Threat model
A scan has to ask public services about an address. This page says exactly who learns what, and where Nymra’s protection ends.
What Nymra cannot see
Section titled “What Nymra cannot see”- Your seed phrase or private key. Nymra never asks for them, and the Terminal empties the scan field at once if one is pasted or typed into it.
- Your result. The score and the findings are computed in your browser and stay there.
- Who scanned what. Nymra keeps no list of scanned addresses and no account, cookie or profile.
- Anything beyond the public chain. Nymra has no private data, leaked databases or off-chain tracking. It only reads what anyone can read.
Who sees what
Section titled “Who sees what”| Who | What they can see | When |
|---|---|---|
| Everyone | Every transaction of every address, forever | Always: the chain is public |
| The public block explorers | Your IP address and the addresses the scan asks about: yours, and a few related wallets such as its funder | Every scan |
| The public RPC nodes | Your IP address and the address | Every scan, one quick check per chain |
| Blockscout’s ENS service and a public Ethereum node | Your IP address, the address and the ENS name you typed | Every scan |
| Nymra’s relay | The request, so the address, and your IP address as any server does to answer. It keeps no log | When an explorer refuses your browser, and for BNB Smart Chain and Linea |
| The services behind the relay | The relay’s request, not your IP address | The same moments |
| The website’s host | That someone loaded the page, from your IP address. Not the address you scan: a share link keeps it after the #, which browsers do not send | Every visit |
| Your wallet app | That the site asked for your address | Only if you press Connect wallet |
| Your network or internet provider | Which hosts you contacted. Not the address inside the encrypted request | Every scan |
| Browser extensions you allowed on the page | Everything on the page, the address you typed included | Every visit |
| Anyone you share a result with | The image and the link you share. The address only if you ticked the box to include it | When you share |
What Nymra does not protect you from
Section titled “What Nymra does not protect you from”- The public chain itself. Nymra shows what is already public. It does not hide anything, and a low score cannot be undone.
- Logs kept by the services you ask. An explorer, a node or the ENS service can keep your IP address next to the address you scanned. Nymra cannot see or delete their logs. Scanning your own wallet from your own connection tells them which wallet interests you; use a VPN if that matters to you.
- Trusting the relay. The relay’s code is open, in the
privacy-scanrepository, but nobody outside Nymra can inspect the server it runs on. When the relay is used, you trust that it keeps no log. - A compromised device or a malicious browser extension. Either can read anything you do in the browser.
- Look-alike sites and impersonators. Check the address bar, and read Safety.
- Address poisoning. A scan lists look-alike addresses it finds in your history as warnings, but it cannot stop a wrong transfer. Check every character of an address before you send.
See Privacy and data for how the relay works, and Verify it yourself to check the hosts with your own browser.