Privacy & safety
The trust model, in plain words.
What our server can see
- The wallet addresses you paste (and their nicknames) — needed to read their history. They live in memory for the audit and up to 10 minutes after, then they’re dropped.
- Your IP address, like every web server. It is used only for in-memory rate-limit counters that reset within the hour, never written to disk or logged with an audit.
- If you sign in for Pro: your wallet address, the fact that it ran an audit, and your Pro expiry date (stored so Pro survives restarts).
What we never do
- Write audits to disk, keep a history, or log the addresses you check.
- Run analytics, load third-party scripts, fonts or pixels.
- Ask for a seed phrase or private key, hold funds, or move funds. Signing in is a free message signature.
- Show you a burn without the exact amount first.
Who else sees something
- Our Solana RPC provider sees the lookups for your addresses — coming from our server’s IP, not yours. The RPC key never reaches your browser.
- Solscan, if you click an evidence link.
- The blockchain itself: everything ZWeave shows is already public to anyone who looks.
ZWeave is a personal-privacy tool for wallets you own. It does not mix, tumble or hide funds, and its tips are about not leaking more than you mean to — not about evading exchanges, sanctions or law enforcement.