Short version. The browser extension sends nothing anywhere, ever. The website uses cookieless analytics and, only if you actually find the key, sends the signed transaction to the services that can submit it. Nothing on either surface sends your private key.

The two are covered separately below because they genuinely differ, and a single answer would have to be wrong about one of them.

The browser extension

It makes no network requests of any kind. It asks for no host permissions, so it cannot reach any website, and it contains no fetch, no WebSocket and no remote imports. The build script refuses to package it if any appear. It also has no content scripts, so it never reads the pages you visit.

It stores three things on your own device, in extension storage, and nothing else:

• The payout address you type. Kept so you do not have to retype it.
• The chunk size measured on your GPU. A number, so the measurement does not have to be repeated every session.
• The private key, if the search ever finds one. Written to storage before anything else happens, because it is the only part of a win that cannot be recreated.

None of it leaves the machine. There is no account, no sign-in, no identifier, and no analytics in the extension.

The website

Analytics

Vercel Web Analytics, served from this domain rather than a third-party host. It is cookieless and records page views, the referring page, an approximate country and a device class. It does not set cookies, does not follow you between sites, and does not build a profile.

Stored on your device

In your browser's local storage, readable only by this site: the payout address you entered, the measured GPU chunk size, a fingerprint of your GPU and the shader code so the capability check need not repeat, any recovered private key, any claim waiting to be submitted, and which notices you have dismissed. Clearing site data removes all of it. None of it is sent to a server as part of normal use.

One thing worth knowing about share links

A share link created on this site puts the payout address into the URL, as ?pay=…. That is what makes the link useful, and it also means the address is part of the web address itself. Anyone you send the link to can see it, and it appears in the request like any other part of a URL, including in our analytics and in any network logs along the way. If you would rather an address not travel that way, share the plain krackpot.io link instead and let people enter their own.

Only if the search finds the key

This has never happened and almost certainly never will, but it is the case where data does leave your browser, so it should be spelled out.

The key is found and saved on your device first. A Bitcoin transaction is then built and signed locally, and the signed transaction is sent to:

• Rebar Shield and MARA Slipstream, two private transaction submission services, so the transaction can reach a miner without passing through the public network.
• Public Nostr relays, carrying an encrypted copy addressed to the developer, as a backup in case both of the above refuse it.

At the same time, the cryptography libraries needed to sign are fetched from esm.sh. That fetch happens at this point and not before, so ordinary use of the site involves no third-party code at all.

The private key itself is never transmitted. Only the signed transaction is. Being precise about what that does and does not hide: a signature mathematically reveals the public key it was made with, so each of those recipients can work out the public key from what they receive. That is true of any signed Bitcoin transaction and cannot be engineered away. What private submission buys is a smaller number of parties seeing it, for a shorter time, instead of the entire public network for as long as confirmation takes.

What is never collected, anywhere

• No account, email address, name or phone number.
• No cookies for tracking, and no cross-site tracking of any kind.
• No browsing history, no page content, no keystrokes.
• No selling of data, because there is no data to sell.

Your choices

Clearing site data for krackpot.io, or removing the extension, deletes everything stored locally. If a private key is stored, copy it somewhere safe first. Deleting it is irreversible and nobody else has a copy.

Contact

Questions to @simonmales, or through sime.net.au. If this policy changes, the date at the top changes with it.