Garm privacy

Read-only. Never connects a wallet.

Garm is on · checks locally · only CAs leave your browser.

Garm is a free Chrome extension for x.com. It has no accounts, no sign-in, no ads and no default telemetry.

What leaves your browser

• To our API: CA strings (Solana contract addresses written in posts you see), in batches of up to 20, plus a random install id made on your device. When the side panel shows a coin page you open from X, that coin's mint (a CA string, never the page or its URL), for the family line ("1 of M+ mints called $T"). When you click a "named after @handle" pill, that coin's address once more (at most once a day, unless the last read failed) to check its metadata link again. When a post gets the "pushed by a known ring" chip, that ring's coin addresses (CA strings only, from posts this device saw in the last 30 days, at most 8), for the chip's record of how those coins did. Nothing else. Never post text, images, handles or wallet addresses.
• To DEX Screener: CA and mint lookups, and the pool address in the URL of a coin page you open from X, to find the coin behind an address.
• To GeckoTerminal: holder spread and pre-post prices for coins in posts, and led-you-here prices, only after you click "Allow public Solana data" (on the first-run screen or in settings) or turn on led you here.
• To the Solana RPC you chose (your own Helius key, or the public Solana RPC): mint and pool lookups, and your wallet address if you turn on led you here. Your wallet address never goes to our server.

What leaves the browser: CA strings to our API; CA/mint lookups to DexScreener (and GeckoTerminal for led-you-here); the user's wallet address only to the RPC the user chose (their Helius key or the public RPC), never to our domain. Never post text, images, handles (v1) or wallet addresses to our server. No default telemetry.

Local-only mode turns all of this off: Garm then makes no network requests at all and works from local rules only.

What stays on your device

Everything else: the posts Garm has checked, accounts it has seen, ring memory, the coin pages you opened from X (90 days), led-you-here buys and results, your settings, and the X theme (Default, Dim or Lights out) Garm last saw on x.com, so its popup, settings and side panel match X. These live in the extension's own storage on your device and are never uploaded.

What our server keeps

Coin facts per mint (public on-chain and market data) with a time limit, a spend counter, and a count of each install id's requests that day (kept 24 h). No handles from your feed, no post text, no wallet addresses of users.

We remember the top holder addresses of coins we check (public on-chain data), never yours.

Coin pages you open from X

Garm reads the address (URL) of coin pages you open from X, never the page itself. It shows warnings as a toolbar badge, side panel and system notification. This is why Chrome says Garm can "read your browsing history": it matches the coin page to the X post you clicked, on your device only. Only the coin or pool address read from that page's URL leaves the device: to DEX Screener (and the Solana RPC, if you allowed public Solana data) to find the coin, and the coin's mint to our API for the side panel's family line. Never the page or its URL. Local-only mode sends none of it.

Led you here

Led-you-here opt-in: "Tracking from today. Nothing leaves your browser." You add a public wallet address (no connect, no signing). Garm reads that wallet's buys from the RPC you chose and shows, on your device only, what each account that sent you to a coin has cost or made you.

The "Why" panel

Each fact says where it came from: "checked locally" vs "looked up: CA only".

What we send

The options page has a "what we send" log showing every request to our domain, exactly as it left your browser. It keeps the last 200 requests since the browser last started.

Later, opt-in only (v1.1)

Opt-in. Handles you see are sent to our server, hashed with a key that changes daily, and only counts are kept. This is off until you turn it on, and it isn't in v1.

Chrome Web Store

Single purpose: verify crypto content on X and the coin page you open from it.

Limited Use: Garm's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Garm doesn't sell user data, doesn't use or transfer it for advertising, creditworthiness or lending, and no person reads it. The only data that reaches our server is the CA strings and the random install id described above, used only to return coin facts and to limit requests per install.