Privacy

The short version

Ladon never sees your seed phrase, private keys or funds, and never asks for them. It cannot sign, send or block anything.

The only thing the extension sends to Ladon is the address it is checking. Your browsing history, the pages you visit and your balances stay on your device.

What the extension sends

When a site asks your wallet to sign a transaction, Ladon sends the addresses that transaction pays or hands control to (up to five) to the Ladon API, so it can check them.

When you check an address in the toolbar popup, that address is sent to the API.

On Axiom, the token addresses shown on the page are sent to the API so their rug risk can be labelled.

Nothing else is sent. This version of the extension includes no analytics.

What stays on your device

A list of the addresses you have paid and your own wallet addresses, used only to spot poisoned lookalikes. It holds up to 500 addresses and never leaves your browser.

A list of known scam websites. Ladon downloads the whole list and checks sites inside your browser, so the sites you visit are never sent anywhere.

The sites you chose to stay on after a warning. This is cleared when you close your browser.

You can delete all of it at any time by removing the extension.

Reports

If you report a scam, we store the address you report, the transaction signature and anything you write about what happened. Please do not include personal details.

To stop spam and duplicate reports, we also store a scrambled code made from your IP address. It cannot be turned back into your IP address. We do not store the IP address itself.

Season 1 points and connected accounts

If you join Season 1, we store your public wallet address, points activity, daily check-ins and referral relationships. The leaderboard shows a shortened wallet address and points total.

Wallet sign-in asks you to sign a single-use message proving ownership. This does not authorize transactions or access to funds. The sign-in session expires after 12 hours and is kept in your browser's session storage; the server stores only a hash of the session credential.

If you connect X, Ladon requests read access to your profile, follows and posts to verify rewards. We store your X account ID, username, encrypted temporary access credential and completed quest proofs. Ladon does not publish or follow accounts for you, and it does not request your direct messages or email address.

You can remove X access from the airdrop page or revoke the app in X settings. Removing access deletes the stored credential. We retain the Season 1 account binding and completed reward records to prevent duplicate rewards. X usernames are not shown on the public leaderboard.

Who else is involved

Helius provides the Solana data Ladon uses. When an address is checked, the Ladon API asks Helius about that address, never about you.

Vercel hosts the website and the API, and keeps standard server logs, including IP addresses, for a short time.

Supabase stores Ladon's database of reports, scores and Season 1 participation records. X provides account and post information when you choose to connect it for quests.

We never sell or share data for advertising.

Scores are not accusations

Every Ladon score is a probability with its reasons. If you think Ladon is wrong about an address you own, open an issue on GitHub and we will look at the evidence again.