Aura Wallet does not collect, transmit, or sell personal data. No Peranto servers are involved: no analytics, telemetry, user accounts, or advertising IDs. Everything Aura stores lives in your browser’s local extension storage on your device.
What Aura stores, and where
All in chrome.storage.local:
| Data | How | Why |
|---|---|---|
| BIP39 mnemonic and private key | Encrypted (AES-256-GCM + PBKDF2-HMAC-SHA256, 600,000 iterations) | Sign transactions and credentials |
| DID and public addresses | Plaintext (public data) | Show identity while locked |
| Verifiable credentials (JWT) | Plaintext | Local credential vault |
| Settings and trusted sites | Plaintext | Network, RPC, and dapp permissions |
While unlocked, decrypted keys live in chrome.storage.session (browser
memory): not written to disk, cleared on browser close or auto-lock. Your password is never stored; it only derives the
encryption key. If you forget it, re-import your BIP39 mnemonic.
Network requests
Aura does not talk to Peranto servers. It only connects to:
-
The RPC of the network you choose (default
eth-rpc-testnet.polkadot.io) for balances and transactions you approve. -
/.well-known/did-configuration.jsonon sites you authorize (DomainLinkage). - Aztec CRS CDN the first time you generate a ZK proof (public parameters, no personal data).
What dapps see
A dapp only gets your data if DomainLinkage verifies and you approve. Each sensitive action (share, sign, send) needs a separate approval. Revoke origins in Settings → Trusted sites.
Permissions
-
storage— encrypted vault, credentials, and settings on your device. -
alarms— idle auto-lock with the popup closed. - RPC / localhost / CRS CDN hosts — chain access and public ZK params.
-
Content script on HTTPS pages — exposes
window.aura(EIP-1193); message bridge only, does not read or modify page content.
Your data is yours
-
Export: Settings → Backup (after password). Credentials as
.peranto.json. - Delete: “Delete local identity” or uninstall the extension.
Children
Aura is not directed at children under 13 and does not collect anyone’s data.