gleamPrivacy
Last updated: 12 October 2026
What Gleam is
Gleam is a browser extension wallet for Arweave and AO, plus this website. There's no Gleam account. Gleam runs one server, for Gleam Points, and it's optional: the extension sends it nothing unless you redeem an invite code or join.
What stays on your device
Your key is encrypted with your password and stored in the browser's extension storage. While the wallet is unlocked, the decrypted key is held in the browser's session storage. It's cleared when you lock the wallet, when auto-lock runs, or when the browser restarts.
Your settings, contacts, the sites you've connected and a local log of your activity are stored in the extension too. None of it is sent to us.
What we can't see
We can't see your key, your password or your activity. That also means we can't recover a lost password or key. If you join Gleam Points, we see that wallet's address and its AR and AO balances, as described below. Otherwise we don't see your addresses or balances either.
Network requests the extension makes
To show balances, prices and activity, and to send transactions, the extension talks to these services:
- An Arweave gateway,
arweave.netby default, or one you choose: AR balances, activity (through GraphQL), token details and posting transactions. If a GraphQL query fails there, it's retried onarweave.netand thenarweave-search.goldsky.com. ar-io.devandpermagate.io: on first install, ifarweave.netdoesn't answer, these are checked in turn to pick a working gateway.up.arweave.net: data uploads.mu.ao-testnet.xyz: submitting AO messages, such as token sends.cu.ao-testnet.xyz: reading their results.- HyperBEAM peers,
state.forward.computerby default, plus any peer you add: AO balance reads. api.coingecko.comandapi.coinpaprika.com: AR and AO prices, for USD values and the balance chart. These requests only name the token. They don't include your address.lunar.arweave.net: a block explorer. It opens in a new tab only when you click a transaction or address.gleamwallet.app: when you open the extension, it fetchesannouncements.jsonfrom this site, a static file of short notices from the Gleam team. It's a plain request that sends nothing about you or your wallet.api.gleamwallet.app: the Gleam Points server. The extension contacts it only when you redeem an invite code or join, and after you join, for the regular check-ins described below.
Each of these services receives your IP address, as with any web request. Gateways and AO nodes also receive your public address when looking up your balances and activity, because that's how public blockchains work. Transactions you send are public and permanent on Arweave and AO.
Gleam Points
Gleam Points is optional. Nothing is sent to its server until you enter an invite code or choose to join a wallet. When you join:
- Your install creates a device key, which stays in the browser. It only proves that requests come from the same install. It can't sign transactions or reach your funds.
- The wallet signs a message linking its public address to that device key, and the server stores the address, the device key's public half, the wallet's invite code, and who invited it, if anyone.
- About once a day, the extension sends a signed check-in so the server knows Gleam is still installed. The server stores when it last heard from your install.
- Every 6 hours, the extension asks the server for your points and how many invite seats are left, so the toolbar can show a dot when you have a new seat to share. This request carries the device key's ID and a signed timestamp, and nothing about what you do in the wallet.
- Once a day, the server reads each joined wallet's AR and AO balance from public Arweave and AO nodes and stores it with that day's points.
While Gleam is invite-only, a new install needs an invite code before it can create or import a wallet. When you enter one, your install creates its device key and sends the code and the key's public half to the server. If the code is accepted, the server stores the key's public half and the redemption: which code it used, and when. If it isn't, nothing is stored. Checking a code on the invite page sends only the code, which isn't stored.
Because all wallets on one install share the device key, the server can tell they belong to the same install. We use this, the invite links between wallets and the balance history only to run Gleam Points and to review points for abuse. There's no public leaderboard: your points and rank are shown only to your install. The server never receives your key or your password.
The server also receives your IP address with each request, as with any web request. We don't store it, apart from short-lived rate limiting.
To leave, choose "Leave Gleam Points" on the Points screen. This deletes that wallet's points data from the server straight away: its address, invite code, balance history and points. If it was the last wallet on your install, the install's device key, check-in time and invite redemption are deleted too. Leaving gives up the wallet's points and can't be undone.
Uninstalling Gleam stops the check-ins, and a wallet with no check-in for 3 days earns no points, but its data stays on the server until you leave. If an install redeems an invite code but never joins, its device key and redemption stay on the server too. If you no longer have the install, or want those removed, email us from the contact below.
Sites you connect
A site sees only what you grant it, such as your address. Every signing request opens its own approval window. You can revoke a site's access at any time in Connected apps.
No tracking in the wallet
The extension has no analytics, cookies or ads, and it never reports what you do in it. The only exception is the Gleam Points check-in, which tells the points server Gleam is still installed, and the 6-hourly request for your points and invite seats. Both are sent only after you join, and they carry nothing about what you do in the wallet.
It does open three pages on this website. The welcome page opens once, when you install Gleam. The goodbye page opens when you uninstall it. The feedback page opens when you choose "Send us a message" in Settings. The only thing the extension adds to these links is its version number.
Install counts
The welcome, goodbye, feedback, invite, Gleam Points and Gleam Points vision pages use Umami, a cookieless analytics service, to count visits. Umami records the page, the Gleam version, your browser type and your country, and whether a form was sent. For the goodbye form, it also records which reason you picked, but never what you typed. On the invite, Gleam Points and vision pages it counts invite visits, invite codes passed to a new install, use of the points calculator, and clicks on "Add to Chrome", "Accept invite", "Ask for an invite on X" and "Follow on X", including on the welcome page. On the invite page it also records whether an invite code is a member code or a drop code. It never records the invite code itself. It sets no cookies and doesn't identify you. It's how we count installs, uninstalls and invites. The invite page also asks the Gleam Points server whether your invite code has seats left. This request carries no information about you beyond what any web request does, plus the invite code. The rest of this website has no analytics.
Feedback and uninstall forms
If you send a message on the feedback or goodbye page, it's delivered to us by email through Web3Forms. We receive what you type, your email if you give one, your Gleam version, and, for feedback, your browser's user-agent string. We use it only to answer you and improve Gleam.
Hosting
The website is static and hosted on Vercel. Vercel may log standard request data, as described in Vercel's privacy policy. The Gleam Points server is hosted on Railway, which may also log standard request data, as described in Railway's privacy policy.
Changes
If this policy changes, the new version is posted on this page with a new date. The code is public on GitHub.