same way. While the wallet is unlocked, the decrypted keys are held only in the memory of the extension's background page, and they are gone when it locks: after the idle time, when every Monero Pay window has been closed for a few minutes, when your computer locks, or when the browser closes.
The extension cannot read the websites you visit. It has no content scripts and no access to web pages, and no website can talk to it. It asks your browser only for what it needs:
- Storage, unlimited storage: to keep the encrypted wallet and its sync progress, which can grow to tens of megabytes for an older wallet.
- Access to this wallet: the relay described below, the only site it connects to by default.
- Idle: to lock the wallet when your computer locks.
- Offscreen and side panel (Chrome): to keep the wallet running while the small popup is closed, and to show it in the side panel.
- Your own node, if you add one: the browser asks you to allow that one address, and the access is removed again when you stop using it.
Browser stores ask extensions to label what data leaves the browser. Ours says financial information, because the transactions you send pass through our relay on their way to the Monero network, exactly as they do in the web wallet. Nothing else is sent, nothing is sold, and none of it is used for anything but your wallet. The extension has no analytics and no ads.
What our server sees
The node relay
A wallet has to read the Monero blockchain through a Monero node. Most public nodes cannot be reached directly from a web page, so by default your wallet's requests pass through our relay on their way to a node.
The relay sees your IP address, which blocks and outputs your wallet asks about, and, when you send, the finished transaction on its way to the network. Your wallet checks the blocks for your payments on your own device, so the relay never learns your balance, your addresses or your keys. A Monero transaction hides its amount and its receiver, but the relay could tell that your IP address sent one. We do not log any of this. The node at the other end sees the same requests, coming from our server instead of from you.
For full privacy, connect your wallet to your own node in Settings. Then your wallet skips our relay entirely. Learn more about what a remote node can see.
Prices, names and network numbers
To show values in your currency, the wallet asks our server for the current Monero price. That request carries no wallet data. Our server collects prices from public exchange feeds and the European Central Bank, so your browser never contacts them.
When you send to a name such as an OpenAlias address, our server looks the name up through a DNS service (Cloudflare's, by default). The DNS service sees our server, not you, and we see only the name, not who is paying or how much. The fee calculator, mining calculator and donation page get network numbers from our server in the same way.
Floods and errors
To stop anyone from overloading the site, our server counts requests per IP address in one-minute windows. The counts are kept in memory only and forgotten after a minute. Our web server keeps no access logs. When something breaks, the server records the error, such as a node that did not answer, without your IP address.
Payment links
A Monero Pay payment link keeps the address, amount and note after the # sign. Browsers never send that part of a link to a server, so opening a payment link tells us nothing about the payment. Your browser reads it and draws the QR code on its own.
Monero Pay Pay, the checkout for websites, runs on the merchant's own server. Invoices and orders stay with the merchant. We receive nothing from it.
Cookies and tracking
Monero Pay sets no cookies. There is no analytics, no advertising, no fingerprinting and no social media widgets. Our pages load scripts, fonts and images only from our own server, and our security settings tell your browser to refuse anything else.
If we add visitor statistics later, they will be cookie-free counts of page views on the article pages only, never on the wallet. We will update this page before that happens.
When you email us
Mail to our addresses passes through Cloudflare's email forwarding service to the team's inbox. We use what you write only to answer you, and we delete it when it is no longer needed. Never put your recovery words in an email: we will never ask for them, and anyone who does is a scammer.
If you send a donation and ask to be listed as a supporter, we publish only the name you give us.
Other services involved
- Monero nodes. The relay forwards wallet requests to public Monero nodes run by others. They see our server's address, not yours.
- Our hosting company. The site runs on a server we rent and manage ourselves. The hosting company provides the machine and the network connection.
- Cloudflare. Forwards our email, and answers name lookups for OpenAlias as described above.
- Affiliate links. A few article pages link to hardware wallet shops, marked "Affiliate link". Nothing is loaded from the shop until you click. If you do, the link passes through the shop's affiliate service (for Trezor, affil.trezor.io) on its way to the shop, which records the visit under its own privacy policy. We receive only a commission report, never who you are or what you bought. Wallet pages never carry these links.
We do not sell, rent or share data with anyone, and we have none to sell.
Your choices
- Connect your own node, so no wallet traffic reaches us.
- Use a view-only wallet on shared devices, so the browser never holds a key that can spend.
- Remove the wallet from a browser at any time. Keep your recovery words safe so you can bring it back.
- Use a VPN or Tor if you do not want our relay or a node to see your IP address.
Wherever you live, you can ask what we hold about you or ask us to delete it. Apart from emails you have sent us, there is nothing we could link to you.
Changes and contact
No public email contact is configured for this independent installation. Never send recovery words or private keys to anyone claiming to provide support.