Data and privacy

No website access at install. Chrome asks for optional permissions the first time you turn on the feature that needs them.

Side panel and encrypted chat

Runs the side panel and encrypts and decrypts messages on this device.

Browsing history

Only while Share viewing is on: the address and title of the foreground tab. Nothing is kept, and page content is never read. Disabling Share viewing hands it back.

Site access

Only sites you allowed: danmaku, signals and sticky notes from Page interaction, quote locating, and the token name and icon on token pages. Disabling Page interaction hands all of them back.

The tab where you click Palside

Only after you click the toolbar icon or press the screenshot shortcut, for screenshots of that one tab; it ends when you leave the site.

Desktop notifications

Notifies you of new messages.

Chrome uses its own wording: Share viewing appears as “Read your browsing history” and site access as “Read and change your data on the site”. Chrome has no read-only site permission; Palside only does what is listed here.

Token names and logos are read from the public area of a page only on sites you allowed with Token data on; otherwise a short contract address and a default icon are shown. Receivers check token details locally and may load logos directly from a fixed set of public image hosts; on failure a default icon is shown, never fetched through Palside servers. Image hosts can see the request and connection IP; requests carry no page referrer.

Each item leaves your device only for the feature it serves.

Messages

Squad messages are encrypted on your device and the service stores only ciphertext; danmaku is public.

Browsing

Only while Share viewing is on, the token or site name of your foreground tab is sent encrypted to your squad. No history is kept.

Page content

Text you quote or pin as a sticky note, screenshots you confirm sending, and the public token name and icon on token pages.

Page actions

When you send a signal, the page element you point at and its relative position are sent encrypted to your squad. Keystrokes and scrolling are never recorded.

Transactions

Your wallet’s public address, transfer, red packet and tip orders, and their onchain status. Onchain records are public and cannot be deleted.

Network

The service processes connection IPs. Necessary error records last up to 7 days; anti-abuse counters stay in memory or for at most one day. Squad activity IP digests retain the last 30 complete UTC days and the current day.

Only authorized squad members decrypt chat, attachments and viewing content.

Share viewing shares only the foreground tab, only with the current squad, and only after you turn it on: a token page shows the token, any other site shows only its name. Page cards, quotes and screenshots you share go into the draft first and are sent only when you confirm. Chat, attachments and viewing status are end-to-end encrypted by the client with Matrix.

End-to-end encryption does not hide all metadata. The service still processes necessary account, membership, connection time and IP information. Recruiting profiles and reports you choose to submit are separate from private chat.

Danmaku is public and not encrypted.

Your danmaku, nickname and avatar are public. The service stores the text, author and token, retaining the latest 10000 lines per token without time expiry. Votes remain until changed, withdrawn or the account is deleted. The service knows which token you participate in, without receiving page URLs or keeping a persistent browsing trail. Trending counts only accounts with danmaku open, not private squad viewing.

Captains choose 1, 7 or 30 days, or forever, with forever as the default. Images last at most 30 days after sending, then show “Image expired”.

Messages are retained for the period the captain chooses (1, 7 or 30 days, or forever, forever by default; images at most 30 days), counted from the original send time; drafts are kept for 7 days and unsent messages for 24 hours. Signing out clears local caches, drafts and decryption keys; older history may be unavailable when you sign in again. Screenshot originals and editing are processed locally without being uploaded.

Expired content becomes inaccessible immediately; related metadata is cleared within 7 days. Local content cache is capped at 300 MiB; squads you leave remain visible for at most 30 days after leaving. Service logs last up to 7 days. Report evidence lasts at most 90 days while unresolved or 30 days after closure; report and case records are deleted one year after closure. Bans are retained while active and for one year after ending; permanent bans remain. Operator audits last one year, operation deduplication records 7 days, and aggregate counts indefinitely. There are no server backups; copies saved by others cannot be forcibly deleted.

Originals and editing stay on your device. Send only when you confirm.

Cropping and annotation happen on your device. A separate editing window may retain the original in extension background memory. Cancelling, signing out or restarting the background clears it; expired sessions are cleared on later access. Adding to a draft is not sending. A sent image is an ordinary encrypted image message, without the original, layers or cropped-out parts.

Recruiting profiles are public. Reports include only what you confirm.

Reports contain only content you preview and confirm. The operator can read it; the first view of a private report is audited. Recruiting squads publish their name, description, avatar, captain’s nickname and avatar, level and popularity rank. Onchain addresses, amounts and transaction hashes are public and cannot be deleted. The service stores wallet identity bindings, orders and recovery records. Alchemy and RPC services process signed transactions without receiving private keys. Levels and popularity use activity events and daily aggregates, with network address digests isolated by squad and date, without reading encrypted chat content. Deletion removes wallet bindings and reporter links. Pending chain orders are reconciled before account links are removed, retaining only amounts and transaction hashes. Only the public key and deletion time remain for the account; the same phrase can register again. Activity IP digests retain the last 30 complete UTC days and the current day.

Data is used only to provide the features on this page.

Palside does not sell user data, use it for advertising, or use it to determine creditworthiness or for lending. Squad chat runs on a Matrix service operated by Palside.

Alchemy and RPC nodes

Process the PALS transactions you sign and public onchain information. They never receive private keys.

Public image hosts

Receivers may load token icons directly from a fixed set of public image hosts, which can see the image request and connection IP.

The use of information received from Chrome APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Take back permissions or clear local data anytime.

Use Settings › Privacy & data to take back permissions and clear local caches. Deleting your account removes your profile and associations, except records already onchain. Palside is not directed to anyone under 18. For privacy questions, contact palside@pm.me.

Currently in development and testing; not publicly operated yet.

Palside is not yet listed in the Chrome Web Store. Website demos use sample data separately from the extension services and do not verify security or readiness for release.