Extension Privacy Policy

This policy covers the ZODsCC browser extension. The CashCat web interface is a separate product with its own privacy policy, and the two differ in one important way: the website needs no account, and the extension does nothing without one.

The extension is an interface to a ZODsCC account. The account holds a custodial wallet and signs every launch, trade and withdrawal on the server. The extension itself holds no private key and moves no funds.

What the extension handles

Your account API key. You paste it once, from your account page. It is stored in this browser’s local extension storage, never in synced storage, so it does not travel to your other machines. It is sent only to cashcat.io, as an authentication header on your own requests. Signing out deletes it.

What you type into a launch or a trade. The token name, ticker, description, image URL and social links you enter, and the amounts, slippage and gas settings for a trade or withdrawal, are sent to cashcat.io so your account can carry them out. Confirmed trade totals and launch status come back so the extension can show them.

Content of a page, but only when you act on it. On X, holding ctrl or cmd and clicking a post reads that post, and only that post, so a launch form can be filled in from it. On a supported token page, the token address in the page address is read so a trade can be quoted. Nothing is read from a page you have not acted on.

Your preferences. Which network to use, whether the overlay is shown, which launchpad a new ticket opens on, and the position and size of each panel on each site. These stay in browser storage.

What the extension never collects

No browsing history, no list of pages you visit, no clicks, no scrolling, no keystroke logging, no analytics, no advertising or tracking of any kind. The extension carries no analytics library. It never asks for your name, email, phone number or any government ID.

Where it runs

The overlay is injected into these sites and no others. Your browser shows you the same list before you install, and you can switch the overlay off entirely in the extension settings.

• x.com, and its subdomains
• padre.gg, and its subdomains
• tinyastro.io, and its subdomains
• gmgn.ai
• axiom.trade
• basedbot.app
• fomo.family
• dexscreener.com

It runs in the top frame of a page only, never inside embedded frames, and it reads nothing from any of these pages until you act on something.

Where the data goes

To cashcat.io, and nowhere else. The extension has permission to reach exactly one host, so there is no second backend, no analytics endpoint and no third-party service receiving anything.

One exception worth naming, because it is traffic and you should hear about it from us: on a supported token page the extension asks that site’s own API which market the page is showing. It is a same-origin request the page already makes for itself, it carries nothing of yours, and the answer is re-checked against the blockchain before it is used.

How it is sent

Everything travels over HTTPS. The extension is permitted to reach one origin and that origin is https only, so there is no plaintext path for it to fall back to. Your account key is sent in a request header, never in a URL, so it does not end up in browser history, server access logs or a referrer.

What you agree to, and when

Before you can connect an account, the extension shows you this same list of what it collects and asks you to agree. Nothing is sent anywhere before that. If what we collect ever changes, you will be shown the new list and asked again rather than opted in quietly.

Public by design

Launches and trades are blockchain transactions. Once made, they are public, permanent, and visible to anyone, including the token metadata and artwork you attach. Nothing in this policy can make an on-chain record private, and no one can delete one. Do not put personal information in a token name, description or image.

Retention and deletion

Signing out of the extension immediately deletes, from this device:

• your API key
• your cached account profile
• your cached launch list

Uninstalling the extension removes its storage entirely. Data already held by your ZODsCC account, and anything already recorded on the blockchain, is outside what uninstalling can reach. For account data, contact us at the address below.

How we use it

Only to do what you asked: launch a token, quote or place a trade, withdraw funds, and show you the result. We do not sell or transfer your data to third parties, we do not use it for anything unrelated to launching and trading, and we never use it to assess creditworthiness or for lending.

Your rights

Depending on where you live, you may have the right to access, correct or delete personal data, to object to processing, or to complain to a regulator. Email us and we will do what we can. The honest limit is the same one the interface has: data recorded on a blockchain is outside anyone’s control, including ours, and cannot be edited or erased.

Children

The extension is not for anyone under 18.

Changes

We may update this policy. The date above is the current version, and material changes to what the extension collects will be announced before they take effect.

Contact

Privacy questions and requests: legal@cashcat.io