gleamPrivacy
Last updated: 25 September 2026
What Gleam is
Gleam is a browser extension wallet for Arweave and AO, plus this website. There's no Gleam server and no Gleam account.
What stays on your device
Your key is encrypted with your password and stored in the browser's extension storage. While the wallet is unlocked, the decrypted key is held in the browser's session storage. It's cleared when you lock the wallet, when auto-lock runs, or when the browser restarts.
Your settings, contacts, the sites you've connected and a local log of your activity are stored in the extension too. None of it is sent to us. We have no server to send it to.
What we can't see
We can't see your key, your password, your balances, your addresses or your activity. That also means we can't recover a lost password or key.
Network requests the extension makes
To show balances, prices and activity, and to send transactions, the extension talks to these services:
- An Arweave gateway,
arweave.netby default, or one you choose: AR balances, activity (through GraphQL), token details and posting transactions. If a GraphQL query fails there, it's retried onarweave.netand thenarweave-search.goldsky.com. ar-io.devandpermagate.io: on first install, ifarweave.netdoesn't answer, these are checked in turn to pick a working gateway.up.arweave.net: data uploads.mu.ao-testnet.xyz: submitting AO messages, such as token sends.cu.ao-testnet.xyz: reading their results.- HyperBEAM peers,
state.forward.computerby default, plus any peer you add: AO balance reads. api.coingecko.comandapi.coinpaprika.com: AR and AO prices, for USD values and the balance chart. These requests only name the token. They don't include your address.lunar.arweave.net: a block explorer. It opens in a new tab only when you click a transaction or address.
Each of these services receives your IP address, as with any web request. Gateways and AO nodes also receive your public address when looking up your balances and activity, because that's how public blockchains work. Transactions you send are public and permanent on Arweave and AO.
Sites you connect
A site sees only what you grant it, such as your address. Every signing request opens its own approval window. You can revoke a site's access at any time in Connected apps.
No tracking
There are no analytics, telemetry, cookies, ads or third-party scripts, in the extension or on this website. The website is static and hosted on GitHub Pages. GitHub may log standard request data, as described in GitHub's privacy statement.
Changes
If this policy changes, the new version is posted on this page with a new date. The code is public on GitHub.