Privacy Policy

Last updated: 1 September 2026. Applies to Owlio version 1.0.0 and later.

The short version

Owlio has no server. There is no account to create, no database to store your wallets in, and no way for us to link the wallets you track to each other or to you — because there is nowhere for us to write that down.

We collect nothing. We receive nothing. We cannot see your portfolio.

What Owlio does do is fetch balances from public blockchain explorers on your behalf, directly from your browser. Those explorers see the wallet addresses you asked about. That is unavoidable for any wallet tracker, and the rest of this document is mostly about being specific about it, because "we care about your privacy" without a host list is worth nothing.

What Owlio stores, and where

All of it lives in your own browser profile, in storage that belongs to this extension. None of it is transmitted anywhere.

In chrome.storage.local:

In IndexedDB (database owlio):

Uninstalling the extension deletes all of it. So does Settings → Data → Wipe all data, which clears both stores in one action. There is no copy anywhere else.

Chrome's built-in sync is not used: the data is written to chrome.storage.local, which does not leave the device. Moving your setup to another browser is done by explicit export and import in Settings, in a file you handle yourself.

What leaves your browser

Owlio makes network requests from your browser to public APIs. It never sends them to us, because there is no "us" to send them to. Requests fall into three groups.

1. Blockchain data — these hosts see your wallet addresses

When you add a wallet, Owlio asks the explorers for that network about it. The address appears in those requests. This is the real privacy cost of the product, and it is listed in full:

Each of these is a third party with its own privacy policy, and each one learns the addresses it is asked about, together with your IP address.

Which hosts get contacted depends on the kind of wallet you added, not on the networks you personally use. An Ethereum-style address is valid on every EVM network, and there is no way to know from the address alone which ones you are active on — so adding one EVM wallet queries all eleven EVM networks in the table above. Adding a Bitcoin, Tron, TON, or Solana wallet contacts only that network's hosts. Wallet kinds you never added are never contacted at all: with only a Bitcoin address saved, tonapi.io and the Blockscout hosts are never called.

Several networks list more than one host. The extra ones are fallbacks, used when the first does not answer — public explorers go down more often than you would expect, and a network with a single source simply stops showing anything when it does.

On the four networks above, the first host is a node run by the chain itself or by a neutral operator, and the explorer is the fallback. That ordering is deliberate: a node is closer to the chain and does not aggregate your activity across networks the way a single explorer operator would.

The trade is real and Owlio does not hide it. A node can be asked about specific token contracts, but it cannot list everything an address holds. So on these networks Owlio shows only the tokens it already knows about, and says so on the Data status screen — an empty "unverified" screen there means "not looked at", not "nothing suspicious here". The explorer, which can list unknown tokens, is consulted when the node does not answer.

2. Prices — these hosts do not see your portfolio

Prices come from coins.llama.fi (DefiLlama). This request deliberately does not depend on what you own: Owlio asks for its entire built-in asset table, the same list for every user, and picks out the rows it needs locally.

This is a design decision, not a detail. Asking only for "my tokens" would hand a third party the exact composition of your portfolio. The full list is a few dozen keys against a source limit of roughly 173, so the private version costs neither an extra request nor noticeable delay. For the same reason, token logos are compiled into the extension rather than loaded from a CDN — a request for a logo would reveal which assets you hold.

The price request does not wait for your balances and never reads your addresses.

3. NFT previews — the one case we cannot list in advance

When an NFT collection provides a preview image, Owlio loads it from the URL the source gave us: nft.fragment.com for Telegram gifts, and a different host for every other collection. We cannot publish a complete host list here, because the list is decided by the NFT collections you happen to hold, not by us.

These images always load, and there is no setting to stop them. You should know what that means: the host serving the image learns that someone at your IP address is looking at that specific NFT. NFT identifiers are unique, so a handful of such requests can identify the wallet holding them.

This is the one place where Owlio makes a request that can point back to your wallet, and it is a deliberate trade rather than an oversight: for some collections — Telegram gifts in particular — the image is the asset, and the tab without pictures is close to useless. We are naming the price here instead of hiding it.

If that trade is not one you want to make, the NFT tab is the only screen affected: tokens, balances, prices and history never load anything from a collection's host.

Permissions, and why each one exists

• storage, unlimitedStorage — to keep the data described above in your browser. Transaction history outgrows the default quota.
• sidePanel — the interface is a side panel.
• alarms — to continue downloading history in the background, in small steps.
• declarativeNetRequestWithHostAccess — the Solana public RPC rejects requests carrying an extension Origin header; this permission is used to strip that one header for that one host, and for nothing else.
• optional_host_permissions: api.mainnet-beta.solana.com — requested only if you add a Solana wallet, and only at that moment. Owlio ships with no permanent host permissions at all. If you decline, or later revoke it, Owlio marks that network as unavailable and keeps working; it does not present previously fetched data as current.

What we do not do

• No analytics, telemetry, crash reporting, or usage counters of any kind — including aggregate ones, since a count like "networks per user" can narrow down who you are.
• No advertising, and no sale or sharing of data. There is no data on our side to sell.
• No remote code. Everything that runs is in the package Chrome reviewed.
• No accounts, no sign-in, no email address.

Children

Owlio is a financial tool for adults and is not directed at children under 13. It collects nothing from anyone, of any age.

Changes to this policy

If Owlio ever contacts a new host, this document is updated in the same change that adds it. This page always shows the current version, and the date at the top of it says when that version was published.

Feedback

Ideas, improvements and bug reports are welcome by email: d.v.dyakonov@gmail.com.