Privacy & release notes

Local custody

The vault uses AES-GCM 256 with PBKDF2 SHA-256, 600,000 iterations, a random salt and nonce. Recovery phrases and seeds are not sent to the server. The unlocked seed is held in memory while the wallet is open. Browser storage contains the encrypted vault, public transfer receipts and the auto-lock setting. Recovery words can be displayed only through explicit creation or password-gated recovery flows.

Public connections

Solana RPC providers receive the public addresses queried and signed transaction data. Web requests pass through STRATA's fixed-endpoint RPC proxy on Vercel. The extension calls the same public providers directly. PumpPortal receives a subscription for public creation events, not wallet keys or account-trade subscriptions. DEX Screener provides public token profiles and markets. These providers and hosting infrastructure may receive IP addresses and ordinary access logs. No wallet analytics SDK is included.

Account recovery

STRATA generates 24 English BIP39 words and uses SLIP-0010 Ed25519 at m/44'/501'/0'/0'. It restores valid English BIP39 phrases, without an optional BIP39 passphrase. Other wallet paths and additional accounts are not automatically discovered. Exported encrypted backups require their original device password. Losing a recovery backup and password can permanently prevent access.

Release scope

Real mainnet SOL balance lookup, SPL and Token-2022 balance inspection, reviewed SOL transfers to ordinary wallets, locally generated receive QR, public history and public Pump discovery. No dapp provider, swaps, staking, token transfers, hardware-wallet support or background signing. The extension is an unpacked Manifest V3 build, not a Chrome Web Store listing. Web and extension vaults are separate stores; they do not synchronize automatically.

Risks

This is an early release without an independent security audit. Use a separate wallet with small amounts. A compromised browser, malicious extension, device or site update may compromise an unlocked wallet. Local encryption is not protection from all device attacks. JavaScript strings cannot be reliably erased from memory; seeds in byte arrays are overwritten when locked, but guaranteed memory erasure is not claimed.

A saved signature is not confirmation. Uncertain submissions are retained for checking and are not automatically resent. Historical and indexed market data can lag or be unavailable. STRATA is independent, not an official Pump.fun or Solana product. No token contract address or official social account is claimed.