Where are my keys kept, and what does Creta get to see?

Your private key and seed phrase are encrypted with your password and stored only in this browser's extension storage. The encryption is AES-GCM with a key derived from your password by PBKDF2 over 100,000 rounds, and your password itself is never stored anywhere — which is exactly why it cannot be recovered, and why nobody else can use it.

The encrypted data never leaves your device. It is not uploaded, not backed up by us and not synced between browsers.

What does leave the device: your public wallet address and the network you have selected, sent to Creta's own backend so it can look up your balances, tokens, NFTs and history — and transactions you have approved, sent to the blockchain. No account, no email, no analytics, no tracking and no location lookup.