Cloud Signer privacy policy

Cloud Signer manages signing accounts locally in your browser. It processes account names, public addresses, website permissions, transaction and message signing requests, recovery phrases, private keys and passwords to provide the functions you request. Account records and website permissions are stored in an encrypted vault on your device. Unlock material remains in memory and is discarded when the wallet locks or its background process stops. Recovery phrases are not retained as phrases in the vault. Cloud Signer does not provide password recovery.

When you approve a website connection, that website receives only the public accounts you choose to share. When you approve a signing request, the requesting website receives the resulting signature. Websites may retain information you have already shared after you revoke access. Private keys, recovery phrases and vault passwords are not transmitted to websites or to our servers. Cloud Signer does not broadcast your transactions; the requesting website handles submission.

To display transaction details, Cloud Signer may request public chain metadata from gate.polkadot.cloud. Requests contain a chain genesis hash, runtime specification version and metadata format version. The gateway and its infrastructure providers can also observe the network IP address. These requests omit browser credentials and referrers and do not send your account addresses, account names, transaction call data, messages, private keys, recovery phrases or vault passwords. The metadata endpoint is hosted by OVH and does not retain user request data.

Cloud Signer includes no analytics or advertising integration. The separate Polkadot Cloud website has its own website data practices, described at https://polkadot.cloud/privacy.

You can remove accounts and website permissions in the extension, or delete the local vault. Uninstalling the extension removes its browser-managed local storage. Independently downloaded JSON backups remain wherever you saved them and must be managed separately. Keep independent backups before deleting your vault; we cannot recover lost keys or passwords.

For questions about Cloud Signer, contact support@polkadot.cloud.