1. The Zero-Knowledge Guarantee
At CheckPhrase, we believe that cryptographic security tools must be built on the principle of "trustlessness." This Privacy Policy outlines our commitment to your privacy, explaining exactly how our mnemonic scanning architecture operates to ensure your most sensitive data remains entirely under your control.
2. Information We Do NOT Collect
Our core utility is the BIP39 Mnemonic Validation Engine. To guarantee the absolute security of your cryptographic assets, we have architected our systems so that we cannot see, collect, log, or transmit your raw seed phrases.
- No Plain-Text Transmission: Your entered BIP39 words never leave your browser's local DOM memory pool.
- Local Hashing: All structural validation, checksum verification, and SHA-512 hashing occur exclusively client-side (on your device).
- No Database Storage: We do not maintain any databases of user-submitted recovery phrases.
3. Information We Collect Automatically
While your cryptographic data remains entirely secure and client-side, interacting with our web application entails the standard collection of generic network telemetry necessary for delivering the service and defending against cyberattacks.
Edge Server Logs
When you visit the CheckPhrase domain, our web application firewalls (WAF) and server nodes temporarily log standard connection data. This includes:
- Your masked IP Address (used strictly for rate-limiting and DDoS mitigation).
- Browser type and User-Agent string.
- General geographic location (country/region level) derived from IP routing.
- Timestamps of API requests to our threat-intelligence hash databases.
These server logs are strictly used for security auditing, network optimization, and preventing abuse of our API infrastructure. They are routinely purged and are never associated with the cryptographic hashes generated by your browser.
4. Third-Party Threat Intelligence
To provide accurate leak detection, our application cross-references your locally generated cryptographic hash against external indexes of compromised data (e.g., dark web paste dumps, malicious smart contract logs). We only query truncated hash fragments against these APIs to preserve mathematical anonymity.
5. Cookies and Local Storage
CheckPhrase utilizes minimal browser storage technologies solely for functional purposes:
- Session State: To remember your selected phrase length (e.g., 12 vs 24 words) during your active session.
- No Tracking: We do not deploy third-party advertising cookies, cross-site trackers, or behavioral analytics pixels on the scanner application.
6. Data Security Practices
We enforce strict Transport Layer Security (TLS 1.3) across all endpoints. While your seed phrase processing happens offline in the browser sandbox, the secure tunnel ensures that the transmission of the resulting hashes and the retrieval of the breach database results cannot be intercepted by Man-in-the-Middle (MitM) attacks.
7. Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our cryptographic architecture, regulatory requirements, or infrastructure upgrades. The "Last Updated" date at the top of this document will always reflect the most recent revision.
8. Contact the Security Team
If you have specific technical questions regarding our zero-knowledge architecture, client-side validation methods, or this privacy policy, please reach out to our engineering team.
Email: [email protected]