Privacy Policy

Who is responsible

Tamias is built and run by Lukewarm Labs Foundation. Lukewarm Labs Foundation is the data controller for everything described on this page and is answerable for it. Where this policy says “we,” that is Lukewarm Labs Foundation speaking.

The contact point for anything in this document — questions, requests, complaints — is privacy@tamias.io. If you need a postal address in order to exercise a legal right or bring a complaint, ask at that address and it will be given to you.

What it covers

Tamias builds tools for running a Safe — a multi-signature wallet — without needing to hand-build transactions, and a screened, non-custodial rail for moving value out of one. This policy covers three things we operate:

The web app

app.tamias.io, where you sign in with a wallet, manage a Safe, and review and propose transactions.

The extension

Tamias Recorder, which records what you do in a dApp as a Safe batch instead of sending it on-chain.

This site

tamias.io, the marketing site you are reading now.

It does not cover the dApps you visit, the wallet software you use, or the blockchains themselves. A public blockchain is public: anything you send to one is outside our control and outside this policy, permanently.

This is the section a reviewer should read closely, because the extension requests host permissions for all URLs and that is a broad ask. What follows is exactly what it does with them.

When you are not recording

The extension’s content scripts load on pages you visit, as any extension’s do. On load, each one asks the extension’s background service worker a single question: is this tab recording? If the answer is no — which it is for every tab except one you explicitly started a recording in — they stop there. No wallet object is created, no recording sidebar is injected, the page’s fetch and XMLHttpRequest are left exactly as the page defined them, and nothing about the page is recorded, read or transmitted.

The extension is also explicitly excluded from app.safe.global, and one small script — the bridge that lets our own web app ask the extension to start a recording — runs only on our own origins, named one by one in the manifest. A page anywhere else cannot load it and cannot start a recording.

When you are recording

A recording session starts in the Tamias web app: you choose a Safe and a dApp URL, and the extension opens that URL in a new tab and binds the session to it. Only that tab behaves differently, and only for as long as the session lasts.

In that tab, the extension examines outgoing requests against a single rule:

• If the request is not a POST, it passes through. Page navigations, images, scripts, stylesheets, and every GET request the page makes are never examined.
• If the body is not JSON-RPC, it passes through. A form submission, a file upload, an analytics beacon, an ordinary API call — none of these parse as JSON-RPC and none are inspected further, forwarded, stored or logged.
• If the JSON-RPC call is for a blockchain other than the one your session records on, it passes through to the page’s own endpoint.
• Only what is left — JSON-RPC calls for your session’s chain — is redirected to your session’s private fork.

There is one case worth naming explicitly, because it involves a request the extension makes rather than one it observes. When a recording session is active and the page POSTs JSON-RPC to an endpoint the extension has not seen before, it cannot yet tell whether that endpoint serves your chain. Rather than guess, it holds the request and sends one small query — eth_chainId, which asks “which blockchain are you?” — to that same endpoint the page was already talking to, from the page itself. The answer is remembered for that endpoint for the life of the page, so it is asked at most once per endpoint. Nothing about this query is sent to Tamias, and it contains no information about you.

What leaves your browser, and where it goes

Redirected JSON-RPC calls go to Crucible, our session service, at hudini-crucible.fly.dev, hosted in Frankfurt. Each session runs a private, disposable copy of the blockchain — a fork — and each request carries a token scoped to that one session. What arrives there is the JSON-RPC method and parameters: the transactions the dApp wants to send, and the chain state it reads to build them.

That is the whole of it. In particular, the extension does not send us:

• your browsing history, or the addresses of pages you visit;
• the content, text, or form input of any page;
• cookies, credentials, or authentication tokens belonging to any site;
• requests to any endpoint that is not serving JSON-RPC for your session’s chain;
• anything at all from a tab that is not recording.

One address is transmitted deliberately: the Safe you are recording for. The dApp needs to see it as the connected account, and Crucible needs it to build the fork. It comes from the Safe you chose in the web app, not from anything observed in your browser.

To label the recorded calls in the sidebar — so a row reads 1,000 USDC rather than a raw number — the extension reads token names off your own session’s fork, never a public service. Which tokens your recording touched is not disclosed to any third party.

What the extension cannot do

It cannot sign. Every signing method — personal_sign, eth_signTypedData and the rest — is refused, in the extension and again at the server. A recording collects intent; your Safe’s own signers authorise it afterwards, in the app, with their own keys. Nothing recorded is broadcast to a real blockchain. The extension holds no private key, and we never hold your funds.

The extension requests three things and nothing else: host access to all sites, and the tabs and sidePanel permissions. That is the complete list in its manifest, which you can read for yourself on the extension’s store listing.

Host: all URLs

You choose which dApp to record. That could be any site, and the choice is made after the extension is installed, so there is no narrower list to declare. What the extension does with the access is bounded by the interception rule in section 2 — JSON-RPC POSTs, in a recording tab, on your session’s chain, and nothing else.

tabs

To open the dApp in a new tab and bind the session to it before the page loads (a dApp asks for a wallet within milliseconds, and a session that arrives late has missed the question); to take you back to the Tamias tab when you press Finish; and to end the session when you close the tab. It is also how the recording sidebar works out which tab it is showing, by asking which tab is currently in front. Every one of those acts is on a tab involved in a recording. The extension does not enumerate, read or monitor the other tabs you have open, and nothing it does with tabs is reported to us.

sidePanel

To show the recording sidebar — the live list of what you have recorded so far — in browsers that render a native side panel. Where they do not, the same sidebar is shown as a docked panel in the recording tab itself.

Nothing else is requested. In particular the extension declares no storage permission and makes no call to browser storage: it keeps a recording session in memory in its background service worker and writes nothing to disk. It also declares no history, cookies, bookmarks, downloads, webRequest, clipboard or geolocation permission, and therefore cannot read any of them.

Chrome Web Store Limited Use: we do not sell user data; we do not use or transfer user data for any purpose unrelated to the extension’s single purpose of recording dApp interactions as a Safe batch; and we do not use or transfer user data to determine creditworthiness or for lending purposes.

A recording session is a disposable copy of a blockchain plus the ordered list of calls you made against it. Both live in memory in the session service. Neither is written to a database or to disk.

• A session is destroyed ten minutes after its last use. A sweep runs every thirty seconds looking for sessions past that idle window, ends them, and frees the fork.
• It is also destroyed when you press Finish, when you close the recording tab, and when the service restarts.
• No session lives longer than four hours, however busy it is. That cap is well past any recording an ordinary session needs, and it is there so a slot cannot be held indefinitely by keeping it active.
• The service logs one line per request: the HTTP method, the route, the session identifier, the status code and how long it took. No request bodies, no request headers, and no IP addresses are logged. Session tokens and upstream credentials are stripped from anything it logs or returns.

When you finish a recording, the resulting batch is carried back into the web app, where it becomes a proposed Safe transaction like any other and is retained under section 8. The session that produced it is not.

Who you are to us

You sign in by signing a message with your wallet. Your identity is your wallet address. We do not ask for — and have no field for — an email address, a legal name, a phone number, a password, or a document.

What we store

• Your wallet address, as your account identifier, and your role in each organisation you belong to.
• Organisation and Safe details: the organisation name you choose, the Safe addresses you add, and a public mirror of each Safe’s owners, threshold and transaction history read from the blockchain.
• Anything you type: address-book labels, transaction descriptions, invite records. If you write a person’s name against an address, that name is personal data and we hold it because you put it there.
• Payment schedules, if you use them: a schedule name, and for each line a recipient address and an amount. We do not collect employee names, contracts, tax details or any identity document — a payroll here is a list of addresses and amounts, and any name attached to one is a label you wrote in your own address book.
• An organisation audit log of who did what — created, renamed, invited, proposed, signed, executed — recording the values before and after each change. It is append-only and cannot be edited, which is the point of it: it exists so an organisation can answer “who authorised this?” and so can we, if lawfully asked. See section 8 for what that means for deletion.
• Push tokens, only if you pair a phone for notifications. Notifications tell you that something needs your signature; nothing executes from a notification.

Cookies and local storage

The app sets an HttpOnly session cookie when you sign in, a cookie recording which organisation you are currently viewing, and a cookie from the wallet-connection library that remembers which wallet you used. The session cookie lasts thirty days; the admin console’s lasts eight hours. Your browser’s local storage holds your light/dark preference, the organisation you last had open, and any transaction batch you have part-built but not yet proposed. All of these are strictly functional. There are no advertising cookies and no tracking cookies, because there is no advertising and no tracking.

What your browser talks to directly

Managing a Safe means reading a blockchain, and your browser does some of that reading itself rather than through us. When it does, it contacts a public blockchain node run by a third party, and that node sees your IP address alongside the addresses being queried — exactly as it would if you used a wallet or a block explorer directly. Those nodes are not acting on our instructions and we do not control what they log.

What we do not run

No analytics product, no product-telemetry service, no session-replay tool, no error-tracking vendor, no advertising network, and no third-party tag of any kind. We send no email and have no way to, because there is no email address in the system to send one to. Your IP address is read to apply rate limits and is kept in a short-lived, in-memory counter that resets on its own; it is never written to our database and never logged.

tamias.io sets no cookies, runs no analytics, and makes no requests to third parties. It has no login, no forms and no API. Its fonts are served from our own origin. Reading this page tells us nothing beyond what our web host records to serve it.

Tamias also offers a screened, non-custodial rail for moving value out of a Safe — including paying a team without publishing every salary on a public blockchain. This part of the product is subject to anti-money-laundering rules, and those rules require us to collect and keep records. We would rather say exactly what that means than imply a product that keeps nothing.

What we collect for a transfer

• The source and destination addresses, the assets and amounts, and each chain involved.
• A complete record of every leg: which partner performed it, the deposit and settlement addresses, the partner’s reference, and the on-chain transaction hashes.
• A Travel Rule record for the transfer. The Travel Rule requires originator and beneficiary details to travel with a transfer above a threshold, and our system has fields for an originator and beneficiary name. The app does not currently ask you for those names and does not send them, so in practice these records hold addresses rather than names. If that changes, this page changes first.
• The result of screening, described next.

We collect no identity documents, no proof of address, no date of birth and no tax identifier. There is no upload anywhere in the product.

How screening works, precisely

We screen addresses against the U.S. Treasury OFAC Specially Designated Nationals list. We download that list and hold it ourselves, refreshing it every six hours, and perform the check on our own infrastructure — so the address being screened is not sent to a commercial screening vendor. If our copy of the list is missing or more than a day old, screening fails and the transfer stops; it never proceeds on a stale list.

On Ethereum-compatible chains we additionally consult a free, public on-chain sanctions oracle as a cross-check. That check is an ordinary blockchain read, which means the address being checked is sent to a public blockchain node operated by a third party, as it would be by any wallet.

We store the outcome: which address was screened, what the result was, which version of the list answered, and when. A failed check blocks the transfer before anything moves, and may be reviewed by a person and reported to the appropriate authority.

We do not currently use a commercial transaction-monitoring or politically-exposed-person screening vendor, and no customer data is sent to one. Where that changes, this page changes with it, and the vendor will be named here.

Non-custodial, always

We never hold your funds. There is no Tamias wallet or Tamias exchange account that customer money passes through. Transfers are executed by third-party non-custodial swap partners; each partner sees the leg it performs and the addresses that leg requires, and has its own privacy policy and its own compliance obligations. We orchestrate and screen; we do not custody.

6 years

Screening results, Travel Rule records, and the complete transfer trace — every leg, every address, every transaction hash. This is the standard anti-money-laundering record-keeping period. Our legal basis is compliance with a legal obligation, together with our legitimate interest in preventing financial crime. Records held for this reason cannot be deleted on request before the period expires; that is what the obligation means.

Life of the account

Your wallet address, organisation membership, Safe list, address-book entries and payment schedules. Deleting an organisation deletes all of it, in one transaction, across every table that holds it.

Beyond the account

The organisation audit log is the one exception, and it is deliberate. Its entries are append-only — the database itself refuses to update or delete them — and they survive the deletion of the organisation they describe. A record of who authorised a transfer is worth nothing if it can be removed by the person who authorised it. We keep those entries for six years and then delete them.

Ten minutes

Recording sessions, counted from last use. In memory only, never written to disk.

Minutes to days

Sign-in nonces, organisation invitations, and phone-pairing tokens, all of which carry an expiry and are deleted once past it. Rate-limit counters, which hold an IP address in memory for the length of one window and are then gone.

We do not sell personal data. We do not share it with advertisers or data brokers. We disclose it in the six circumstances below, and no others.

Swap partners

Non-custodial exchange partners, currently ChangeNOW and SideShift, receive the addresses, asset and amount needed to perform the leg they are performing. This is necessary to provide the service you asked for.

Authorities

Regulators, tax authorities and law enforcement, on a lawful request. What they can receive is the complete trace, the screening results, the Travel Rule records and the audit log. We designed the product so this answer is always available — see section 10.

Safe

Safe’s own hosted transaction service, operated by the makers of the Safe contracts, receives Safe addresses, owner addresses, proposed transactions and the signatures collected on them. This is how a Safe transaction reaches its other signers and how it is executed; using a Safe means using it.

Infrastructure

Providers who process data on our instructions and nothing else: our database host (Neon, in the EU), our application and services host (Fly.io, Frankfurt), our frontend host (Vercel), and Google Firebase Cloud Messaging — the last only if you have paired a phone for push notifications.

Public services

Public blockchain nodes receive the addresses being queried, as they must in order to answer. A block-explorer API receives the address of a contract you are building a transaction against, so we can show you what the transaction actually does rather than raw bytes. A price feed is queried for exchange rates and receives no personal data at all.

Successors

Whoever takes it on, if Tamias is ever sold or handed over, under the same commitments made here.

Our servers and our database run in the European Union — Frankfurt for the application and the session service, an EU region for the database. The websites themselves are served from a global content network. Swap partners, blockchain networks, Safe’s service and the push-notification service operate globally, so data disclosed to them may be processed outside the EEA.

This is the product’s actual position and we would rather state it here than let you infer something more flattering.

A public blockchain publishes everything forever. One payroll transaction exposes every salary, every recipient’s address, and your whole payee list to anyone who cares to look, permanently. Tamias exists to break that link from the crowd.

It does not exist to break it from a regulator, a tax authority, or a court. Where a transfer routes through an intermediary chain, we use only transparent ones — Litecoin, Tron, Solana — and deliberately never fully-opaque ones such as Monero, precisely so that a complete, auditable trace always exists and we can produce it. We screen before we execute, we keep the record for six years, and if a court asks where funds went, we can answer completely.

If what you want is privacy from law enforcement, this is the wrong product, and we would rather you knew that from the policy than found out later.

If you are in the UK or the European Economic Area, you have the right to ask for a copy of the personal data we hold about you, to have inaccurate data corrected, to ask for deletion, to object to or restrict certain processing, and to receive your data in a portable form. You can also complain to your national data protection authority. We extend these rights to everyone, wherever you are.

Two honest limits. Records we are required to keep for anti-money-laundering purposes cannot be deleted before the six-year period expires, and the organisation audit log is append-only by design, so entries cannot be altered — we will tell you exactly what is held and why rather than silently declining. And anything already written to a public blockchain is beyond anyone’s reach, including ours; no request to us can remove it.

To exercise any of these, write to privacy@tamias.io. We will respond within 30 days.

Tamias is not intended for anyone under 18, and we do not knowingly collect data from children.

If we change how we handle data, we change this page and move the date at the top. Where a change is material — a new category of data, a new recipient, a longer retention period — we will say so here rather than let a quiet edit stand for notice.

Questions, requests, or anything in this document that does not match what you observe the software doing: privacy@tamias.io. The last point is a genuine invitation: this policy was written against the source code, and if it has drifted from it we want to know.