What it never touches
XMRadar runs in your browser, with no account. Its own site is asked only for the latest version number; other services are asked only for the features you use, listed below. The code is open, so you can check every claim.
KYC-rip/xmradarRead the source →
- ✓
No Monero keys, no fundsTips open in your wallet, and your wallet signs for Sign in with Monero. XMRadar never sends or holds Monero.
- ✓
Your Nostr key, your choiceWith a NIP-07 signer, events go through it, and it decides what to ask you. Without one, XMRadar makes its own key, kept in the extension's own storage (IndexedDB) that pages and content scripts can't open, exportable and deletable in Options. That key signs only XMRadar's own events without asking each time: xos and their removal, Xap receipts and confirmations, your profile name, relay list, Monero address, X link and the xmr.bio listing request. Never your posts.
- ✓
xmr.bio listing is your choiceOn by default. Once your X link verifies and you've published a Monero address, and xmr.bio doesn't know your handle yet, XMRadar sends your handle, address, Nostr key and the proof tweet's id to xmr.bio. Your profile and its directory show the handle, address and key; the tweet id stays in the stored proof. Untick it in Options → Monero identity; on xmr.bio, unlist hides you and delete removes the profile.
- ✓
What an xo showsAn xo is a public Nostr event naming the X post's link, the author's X handle and, when it's known, their Nostr key, so relays see who liked what. Holding the heart, or the option for a plain click, also likes the post on X.
- ✓
No transaction ids in publicTip receipts never include a transaction id, tx key or payment proof.
- ✓
xmr.bio's directory comes wholeWhile badges are on (the default), XMRadar downloads xmr.bio's signed directory, the same file for everyone, about once an hour, and matches X accounts on your device. xmr.bio doesn't learn which accounts you view.
- ✓
Discovery is off by defaultLooking up X accounts on relays is opt-in, because relays can see which accounts you view.
- ✓
The site you visit stays in your browserxmr.club's signed list is downloaded whole, the same file for everyone, and matched on your device, lookalike warnings included.
- ✓
Receipts and letters stay localChecked and saved in your browser only. A letter is asked for only from the order page's own site, and keys come from xmr.club's signed list, never from the page.
- ✓
Burner mail stays localGhostMail gets only what the inbox needs (its address and token, and a random proof-of-work seed when it's created), nothing about the page you are on.
- ✓
The update check carries no IDOnce a day it asks xmradar.app for the latest version number, with no version, ID or page in the request. Like any visit, the site sees your IP address and browser, and that XMRadar is in use. It only tells you; you download and check the new zip yourself. You can switch it off.
- ✓
Tag suggestions are opt-inOff by default. A local model keeps the post on your computer; a provider gets the post's text and tags only with your own key, which no page can read.