Privacy by design
Why having no backend means there is nothing to leak, and exactly what the app sends and where.
ToolPack is built so that privacy is not a policy you have to trust. It is a consequence of the architecture. Because there is no backend and no database, there is no store of your activity that could be leaked, subpoenaed, or sold. This page explains what that means and lists precisely what the app talks to.
Nothing to leak
The app is a static frontend. Every tool is either pure computation in your browser or a direct call from your browser to the chain. Concretely:
- No account system. There is nothing to sign up for and no identity to log in as.
- No database. Your addresses, lists, balances, and results stay in the page while you use it. Nothing is written to a server, because there is no server to write to.
- No custody or connected-wallet key access. The app never holds funds and never receives the private key or seed phrase of a wallet you connect. Transactions are signed in your wallet. The Vanity Address Generator creates a new key locally and shows that generated key only in your browser.
- No activity logs. No backend records what you look up or send.
A breach exposes data that exists somewhere. Here, the sensitive data never leaves your browser: your lists and your queries stay on the page.
What the app sends, and where
The app contacts only what it needs to function. Depending on which features you enable, these are the expected destinations:
| Destination | Why | What is sent |
|---|---|---|
| Robinhood Chain RPC | Read chain data and broadcast transactions you sign | Standard RPC requests: balance and contract reads, transaction lookups, and signed transactions you approve |
| Blockscout explorer API | Fetch verified-contract ABIs and names | A contract address, to retrieve its public verified metadata |
| openchain.xyz | Look up an unknown 4-byte function selector in the Transaction Decoder | Only the 4-byte selector, never your address or full calldata |
| api.github.com | Show the repository star count in the header, only when a GitHub repository is configured | The public owner and repository name, to read the repository's public star count |
| Reown / WalletConnect infrastructure | Wallet discovery, QR pairing, and relay transport when wallet connection is enabled | Wallet-connection protocol metadata needed by Reown AppKit; analytics, email login, socials, swaps, on-ramp, and history are disabled in ToolPack |
If you self-host with your own RPC, chain reads go to a provider you choose. See the Network reference. Browser extensions and wallets may also contact their own services independently of ToolPack.
Tools that touch no network at all
Several tool computations are fully local and do not transmit their inputs. The surrounding app shell may still initialize configured wallet infrastructure:
- Unit & Hex Converter
- Address List Utilities
- Merkle Tree Generator
- Sign & Verify: the verify side (recovering a signer) is local; signing uses your wallet
- Vanity Address Generator: keys are generated locally and never transmitted
Your wallet and its own RPC still see the transactions you sign; that is inherent to using a blockchain. ToolPack adds nothing on top of that, with no analytics and no server in the middle.
Verify it yourself
You do not have to take this on faith. The code is open source, and you can read exactly what each tool requests or self-host it so the frontend itself is served from infrastructure you control.