MemeTagYour data, clearly.
What stays on your device, what a trade sends to outside services, and what you control.
Scope of this notice
This notice describes the MemeTag website and extension version 1.4.7. It covers the information the software handles to detect tokens, operate a local wallet, and prepare and submit transactions.
External websites, your browser, hosting services, and trading providers have their own data practices. Their handling of data is separate from local extension storage.
Saved tokens
Your watchlist stores up to 100 network and contract pairs, token names, symbols, and save times in local extension storage. This browser-level list is shared across wallet connections, not uploaded or synced to a MemeTag account. Saving or removing a token does not request market data; opening its trade panel does.
Remove individual entries in Watchlist. Removing the local MemeTag wallet or uninstalling the extension deletes the entire list. Disconnecting an external wallet or locking does not delete it.
Data on your device
| Information | Purpose and storage |
|---|---|
| Recovery phrase and private keys | Stored inside a password-encrypted local vault. Unlocked signing material is held in trusted extension session storage. |
| Public wallet addresses | Used to show accounts, balances, and the selected transaction recipient. |
| Settings and RPC URLs | Stored locally to retain network choices, slippage, lock timing, and connection settings. |
| Token selections and quick-buy limits | Stored locally to remember exact contracts and enforce configured allowances. |
| Position records | Confirmed Solana trade receipts, token movements and native cash flows are stored locally for cost basis and PnL calculations. They are not uploaded to a portfolio database. |
| Recent activity | Up to 100 transaction records, including identifiers, status, and the RPC used, are retained locally. If you turn on Save source X posts, a trade can also include the post’s canonical URL. Tweet text and browsing history are not stored. |
The persistent vault uses AES-256-GCM and a key derived from your password with PBKDF2-SHA-256 at 600,000 iterations. The extension does not send the recovery phrase or private keys to MemeTag’s website or trading providers.
Locking clears the unlocked session and pending session data. Browser restart clears session storage. Local wallet data is not synced to a MemeTag account. Activity, fill and PnL image exports are generated on your device only when you choose to download them. PnL images hide the wallet address and SOL amounts by default; enabling either option places that public financial information in the downloaded image. Activity CSV files include a stored source-post URL when that opt-in setting was enabled; exports omit RPC URLs, recovery phrases and private keys. Downloaded copies remain where you save them.
Connected wallets
Connecting Phantom, Solflare, or Backpack shares your public Solana address and a signed connection message with the extension through the MemeTag connection page. Private keys remain in your selected wallet.
The website receives a short-lived request identifier and the transaction details needed to present a wallet approval. The signed transaction is returned to the extension for verification and broadcast. Connection requests expire after five minutes, trade requests follow quote expiry, and connection state clears on lock, when the configured auto-lock timer expires, or on browser restart.
Your wallet provider processes its own approval screens and any network requests it makes under its privacy policy. The MemeTag connection page does not retain a server-side wallet profile or trade history.
Post text on X
The content script inspects rendered post text to find cashtags and Solana or EVM contract addresses. That detection happens in the browser. Opening a token initiates its market lookup; the extension does not upload your full timeline.
When your wallet is unlocked or connected, the X page can ask the trusted extension background for the balance of the one exact contract rendered beside a control. It cannot request the wallet’s full token list. Repeated appearances share a short-lived local read, and displayed ownership is cleared when the account, network, lock state, or exact contract changes. These reads are not uploaded to a MemeTag account.
The extension does not ask for your X password or use X account credentials to post, follow, like, or send messages. Text in a post is not permission to reveal a key or transfer assets.
Requests to outside services
| Recipient | Information and purpose |
|---|---|
| Dexscreener | Ticker or contract queries and market/pool identifiers for token and route discovery. |
| Raydium and PumpPortal | Relevant public wallet address and order details when their services are used to prepare a transaction. |
| Selected network RPC | Public addresses, account reads, simulations or gas estimates, signed transactions, and status checks. A custom provider can be selected in Settings. |
| Robinhood Chain Blockscout | Public addresses for token discovery and pool identifiers for routing lookups. |
| Token image hosts | Image requests used to display token artwork. |
| Transaction explorers | A transaction identifier or public address when you open its explorer link. |
The default Solana RPC is Vibe Station (public.rpc.solanavibestation.com); Robinhood Chain uses PublicNode. Version 1.4.7 replaces the exact previous Solana default. Custom endpoints remain unchanged.
Direct Pump.fun and PumpSwap routes use bundled SDKs and RPC data. Robinhood Chain orders are encoded locally and quoted through the selected RPC. A signed transaction does not contain a private key.
Providers receiving a direct request can also receive connection information such as the IP address, time, and user agent. Their retention, security, and international processing depend on their own practices.
A custom RPC URL can include a provider access token. It is stored locally and used for requests to the chosen host; MemeTag does not return the full endpoint to the X content script.
Website, hosting, and cookies
The MemeTag application code does not add advertising trackers or analytics cookies. The homepage requests public market information for its token preview. The website’s market endpoint temporarily caches token lookup results to reduce repeated requests.
The hosting and delivery services process normal request information to serve and protect the site. Hosting-level sign-in can use necessary authentication cookies. Downloading the extension does not create a MemeTag wallet account or send wallet secrets to the website.
Cloudflare describes its infrastructure data handling in its privacy policy. Hosting-level authentication and provider logs are separate from the wallet’s local data.
MemeTag’s use of information received through the extension follows the Chrome Web Store User Data Policy, including its Limited Use requirements. The current application does not include advertising-data sales, a marketing mailing list, or a behavioral analytics pipeline.
Why the extension needs permissions
| Permission or access | Use |
|---|---|
| Storage | Save the local vault, settings, token choices, activity, and unlocked session. |
| Alarms | Schedule wallet locking and transaction-status checks. |
| X and Twitter page content | Find token text and place the trading controls beside it. |
| Listed market and network hosts | Look up tokens, prepare supported routes, and communicate with the chains. |
| Optional HTTPS host access | Connect to an RPC host you choose in Settings after the browser grants permission. |
Chrome explains local and session extension storage in its storage documentation. MemeTag restricts access to its local and session storage to trusted extension contexts.
Retention and removal
Local wallet and configuration data remain until you change or remove them. Recent activity is capped at 100 records. Unlocked session data is cleared when you lock the wallet or restart the browser.
- Back up the recovery information before removing anything.
- Open wallet Settings → Remove wallet from this device.
- Enter your password and type REMOVE to clear the wallet, settings, activity, position records, tracked tokens, and local allowances.
Uninstalling the extension removes its browser storage. Copies you exported or downloaded remain wherever you saved them. Provider-side logs follow the relevant provider’s retention practices.
Your choices and updates
You can hide the Buy buttons, disable quick buy, keep source-post saving off, choose another RPC, lock the wallet, or remove the extension. The wallet guide explains backup and removal.
This notice is dated above and describes the named release. Check it again when installing a new version. The implementation and its dependencies can be inspected in the source package.
Download source code