TOKINT Privacy Policy

Effective date: October 20, 2026

TOKINT is a browser extension for inspecting Ethereum NFT metadata and artwork, resolving IPFS references, and downloading or converting associated media. This policy covers the extension distributed by the publisher identified on its Chrome Web Store listing.

Data used to provide the features you request

TOKINT processes the contract addresses, token IDs, public wallet addresses, IPFS references, and settings you enter. When you click the toolbar button, it reads the active tab's URL to identify a token. It does not continuously monitor your browsing or read your browser history. Address-bar suggestions are generated locally without network requests.

After submission, lookups contact your configured Ethereum RPC provider and IPFS gateway, and the metadata or media hosts referenced by the token. When animation_url is present, that media is selected initially; otherwise the first available image or media field is used. Defaults are PublicNode and Pinata; Arweave gateway resources are also supported. These services receive your IP address and ordinary connection information, together with the request details needed for the lookup, such as a contract address, token ID, CID, or resource path. A public wallet address may identify a person when combined with other information.

If you configure Alchemy, TOKINT uses your endpoint, including its API key, for requested RPC and NFT API calls. Collection and wallet browsing, ownership, and mint information are obtained from Alchemy. Optional thumbnails are fetched from Alchemy's CDN or its Cloudinary resources after permission is granted. TOKINT does not connect a wallet, request private keys or recovery phrases, sign transactions, or process payments.

TOKINT has no developer-operated data collection server, analytics, advertising, or telemetry. Lookup data is sent directly to the relevant providers, not to the TOKINT publisher. Providers may log requests and retain data under their own policies; TOKINT cannot delete those logs. Choosing an endpoint does not make your queries anonymous.

Local storage and retention

The extension saves gateway preferences, public RPC presets, the last entered contract, your theme, recent-token identities, metadata, and cached artwork locally without encryption. TOKINT does not use Chrome Storage Sync. Local and session preferences are restricted to trusted extension contexts.

Alchemy and all custom RPC URLs, including any API key they contain, are kept only in memory in Chrome session storage by default. They are shared across TOKINT tabs but cleared when Chrome restarts or the extension is reloaded, updated, or disabled. Closing a window alone may leave Chrome running. After expiry, token lookups ask you to re-enter the URL or choose a public provider; they do not silently use a different RPC. IPFS commands continue using your saved gateway.

The optional Remember on this device setting saves the complete RPC URL, including any API key, persistently in the local browser profile without encryption. Anyone able to read that profile may be able to recover it. Uncheck the option and save to remove the persisted URL and use it only for the current session, or choose and save a public preset to remove the custom URL. Replacing or deleting records does not promise forensic erasure of old disk remnants or backups.

The passphrase vault and its migration flow have been removed. Old encrypted preferences and the previous token cache are discarded on update; re-enter custom settings and look up tokens again to rebuild the cache. No passphrase is requested or processed. Older unencrypted settings move custom RPC URLs into session storage without automatically opting into persistent storage.

Recent-token history is limited to 30 distinct tokens. Metadata and successfully decoded preview originals are cached locally in IndexedDB within a 50 MiB payload budget. Cached snapshots are eligible for reuse for 24 hours; expiration does not guarantee immediate physical deletion. Cache maintenance removes expired or excess snapshots as entries are written. Recent shortcuts may remain after their cached content is removed. Download-only media and Alchemy browsing results are not added to this token cache.

The trash control clears recent tokens and cached files. It does not clear settings or the last entered contract. You can change settings in Settings; removing the extension removes its browser-managed local storage. Inspector URLs can include contract, token, method, or error information and may remain in browser-managed history. Browser-managed history, files you download, and data you explicitly copy to the clipboard are managed separately from TOKINT’s local settings and cache. Downloads and clipboard data are managed by your browser or operating system and are not removed by clearing TOKINT's cache or uninstalling it.

A separate local cache stores only the public p5.js library for offline reuse, with its hash verified before each use. This library cache is unencrypted and contains no artwork, token identifiers, settings or credentials. Clearing recent tokens clears their cache; the library cache remains until extension data is removed or the extension is uninstalled.

Media processing and connections

Image and animation conversion runs on your device; TOKINT does not upload media to a conversion service. HTML artwork is paused by default. TOKINT displays a disclosure before you choose Run HTML artwork. This permits the selected artwork’s code to run in an opaque sandbox without access to TOKINT settings, extension APIs, or other tabs. The sandbox restricts ordinary resource loading but is not a network isolation boundary: artwork can use WebRTC and related connections to contact external or local services without a separate site-access permission prompt. These destinations are chosen by the artwork’s code, not TOKINT. They can receive your IP address, connection information, and information included in or generated by that artwork, and may process or retain it under their own practices. TOKINT cannot enumerate, control, or delete data at these destinations. TOKINT’s own RPC, metadata, media, dependency, and thumbnail fetches omit cookies and referrers and reject redirects. Those fetches require HTTPS. Plain HTTP for those fetches is supported only for explicitly configured or permitted services on localhost or 127.0.0.1.

Artwork consent is held only for the exact selected bytes in the current inspector tab. It covers preview, fullscreen, and conversion, which can each run a fresh copy of the artwork. It is never saved or synchronized. Stop HTML artwork ends these executions and revokes consent. Switching media, starting or refreshing a lookup, reloading, or leaving the token also revokes it; cached artwork needs fresh consent when reopened. Declining to run it leaves metadata, other images, and the original download available. Downloading the original does not execute it in TOKINT; opening that file elsewhere may execute code with that application’s permissions.

When HTML artwork references the supported p5.js 1.0.0 script, TOKINT downloads that exact file from cdnjs.cloudflare.com after artwork consent and host permission are granted. The request omits cookies and referrers; the CDN receives your IP address and the library URL. TOKINT verifies a pinned SHA-256 hash and passes the verified bytes into the isolated sandbox. The dependency executes only within the consented artwork sandbox, which has no extension API access but may make the artwork-initiated connections described above. Other external script dependencies are unsupported. Original HTML downloads preserve the source bytes.

Before fetching, TOKINT resolves recognized Arweave transaction URLs to their transaction-specific gateway subdomains. Supported legacy routes for the original Art Blocks contract resolve to token.artblocks.io for metadata and artblocks-mainnet.s3.amazonaws.com for PNG artwork. The destination host receives the resource request and connection information described above. Host permission is checked before each of these TOKINT-managed fetches; the Art Blocks destinations, including generator.artblocks.io for HTML animation, require optional access. Other HTTP redirects remain blocked.

Opening Etherscan, a marketplace, a source link, or an IPFS address-bar destination navigates to an ordinary website. That website can receive normal browser requests and use cookies under its own policy. This is different from the extension's restricted background fetches.

Permissions and your choices

Storage permission saves local preferences and keeps session-only RPC URLs in memory. Remember on this device enables persistent, unencrypted storage of the chosen RPC URL and any API key. Temporary active-tab access supports the toolbar lookup you initiate. Required host permissions cover default lookup services. Optional host access is requested for additional providers and token resources when you choose to allow them. These grants control TOKINT-managed fetches; they do not restrict artwork-initiated WebRTC connections after the separate Run HTML artwork consent. You can decline these requests, change providers in Settings, revoke optional site access through your browser's extension controls, clear the token cache, or uninstall TOKINT.

Limited use

TOKINT uses the data described here only to provide its disclosed inspection, browsing, caching, downloading, and conversion features. It does not sell user data, use it for advertising or unrelated profiling, or use it to determine creditworthiness or for lending. Data is transferred only as needed for the features you request. The publisher does not receive or have remote access to your locally stored data through the extension.

Contact and changes

For privacy questions, use TOKINT support on GitHub or the publisher’s support contact on the Chrome Web Store listing. GitHub issues are public; do not post sensitive personal information. If you contact support, the publisher receives whatever information you choose to provide; do not include private keys, recovery phrases, or API keys.

Changes to this policy will be published with an updated effective date. Material changes to data handling will be disclosed in the extension before the new handling begins.