What the network makes public
Your account name and its full transaction history are public on the network by design. That's true of every account, whatever wallet holds its keys.
What we store
Google or Apple tell us your email address. We keep a hash of it, linked to your account name, never the address itself. Your address reaches our servers when they hand it over, and rides in your browser's own session cookie.
What we log
The web authenticator reads the network and broadcasts what you sign through a Vaulta node we run, eos.greymass.com. It keeps temporary logs which are cleared at set intervals.
What the apps send
Anchor for iPhone, Android and desktop create and hold your keys on the device itself.
Anchor for Android sends crash reports to a Google service, so we can find and fix what broke. The iPhone and desktop apps send none.
Cookies and local storage
Your browser stores three things on the account path, all of them functional or strictly necessary:
- a first-party
localecookie remembering your language, from your own choice or your browser's language setting localStorage(not a cookie) holding your account name for the session you're signing in with- the web authenticator's own sign-in cookies, set before you do anything on that page
None of them needs your consent, so there's no banner asking for it.
Where your keys are
Your keys are made on your own device and stay there. The passkey that guards a browser account lives in the same keychain that signs you in to other sites. No website or browser can read the keys, and neither can we.
Questions about any of this go to support.
Last reviewed: 2026-07-29