Privacy Policy

1. Who We Are

ShieldBot Transaction Firewall is a Chrome browser extension developed by ShieldBot Security. The extension analyses blockchain transactions before they are signed to protect users from scams, phishing sites, and malicious contracts.

For questions about this policy, contact us at: support@shieldbotsecurity.online

2. What Data the Extension Collects

When you interact with a Web3 DApp and your wallet triggers a transaction, the extension sends the following transaction parameters to our risk analysis API:

• to — the recipient contract or wallet address
• from — your wallet address
• value — the amount of native token (e.g. BNB) being sent
• data — the encoded calldata (function call and arguments)
• chainId — the blockchain network identifier
• typedData — EIP-712 structured data, if applicable (e.g. Permit2 signatures)
• authorizationList — for an EIP-7702 transaction, the address of each contract it would delegate your account to (never the signed authorization)

With each check the extension also sends the signing method (for signature requests) and your policy mode (Balanced or Strict). For a personal_sign or eth_sign request, neither the text of the message or the hash you would sign nor your wallet address is sent. This is the minimum required for a meaningful security analysis.

Some features send data only when you use them:

• AI chat in the side panel — the message you type
• Prompt injection scanner — the text you paste in
• Wallet Health — the wallet address you enter

3. What Data Is Stored Locally

The extension stores the following data in your browser's local storage (chrome.storage.local), which never leaves your device unless described otherwise:

• Your settings: the API endpoint (default: api.shieldbotsecurity.online), whether the firewall is on, the policy mode (Balanced or Strict), the language, and the chain chosen for Wallet Health and the side panel
• The last 50 transaction scan results for the history view
• The last 100 addresses you chose to send to through a web page, to warn you when a later recipient only looks like one of them
• The wallet address you enter in the Wallet Health scanner, which is sent to our API when you run a scan
• A random chat identifier, made the first time you open the side panel; it is sent with each side panel chat message, in the X-Install-Id header and as user_id
• Up to 20 recent side panel chat messages

The side panel also keeps which of its tabs was open last, in its own local storage. Phishing check results are kept by site host in the browser's session storage (chrome.storage.session), which web pages cannot read and which is cleared when the browser closes.

When you press "Why is this risky?" on a warning, the extension sends the result of that check, as our API returned it, to the API's explanation endpoint (/api/agent/explain).

4. How We Use Transaction Data

Transaction data sent to our API is used exclusively to:

• Compute a risk score and classification (SAFE, CAUTION, HIGH RISK, BLOCK RECOMMENDED)
• Return a verdict to the extension before you sign the transaction
• Improve detection accuracy through aggregated, anonymised analysis

Scan results are stored by contract address and chain. They are not stored with your IP address, and we do not use wallet addresses as user identifiers.

5. Phishing Detection

When you visit a website, the extension sends only the site's origin (scheme, host and port; never the path or query string) to our API, which checks it against the GoPlus phishing database. The result is cached in your browser to minimise requests: for one hour when the site is flagged, and for five minutes when it is not. The origin is used only for this check and is not stored in our database.

6. Data Sharing

We do not sell, rent, or share your data with third parties for advertising or marketing purposes. To perform security analysis, we query the following external services:

• GoPlus Security — phishing checks and token risk data
• honeypot.is — buy and sell simulation for honeypot detection
• DexScreener — market and liquidity data
• Ethos — on-chain reputation data
• Block explorers (Etherscan, BscScan, Blockscout) and Sourcify — contract source, verification and creation data
• openchain.xyz — function signature lookups for decoding calldata
• Token Sniffer — token risk checks
• Tenderly — transaction simulation, when enabled
• Anthropic — optional AI explanations, when enabled
• BNB Greenfield — storage of forensic reports for high risk checks, when enabled
• Blockchain RPC providers — reading contract code and on-chain state for each supported chain
• EAS on Base (base.easscan.org) — reading ShieldBot's published attestations

These services receive only the data needed for their function, such as a contract address, a transaction to simulate or a site origin. They are governed by their own privacy policies.

If you join the update list on our website, we store your email address and send messages through our email provider, Resend.

Our website counts visits with Plausible Analytics. It sets no cookies and stores no IP addresses: to count a visitor once per day it uses a hash of the IP address and browser with a salt that Plausible rotates and deletes every 24 hours. The requests go through our own domain, and what we see is aggregate: pages viewed, referring sites, location (country, region and city), device and browser type, and which outbound links were clicked. The extension does not load it.

7. Data Retention

Scan results (contract address, chain, risk score and findings) are kept on our servers so repeat checks are faster and the public threat feed works. They do not include your IP address. Each verdict the API returns for a transaction or contract check also gets an evidence document, kept for 90 days: the chain, the contract, the verdict and which checks answered, and for a transaction only its function name and a hash of its data. It never holds your wallet address, IP address, API key or transaction data, and anyone with its link can read it. If you file a report about a contract, the report is kept as evidence, with at most a keyed hash of your IP address and never the address itself. Messages to the AI assistant are deleted after 24 hours. Until then, side panel chats are stored under an identifier derived from your IP address and chat ID, and Telegram chats under your Telegram user ID. If you use an API key, a record of each request (the key, the endpoint and the time) is kept for 90 days. Like most web services, our servers may keep standard access and application logs for security and troubleshooting. To have the data linked to your email address, IP address or Telegram account deleted, write to the address in section 11.

Locally stored data (history, settings) remains on your device until you uninstall the extension or clear it manually.

8. Security

All data transmitted between the extension and our API is encrypted in transit using HTTPS/TLS. Our API servers are access-controlled and not publicly writable.

9. Children's Privacy

ShieldBot is not directed at children under 13 years of age. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this policy as the product evolves. The "Last updated" date at the top of this page will reflect any changes. Continued use of the extension after changes constitutes acceptance of the updated policy.

11. Contact

If you have questions, concerns, or requests related to your data, contact us at:
support@shieldbotsecurity.online

Response time: within 48 hours.