Privacy Policy

1. Who we are

“Sizland”, “we”, and “us” means the operator of the websites and services at siz.land and wallet.siz.land, and of the SizWallet Chrome extension. The publisher name shown in product metadata is Sizland (www.siz.land).

Registered legal entity name, company number, and postal address are operator details. Until those are published here, contact us using the emails in Contact.

2. What this policy covers

This policy covers, together:

• siz.land — the main Sizland website, including accounts, land and token purchase flows, and SSO into related Sizland apps on *.siz.land.
• wallet.siz.land (SizWallet) — DID wallet, multi-chain addresses, passkeys, KYC and Element Pay rails, and the dashboard.
• SizWallet Chrome extension — companion popup/side panel that unlocks the same identity and signs locally.
• Wallet backend APIs (Django on our hosting) and the Next.js proxy at /api/wallet on wallet.siz.land.

Wallet DID accounts are a separate identity layer from siz.land email / Google / NextAuth accounts, unless you later choose to connect them. Using one product does not automatically create an account on the other.

3. Important notice

This page is a product disclosure so users and the Chrome Web Store can see what the software does. It is not legal advice and should be reviewed by counsel before it is treated as a binding contract. Public blockchains are independent of Sizland; we cannot rewrite or erase confirmed on-chain records.

4. Information we handle

Chrome and similar stores treat “handle” as collecting, storing, transmitting, or using data — including data that stays only on your device.

A. SizWallet and the Chrome extension

• Identifiers. DID (did:key:…), public keys, and chain addresses (Base, BNB Smart Chain, Polygon, Algorand, Sui, TON). These are sent to our wallet API to register wallets, prove ownership, and operate the dashboard.
• Username and public profile. Optional username, bio, and avatar (IPFS CID). Usernames can be resolved publicly.
• Authentication. Ownership tokens (short-lived JWTs), DID signatures, and WebAuthn/passkey public credential data (credential id, public key, device name, sign count). Vault passwords and recovery phrases are used on your device; they are not required fields on our wallet API.
• Financial / on-chain activity. Balances, send amounts, destinations, UserOperations, transaction hashes, and activity queried from public RPCs and Basescan. Smart-wallet addresses and credit-score / reputation fields associated with a DID may be stored by us.
• KYC and payments (optional). If you use Element Pay on-ramp or off-ramp, the wallet app collects legal name, country, phone, email, date of birth, address, ID type and number, and BVN (Nigeria). Bank or mobile-money details (account name/number or phone) are collected for quotes. This is stored in our wallet database and forwarded to Element Pay to process the order.
• Technical data. Our hosts and RPC providers necessarily see IP addresses and standard request metadata when you call them. We do not run a first-party analytics SDK on wallet.siz.land.

B. siz.land website

• Email, first name, last name, and password when you register with email.
• Google account email and profile if you use Google sign-in.
• Algorand or EVM wallet addresses if you connect a wallet.
• Payment email and wallet address for Stripe or Paystack token purchases. Card numbers are handled by those processors, not stored in our front-end code.
• Contact name and email on land-acquisition request forms.
• Session cookies on .siz.land for login and SSO into related apps (for example erp.siz.land).
• Wallet-auth analytics on siz.land may send wallet address, IP address, and user-agent to the Sizland backend.

We do not operate a KYC form on siz.land itself. KYC in this policy is the SizWallet / Element Pay flow.

5. Keys, phrases, and passwords

SizWallet is built so a new identity starts from a recovery phrase generated in your browser. Signing for sends is designed to happen on your device (website or extension). The wallet API is guarded so mnemonic and private-key field names are not accepted on ordinary client requests.

You should still treat these facts as part of the real product:

• The Chrome extension stores the recovery phrase in chrome.storage.local as AES-GCM ciphertext. Unlocking keeps signing keys in the extension service worker memory, not in that vault as plaintext.
• The website may keep an encrypted PIN keystore in localStorage, and may also keep EVM/DID key material in localStorage for convenience after backup. Anyone with access to that browser profile can reach what the browser stored.
• Passkey private keys stay in the authenticator (phone, laptop, or security key). We store the public WebAuthn credential so we can verify you.
• Backend configuration can allow server-side wallet generation, which may return key material over HTTPS. The public create flow still generates a phrase in the browser; operators should not enable server generation in production if the product promise is “keys never leave the device.”
• siz.land includes a legacy email route that can send wallet material by email if that flow is used. Do not use email delivery of keys if you want them only on your device.

If you lose your recovery phrase and have no passkey or other backup, Sizland cannot reconstruct it. Deactivating a DID does not wipe keys from your devices.

6. How we use information

• Provide the wallet, website, extension, and related Sizland apps you choose to use.
• Verify DID ownership, passkeys, and sessions.
• Register chain addresses, usernames, and smart-wallet status.
• Submit locally signed UserOperations through our bundler proxy.
• Process optional KYC and on-ramp / off-ramp orders.
• Secure the service (rate limits, fraud and abuse detection, debugging).
• On siz.land, fulfill purchases, land requests, and cross-app SSO.

We do not use SizWallet dashboard data to run advertising SDKs on wallet.siz.land. siz.land may use Vercel Speed Insights and WalletConnect/Reown analytics when those features are enabled on that site.

7. Sharing and processors

We do not sell your information. We share it with processors only as needed to run the product you are using, or if the law requires it.

Wallet product

• Hosting: website front end (typically Vercel) and wallet API (typically Railway), plus PostgreSQL and Redis when configured.
• Pimlico: bundler JSON-RPC for UserOperations, called from our server (API key stays on the server).
• Public chain RPCs and indexers your browser calls directly: Base, BNB public node, Polygon public node, Algorand AlgoNode, Sui fullnode, TON Center, Basescan, Polygonscan. They receive the addresses you query.
• Pinata / IPFS: public credentials and avatars you publish.
• Element Pay: KYC and fiat on-ramp / off-ramp when you use those screens.
• Optional scoring / AO reputation services when those integrations are enabled on the backend.

siz.land

• Google (OAuth).
• Stripe and Paystack (payments).
• WalletConnect / Reown (wallet connect).
• Map providers (OpenStreetMap / ArcGIS tiles) on map pages.
• SIZBackend hosting (Railway / Render as configured) for accounts and land data.

Confirmed on-chain transfers are public. Explorers and nodes are independent of Sizland.

8. Chrome extension

The extension’s single purpose is to let you unlock your Siz.land DID, view addresses for that identity, and sign sends locally. Passkey sign-in is completed on wallet.siz.land, then a public session is handed to the extension.

For Chrome Web Store data types, the extension handles:

• Personally identifiable information — DID and wallet addresses as identifiers.
• Financial and payment information — crypto balances, sends, and activity (not card numbers).
• Authentication information — vault password on device, passkey session, ownership tokens.

It does not read your general browsing history, scrape page content, log keystrokes, or collect GPS. Host permissions are only for wallet.siz.land and the chain APIs listed in the store listing. Uninstalling removes extension storage on that Chrome profile; it does not delete server-side DID, KYC, or on-chain records.

9. Cookies and device storage

wallet.siz.land

• sessionStorage for a public wallet session snapshot (DID, addresses, username flags — not private keys).
• localStorage for optional PIN keystore, optional plaintext key convenience store, and tracked-token lists.
• No first-party advertising cookies in the wallet app code.

Chrome extension

Encrypted vault in chrome.storage.local. Signing keys in RAM while unlocked.

siz.land

• NextAuth session cookies, including a production domain of .siz.land so related apps can share login.
• SSO token cookie for ERP and similar apps.
• Theme and wallet-connect storage in the browser.

There is no cookie preference center in the current products. You can block cookies in the browser; account and wallet features that need storage will not work fully.

10. Retention and deletion

• Sign out on wallet.siz.land clears the in-browser session. It does not erase localStorage keystores or server records.
• Locking the extension drops keys from memory. The encrypted vault remains until you clear extension data or uninstall.
• You can delete an individual passkey from the dashboard/API.
• DID deactivation marks the identity inactive. It does not currently purge wallets, KYC profiles, or payment orders from our database.
• We do not currently offer a full “erase all copies” API. Retention periods for backups and logs are an operator decision and are not defined in application code.
• Blockchain records, IPFS content you published, and Element Pay records held by that processor may remain after you stop using Sizland.

To ask us to restrict or delete server-side records we control, use the contact emails below. We may need to keep information where we have a legal duty (for example payment or fraud records).

11. Your choices

• Do not submit KYC or use on-ramp/off-ramp if you do not want identity and bank details processed.
• Use a passkey, a strong vault password, and device encryption.
• Clear site data or uninstall the extension to remove on-device stores.
• Revoke passkeys you no longer use.
• Depending on where you live, you may have rights to access, correct, delete, or object to processing of personal data we hold. Email us to exercise them.

12. Children

SizWallet, the extension, and payment/KYC features are not directed at children. Do not use them if you are under 18. The siz.land marketing site previously referred to age 13; wallet and financial features should be treated as 18+.

13. International processing

Hosts, RPCs, Element Pay, and CDNs may process data in countries other than yours (including where Vercel, Railway, and those vendors operate). Exact server regions are an operator configuration and are not hard-coded as a single country in the apps.

14. Changes

We will post updates on this page and change the “Last updated” date. Material changes to how the extension handles data will also be reflected in the Chrome Web Store privacy disclosures when we publish a new version.

15. Contact

Privacy: privacy@sizland.tech

Wallet support: support@siz.land

Chrome Web Store listing URL for this policy after deploy: https://wallet.siz.land/privacy