What xrpl.to keeps, and what it never sees

• A wallet you create or import is encrypted inside your browser’s own storage and is never uploaded. xrpl.to’s servers never hold a seed, a private key or a wallet password. Transactions are signed on your device.
• Your browser keeps a list of your accounts (addresses and the names you give them) so the site can show balances. That list contains no secrets. Watch-only accounts hold no key at all.
• If you connect an external wallet (Xaman, Joey through WalletConnect, or a browser-extension wallet), the transaction is signed inside that app. xrpl.to only prepares it.
• A Ledger account keeps its key on the Ledger. Your browser talks to the device directly over USB or Bluetooth and stores only the account’s address, public key and derivation path.
• The trade-off this design accepts: while a wallet is unlocked on a device, that device can sign without asking again. Keep your device clean and keep a backup of your seed.

• Every request reaches our servers with your IP address, the page or API path you asked for and your browser’s identification string. A page about an address has that address in its path, so the log records that your IP looked at it.
• If a tap, click or key press takes more than 200 ms to update the screen, the page reports it: the page type (never the address in it), the control’s tag and label (never what you typed), how long each step took, which of our scripts was busy and whether the screen is phone-sized. Chrome, Edge and other Chromium browsers only. It goes into the same web-server logs.
• Raw web-server logs are kept for 14 days. Aggregated statistics per page or endpoint (request counts, status codes, timing) are kept for 90 days. Per-IP hourly request counts, used to stop abuse and plan capacity, are kept for 7 days.
• Cloudflare sits in front of the site for encryption, bot filtering and caching. It sees the same requests and keeps its own logs under Cloudflare’s privacy policy.
• There is no sign-up. The site never asks for an e-mail address or a name.

Cloudflare's policy: cloudflare.com/privacypolicy

• No analytics SDK, advertising pixel or fingerprinting script runs on the site. No third-party script runs at all: the site instructs your browser to block any script that does not come from xrpl.to itself.
• No cookies are set for visitors. One session cookie exists for staff sign-in to the admin area.
• Personal data is not sold or shared with anyone for advertising. A Global Privacy Control signal from your browser therefore changes nothing: it is honoured by construction, with no banner to click.
• Chrome’s advertising interest (Topics) API is switched off for this site.

• Messages you send to the assistant go to the model provider you choose. With xrpl.to’s own models the request goes from our server to the provider named next to the model. With your own API key, our server relays the request to that provider using your key; the key is encrypted in your browser and is never stored or logged by xrpl.to.
• So the assistant can answer questions about your portfolio, each request includes your connected address, XRP balance, largest holdings, open orders, watchlist and running automations. All of that is public information on the XRP Ledger; nothing private is added.
• Your chats are kept in your browser and, unless you turn it off in the assistant’s connection settings, on our server for 90 days after the last message, to improve the assistant and to show your history on your other devices. Seeds and pasted images are removed before a chat is saved. Turning it off deletes the copies on our server.
• Our server also records which wallet used which model, the token counts and the cost, for billing.
• Voice input uses your browser’s speech recognition: Chrome sends the audio to Google and Safari to Apple for transcription. Only the resulting text reaches xrpl.to, and the site asks before the microphone is used for the first time.

• Automation scripts and the testnet faucet open a direct connection from your browser to a public XRP Ledger node (the mainnet cluster, testnet or devnet), which sees your IP address.
• Connecting a WalletConnect wallet uses the WalletConnect relay and its verification service.
• Artwork for NFTs that xrpl.to has not yet mirrored is loaded from public IPFS gateways.
• Everything else, including prices, charts, order books and the market data the assistant uses, is fetched by our servers and served to you from xrpl.to.

• Kobbi is xrpl.to’s wallet app for iPhone and Android, also at mobile.xrpl.to. Its keys stay on your phone: each account is encrypted with AES-256 under a key that only your PIN, your fingerprint or face, or your YubiKey opens, kept in the phone’s secure storage (the Keychain on iPhone, the Keystore on Android). Nothing is uploaded, and there is no Kobbi account to sign up for. Removing an account in Settings deletes its key from the phone.
• A YubiKey account’s private key is created inside the YubiKey and never leaves it. The app stores only the account’s address and public key. NFC and USB are used only to talk to the YubiKey.
• On Android the app is excluded from cloud and device backups, so its data is never copied off the phone that way.
• Apart from Google’s QR scanner (below), the app talks only to xrpl.to. It sends api.xrpl.to the addresses whose balances, tokens, NFTs and history it shows you, and the transactions you sign, which it submits to the XRP Ledger. Our servers see your IP address with those requests and keep them as “What our servers see” describes. Images also come only from xrpl.to.
• Cross-chain swaps (Bridge) are carried out by ChangeNOW. The app asks our server, which passes ChangeNOW the coins, amounts and addresses of the swap; ChangeNOW handles it under its own privacy policy. The app never connects to ChangeNOW itself.
• DApp Connect pairs the app with a website through xrpl.to’s relay, which passes the website’s signing requests and your answers between the two.
• The camera is used only to scan QR codes. Google’s ML Kit reads the code on the phone and sends Google usage and performance diagnostics: device and app details, a per-installation identifier, performance figures and error codes.
• There is no analytics, advertising or crash-reporting SDK in the app.

Write to hello@xrpl.to. Security researchers will find the reporting address and scope in security.txt. The terms of service are in the documentation.