Privacy Policy PaperVault for Aave

The short version

The extension is read-only. It never asks for a seed phrase or private key, never signs anything, and never broadcasts transactions. It only reads public on-chain data.

1. What data the extension processes

"PaperVault for Aave" is a read-only portfolio viewer and a local simulation tool for Aave v3. To do its job, it processes the following:

• The public wallet address you choose to track. You paste this address yourself. It is a public identifier on a public blockchain — anyone can look it up. The extension does not access your private keys, seed phrase, or any signing capability.
• Public on-chain data fetched live from the official Aave v3 GraphQL API and public RPC endpoints (Ethereum, Arbitrum, Base, Polygon, Optimism, Avalanche). This includes wallet token balances, Aave v3 supply/borrow positions, health factor, market reserves, and APYs.
• Local paper-mode simulation state you create by practicing supply / borrow / withdraw / repay. This is a pure in-memory and local-storage simulation. It is never sent on-chain and never sent to any server in v1.0.

2. Where the data is stored

In v1.0 there is no backend server, no account system, and no analytics. The only network requests the extension makes are read-only queries to the Aave API and public RPC endpoints to fetch the public on-chain data described above. Those endpoints see your connection IP address as part of any normal HTTP request, but the extension sends them no personal information beyond the public wallet address you are querying.

3. Permissions and why each is required

storage

Stores the tracked wallet address, cached portfolio data, and your local paper-mode simulation in your browser. Without this, the extension could not remember your address between sessions or keep your paper scenario while you explore. The data never leaves your device in v1.0.

alarms

Schedules periodic background refreshes of live portfolio data (every few minutes) so the popup and dashboard stay current without manual refresh. No data is transmitted by the alarm itself — it only triggers a read-only fetch of public on-chain data.

Host permissions (Aave API & RPC endpoints)

The extension reads public on-chain data via:

• The official Aave v3 GraphQL API at api.v3.aave.com
• Public RPC endpoints per chain: Ethereum, Arbitrum, Base, Polygon, Optimism, Avalanche (with fallback providers per chain)

All requests are read-only (eth_getBalance, eth_call, GraphQL queries). No transactions are signed or sent. These hosts are required for the core read-only functionality. The list of exact host permissions is visible in the extension's manifest.json and in the Chrome Web Store listing.

v1.0 does not request any host permission for an analytics or backend server.

4. What the extension never does

• Never asks for a seed phrase or private key. The extension has no code path that requests, reads, or handles private keys.
• Never signs transactions. No eth_sendTransaction, personal_sign, eth_sign, or any signing method is ever called.
• Never broadcasts anything on-chain. Paper mode is a pure local simulation. Even the "real" tab only reads public data.
• Never sells or shares data. There is no data to sell in v1.0, and the future opt-in sync (if enabled) sends data only to our own backend for the user's own cross-device sync.
• Never uses your data for creditworthiness or lending decisions.
• Never tracks you across other websites. No content scripts run on third-party pages. The extension only runs in its own popup and dashboard.

5. Third-party services

The extension queries the following third-party read-only endpoints to fetch public on-chain data. These services have their own privacy policies that govern what they log:

• Aave v3 API (api.v3.aave.com) — public market and position data. See Aave's own documentation for their data practices.
• Public RPC providers (per chain) — used only to read token balances (eth_getBalance, eth_call). These are public infrastructure providers; their logging practices are outside our control.

We do not embed any third-party analytics, advertising, or tracking SDKs. No Google Analytics, no fingerprinting libraries, no ad networks.

6. Children's privacy

The extension is not directed at children under 13 (or the applicable age in your jurisdiction). We do not knowingly collect any data from anyone, including children. If you believe a child has provided any information to us through the extension, please contact us — although in v1.0 no information is collected or transmitted in the first place.

7. Your controls

Because all v1.0 data lives in your browser, you have full control at all times:

• Clear tracked address & data — use the in-extension "Clear" option, or remove the extension entirely.
• Clear everything — Chrome's "Clear browsing data" or removing the extension wipes all stored data immediately.
• Review permissions — visit chrome://extensions, click "Details" on PaperVault, and review or revoke any permission at any time.

8. Future versions & optional cloud sync

If and when this ships, it will be:

• Strictly opt-in. Off by default. You must explicitly turn it on in the extension's Settings. It is never enabled automatically, never enabled by accepting the onboarding, and never enabled by updating.
• Revocable at any time. Turning it off deletes the local consent flag and the random device identifier from your browser. No further data is sent.

What the optional feature would send opt-in only

If you choose to enable it, the extension would send the following to our backend server at api.aave-paperwalet.xyz:

• A random, per-installation device ID (not your name, not your email, not linked to any identity). Used only to group your own sessions together.
• The public wallet address you are tracking. This is already public on-chain; we use it only to keep your tracked addresses in sync across your devices.
• Basic browser and OS metadata — your browser's user agent string and platform string. Used for compatibility diagnostics only.
• Feature usage events — aggregate counts of which features you use (e.g. "opened dashboard", "enabled paper mode"). No page content, no keystrokes, no amounts.
• Your connection IP — the server sees this as part of any HTTP request. We do not use it to identify you personally, but we cannot avoid receiving it.

What it would never send: private keys, seed phrases, signed transactions, page content from other websites, clipboard contents, or anything from outside the extension.

This section will be updated with the exact data fields before any such version ships. If you keep the optional feature off (the default), your experience is identical to v1.0: no data leaves your device.

9. Changes to this policy

If this privacy policy changes materially, we will update the "Last updated" date above and the version badge next to each section. For any change that introduces new data collection, the version of the extension that implements the change will require an explicit opt-in — we will not silently start collecting data through an update.

10. Contact

PaperVault for Aave is an independent tool and is not affiliated with, endorsed by, or sponsored by Aave Labs. "Aave" is a trademark of its respective owner and is used here only to describe the public protocol this extension reads from.

For privacy questions or concerns, please contact the developer through the support channel listed on the extension's Chrome Web Store listing.