Mango Wallet — Privacy Policy
Short version: Mango Wallet does not collect, transmit, or have access to your recovery phrase, private keys, password, or any personal data. Everything sensitive is generated and stored entirely in your own browser.
What Mango Wallet is
Mango Wallet is a self-custodial browser extension for EVM-compatible chains and Solana. "Self-custodial" means your recovery phrase and private keys are generated on your device, encrypted on your device, and never sent to Mango's servers or anyone else's — not in plain form, not encrypted, not in any form.
What we collect
Nothing. Mango Wallet has no backend, no analytics SDK, and no telemetry. We cannot see your balances, your addresses, your transaction history, or your identity through this extension.
What's stored, and where
Your recovery phrase and private keys are encrypted with a password you choose (AES-256-GCM, with the encryption key derived via PBKDF2-SHA256 at 600,000 iterations) and saved using the chrome.storage API, which keeps data local to your browser profile on your device. Nothing in that storage is ever transmitted anywhere by this extension.
Network requests this extension makes
To show balances and send transactions, the extension talks directly from your browser to public blockchain RPC endpoints (the same kind of public infrastructure MetaMask, Phantom, and every other wallet use) — never through a Mango-operated server. Those RPC providers can see the requests your browser sends them (that's how any blockchain RPC call works), but Mango itself is not in that path and does not log or relay it.
Why each permission is requested
storage— save your encrypted wallet vault locally, so it's there the next time you open the extension.windows— open the approval popup when a website asks to connect or asks you to sign something, the same pattern every browser wallet extension uses.host_permissions: <all_urls>— inject the wallet's provider (window.ethereum/window.solana) into pages so dApps can detect and connect to Mango Wallet, exactly like MetaMask or Phantom. This does not let Mango read page content or browsing activity; it only makes the provider object available for a site to call if it chooses to.
Third parties
Mango Wallet does not use any third-party analytics, advertising, or tracking scripts. The only outside parties it talks to are the public blockchain RPC endpoints described above, chosen for being real, independently verifiable public infrastructure.
Changes to this policy
If this policy changes, the "Last updated" date above will change with it. Material changes will be reflected here before they take effect.
Contact
Questions about this policy or the extension can be sent to mango@mangoprotocol.site, or through Mango's usual channels at mangoprotocol.site.
← Back to Mango