Verify it yourself

You do not have to take these docs on trust. Three checks need nothing but a browser and, for the last one, a terminal.

1. Watch what your browser contacts

The scan runs in your browser, so your browser shows every request it makes.

1. Go to Scan a wallet, which opens the Terminal.
2. Open your browser’s developer tools (F12, or Cmd+Option+I on a Mac) and choose the Network tab. Turn on the option to keep the log, so nothing disappears while the result updates.
3. Run a scan. To see only the scan’s requests, filter on Fetch/XHR.

You should see requests to these hosts and to no others. The list is read from the engine’s chain register when these docs are built:

Nymra's own site

The page and its files. The relay at nymra.si/p only as described below.

nymra.si

Block explorers

The history of each chain that has activity.

api.routescan.ioarbitrum-nova.blockscout.comarbitrum.blockscout.comastar.blockscout.combase.blockscout.comblockscout.lisk.comcelo.blockscout.cometh.blockscout.comevm.flow.comexplorer.immutable.comexplorer.inkonchain.comexplorer.mainnet.aurora.devexplorer.mode.networkexplorer.optimism.ioexplorer.roninchain.comfilecoin.blockscout.comgnosisscan.iomegaeth.blockscout.compacific-explorer.manta.networkpolygon.blockscout.comrobinhoodchain.blockscout.comrootstock.blockscout.comscrollscan.comshapescan.xyzsoneium.blockscout.comunichain.blockscout.comworldchain-mainnet.explorer.alchemy.comzksync.blockscout.com

Public RPC nodes

One quick check per chain.

api.node.glif.ioapi.roninchain.comarbitrum-one-rpc.publicnode.comavalanche-c-chain-rpc.publicnode.combase-rpc.publicnode.comblast-rpc.publicnode.combsc-rpc.publicnode.comcelo-rpc.publicnode.comethereum-rpc.publicnode.comevm.astar.networkgnosis-rpc.publicnode.comlinea-rpc.publicnode.commainnet.aurora.devmainnet.era.zksync.iomainnet.evm.nodes.onflow.orgmainnet.megaeth.commainnet.mode.networkmainnet.shape.networknova.arbitrum.iooptimism-rpc.publicnode.compacific-rpc.manta.networkpolygon-bor-rpc.publicnode.compublic-node.rsk.corpc-gel.inkonchain.comrpc.api.lisk.comrpc.immutable.comrpc.mainnet.chain.robinhood.comscroll-rpc.publicnode.comsoneium-rpc.publicnode.comunichain-rpc.publicnode.comworldchain-mainnet.g.alchemy.com

ENS

The names and records of the address.

bens.services.blockscout.comethereum-rpc.publicnode.com

Only through the relay, never from your browser

Their free API needs a key that only the relay holds: BNB Smart Chain; Linea.

bsc-mainnet.nodereal.ioapi.etherscan.io

You should not see analytics, trackers, ad networks or any host that is not listed here. Requests to nymra.si/p are the relay. They appear only when an explorer refused your browser (too many requests, or a bot check), and for BNB Smart Chain and Linea, whose free API needs a key that only the relay holds.

The page also tells your browser the same thing in advance. Its Content-Security-Policy header (open the request for /terminal/ in the Network tab and look for connect-src) lists the hosts the page may talk to, some as a wildcard such as *.blockscout.com. The browser refuses any other connection.

2. Check which engine produced a result

Under every finished result the Terminal prints a line like this one:

Engine 0.1.0 (b5ba243d), rules 1.0.0, scanned 2026-10-15 23:05 UTC

• 0.1.0 is the version of the scan engine.
• b5ba243d is the commit of the open privacy-scan repository the engine was built from. Open that commit to read the exact code and rules behind your result.
• rules 1.0.0 is the version of the published rules (RULES.md in that repository). The Privacy Score page names the rules version these docs describe.

The line is printed by the site. It tells you which open code the site says it runs; it cannot prove that the code your browser received is exactly that commit. What your browser contacts (check 1) is what you can see for yourself.

3. Run the engine yourself

The engine is plain TypeScript without runtime dependencies, so a recent Node.js (23.6 or newer) runs it straight from a clone:

git clone https://github.com/nymrasi/privacy-scan
cd privacy-scan
npm test                         # the automated tests, offline
node scripts/scan.ts 0x...       # scan one address from your own machine
node scripts/scan.ts 0x... --json  # the full result as JSON

npm test runs the engine’s automated tests without network. The scan script is a development script in the repository: it reads the chains from your own machine and prints the coverage per chain, the score and every finding.

Two differences with the browser:

• Base, Arbitrum One, Polygon PoS and Robinhood Chain answer a bot check that only a real browser passes. From Node these chains show as not read.
• BNB Smart Chain and Linea need the relay’s API key. Without a relay they show as skipped, with the reason.

A chain that could not be read always shows as such in the coverage, never as a clean chain.