Privacy · P1

Telemetry, analytics, and error-reporting SDKs

Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting?

Why it matters

Analytics in a payment widget sends your customers' browsing and payment behaviour to a third party you have no contract with. It is also an undisclosed data-processing relationship for most compliance regimes.

A score of 3 needs evidence naming the distributed package (name, version and integrity hash) or a network trace, not only source code in a repository.

The top score rewards the absence of a problem. It is only available when every required component in the request path is public, or a network trace covers the closed parts.

Scoring anchors

3 Strong	None in SDK, widget, or frontend manifests and lockfiles, confirmed by trace.
2 Partial	Present, off by default, opt-in visible in code.
1 Weak	Present, on by default, disclosed in docs.
0 Fails	Present and undisclosed, or fingerprinting libraries present.
No evidence	No admissible evidence submitted yet. Counts as 0 in the pillar.

Admissible evidence

package.json, lockfile, and initialization code at a pinned commit verified
Network trace from a running instance documented (trace)

Common failures

Sentry or PostHog initialised in the hosted frontend but not in the SDK; score covers both.

Current ratings

Provider	Score	Finding
Aleo (credits.aleo private transfers)	2 Partial	The SDK, CLI and node ship no third-party analytics. The SDK's demo website imports Amplitude, but its init call is commented out, and the website is not on the payment path. The closed consumer wallets were not inspected. Judgment call: absence shown in code and the published package, with no trace, is capped at 2.
AnomaPay	No evidence	No admissible evidence yet.
Avalanche Card	1 Weak	Analytics and advertising SDKs are disclosed in the policy. The app is closed and no trace was run, so their presence and default state are not confirmed. Judgment call: disclosed in policy, so 1 (the documented cap).
Avici Card	1 Weak	Analytics and error reporting are disclosed in the policy. The app is closed and no trace was run, so presence and default state are unconfirmed. Documented cap, so 1.
Aztec (Alpha mainnet private token transfers)	2 Partial	The client libraries ship no analytics or telemetry. Third-party browser wallets were not inspected. Judgment call: absence shown in code and the published package, without a trace, is capped at 2.
Bitget Wallet Card	1 Weak	Analytics is disclosed by Fiat24 (Google Analytics, Tag Manager) and by Bitget Wallet (unnamed). Neither app was traced. Documented cap, so 1.
Blanksquare (Shielder)	1 Weak	The SDK has no analytics dependency. The apps ship PostHog on by default, disclosed in the privacy policy. Scored 1; the closed live builds were not inspected.
COCA Card	1 Weak	Tracking is disclosed in the policy without vendors. The app was not inspected and no trace was run. Documented cap, so 1.
Coinbase Commerce (Onchain Payment Protocol)	1 Weak	Telemetry is on by default in both payment frontends. The SDK checkout sends the payer's address and amount to Coinbase's analytics endpoint unless the integrator sets analytics to false. The hosted checkout bundles Amplitude, Sprig (which includes session-replay code), Bugsnag and Coinbase's own analytics service. The privacy policy discloses analytics providers only by category. Judgment call: we score 1 and not 0, following the Daimo precedent: the policy disclosure covers analytics in general, even though it names no vendor. We found no fingerprinting library; the "fingerprint" matches are Bugsnag ID helpers and icon names.
Curvy	1 Weak	The public SDK ships no analytics. The web app is closed, and the policy discloses basic analytics on the site and app. Scored 1: present and disclosed in policy, and the app code cannot be inspected.
Daimo Pay	1 Weak	The SDK has no third-party analytics package, but it does ship first-party UI telemetry. That telemetry is on by default and sends navigation steps, amounts, copied addresses, and errors to Daimo's API. The privacy notice discloses analytics in general terms, which fits anchor 1. We did not review Privy's transitive dependencies or the hosted daimo.com flow, because the lockfile is stale and no trace was run. Without a trace this cell cannot reach 3.
Deblock Card	No evidence	No admissible evidence yet.
Ethena Pay	No evidence	No admissible evidence yet.
ether.fi Cash	0 Fails	The app and web frontend are closed, so their manifests cannot be inspected. The provider's own privacy policy, however, discloses device fingerprinting and behavioural biometrics. The anchor puts fingerprinting at 0 whether disclosed or not. No trace was run.
Exa Card	1 Weak	Analytics (Segment, keyed to the wallet address) and error reporting (Sentry) are on by default, with no opt-in in code. The privacy policy discloses analytics in general terms. Present, on by default, disclosed, so 1.
Fluidkey	No evidence	The app is closed and we ran no trace. The privacy policy mentions consent-based usage analysis, which does not show whether analytics is on by default.
Fuse Card	1 Weak	Analytics are disclosed in the policy. The app is closed and no trace was run, so presence and defaults cannot be checked in code. Judgment call: disclosed, so 1.
Gnosis Pay	1 Weak	A third-party support widget (Pylon) is on by default in the web app and receives identity plus the Safe address; the privacy policy discloses analytics (Google) and support partners. No analytics or error-reporting SDK appears in the frontend manifest. No trace was run, so what the Pylon script collects at runtime is unconfirmed. Judgment call: Pylon is a support SDK, not analytics, but it is a third-party script loaded on every page; treated as present, on by default and disclosed generically, so 1.
HesabPay	1 Weak	Google Analytics loads by default on hesab.com and the privacy policy discloses analytics in general terms without naming Google. Google reCAPTCHA also loads on the page and is not named in the policy. The mobile app and web.hesab.com were not inspected at a pinned source, so the score covers the website plus the policy. Judgment call: 1 (present, on by default, disclosed) rather than 0, because analytics collection is disclosed even though the vendor is not named.
Hinkal	1 Weak	The apps run Google Analytics, Microsoft Clarity session replay and RB2B, disclosed and gated by consent according to the policy. The frontends are closed, so the gate could not be checked in code. The SDK also reports each deposit to Hinkal's data server by default, and the policy does not describe that. Judgment call: analytics are present and disclosed in policy, so we score 1. The undisclosed SDK deposit report would support 0, but it is first-party and covers deposits that are already public onchain.
Holyheld Card	1 Weak	The SDK ships no third-party analytics library in its dependencies, but it sends first-party audit telemetry (wallet address, transfer data) to Holyheld on by default. The Holyheld app is closed and the privacy policy discloses cookies and tracking. Present, on by default, disclosed in docs, so 1.
Houdini Swap	1 Weak	Analytics run in the web app by default, and this is disclosed in docs and the privacy notice. Houdini states they are self-hosted. The web app could not be inspected: houdiniswap.com answers curl with a Cloudflare challenge, which we did not bypass, and no trace was run. Which SDKs ship, and whether they can be switched off, is not known. Documented only, so 1.
Hyperbeat Card	0 Fails	The Pay web app ships Google Ads tagging, Datadog browser monitoring and Intercom. The privacy policy mentions analytics providers only as a category and does not disclose advertising tags. Judgment call: present and not specifically disclosed, so 0. No network trace was run; this rests on the served page and bundles.
Jupiter Card	No evidence	No admissible evidence yet.
M-Pesa	No evidence	No admissible evidence yet.
MetaMask Card	1 Weak	Analytics (MetaMetrics) and error reporting (Sentry) ship in the app and are consent-gated, but a forced Sentry path reports critical errors before consent. The Baanx-hosted KYC and web dashboard were not inspected, and no trace was run. Judgment call: mostly opt-in (2), but the forced pre-consent path and the unseen hosted flows put this between anchors, so I took the lower one, 1.
Opera MiniPay	1 Weak	An attribution/analytics SDK (AppsFlyer) and Firebase messaging are in the app, disclosed in the privacy statement. Whether they are on by default, and what they send, could not be checked: the app is closed and no trace was run.
Monero	2 Partial	We found no analytics, telemetry or crash-reporting SDK in the node, CLI or GUI. The node's default update check is a DNS lookup, counted under P4. We ran no trace. Judgment call: absence shown only in code is capped at 2.
Nullmask	No evidence	No admissible evidence yet.
Oobit Card	1 Weak	Automated tracking is disclosed in the policy. The app is closed and no trace was run. Judgment call: disclosed, presumed on by default, so 1.
Payy Card	1 Weak	The policy discloses diagnostics and performance collection. The app source is closed, so the SDKs in use and their defaults cannot be checked, and no trace was run. Judgment call: disclosed and presumed on by default, so 1. It could be 0 if the app ships undisclosed SDKs, which I cannot see.
Phantom Cash	1 Weak	Analytics is present, on by default and disclosed in the policy. The app is closed and no trace was run. 1.
Plasma One	1 Weak	Analytics is present and disclosed in the privacy policy. The app is closed, so whether it is on by default or opt-in cannot be checked in code. Judgment call: disclosed analytics with no code to show opt-in is anchor 1.
Privacy Pools (0xbow)	1 Weak	The SDK has no analytics. The website loads Google Analytics on every page by default, and Sentry error reporting, sanitised and with tracing and replay off. The privacy policy discloses automated collection. Scored 1: present, on by default, disclosed.
Railgun	0 Fails	The SDK ships no analytics or telemetry. Railway desktop includes a fingerprinting library; in the code we read it is used locally to derive an encryption key, and we saw no network send. Judgment call: the anchor names fingerprinting libraries as 0 regardless of use, so we take 0; on the SDK alone this cell would score higher.
Request Network	1 Weak	The SDK ships no analytics or telemetry. Both reference frontends ship Google Tag Manager. With an ID configured, GTM runs full tag-manager analytics, which is opt-in and visible in code. Without an ID, the script tag still loads from googletagmanager.com on every page, so Google sees each visitor's IP and page. The README presents the GTM ID as optional, and nothing tells end users. Request's own hosted apps disclose analytics in the privacy policy. Judgment call: between 2 (opt-in) and 1 we take 1, because the template calls Google by default. No trace was run, so this cell cannot reach 3.
Rizon Card	No evidence	No admissible evidence yet.
SafePal Card	1 Weak	Analytics is disclosed for Fiat24's web surfaces. The SafePal app, where SafePal users manage the card, is closed and was not traced, and SafePal's own privacy policy names no analytics vendor. Documented cap, so 1.
Solayer Card (Emerald Card / Solayer Pay)	No evidence	No admissible evidence yet.
Tongo (confidential ERC-20 on Starknet)	2 Partial	The SDK ships no telemetry. The demo frontend is closed and was not inspected, and no trace was run. Judgment call: absence shown only in code is capped at 2.
Tornado Cash (Classic pools)	2 Partial	The archived UI and the core client ship no analytics or telemetry. When a remote RPC is used, tornado-cli calls ip.tornado.cash to show the user's IP; that call is counted under P4. We ran no trace and did not inspect the live IPFS build. Judgment call: absence shown only in code is capped at 2.
Tria	1 Weak	Analytics and advertising trackers are disclosed in the privacy policy; the app is closed, so default state cannot be checked. Judgment call: disclosed in docs, so 1.
Tuyo Card	1 Weak	Analytics are disclosed but the vendors are not named. The app is closed and no trace was run. 1.
Umbra Cash	2 Partial	The SDK and frontend ship no analytics or telemetry. Judgment call: absence shown only in code, with no package for the current SDK and no trace, is capped at 2.
Wirex One	1 Weak	Error reporting, product analytics and tag management are on by default in the web app. The privacy policy discloses analytics only by category. Judgment call: category-level disclosure counts as "disclosed in docs" (1) rather than undisclosed (0); no trace was run.
Wise	1 Weak	Analytics and advertising tracking in the website and app are disclosed in the privacy notice. Which SDKs ship, and whether they are on by default, was not checked: the app is closed and no trace was run.
WORM (BETH proof-of-burn)	2 Partial	Neither the frontend nor the Rust CLI ships an analytics or error-reporting SDK. The wallet-connector libraries may send their own connection telemetry; we did not assess that, and we ran no trace. Judgment call: absence shown only in code is capped at 2.
XPlace Card	1 Weak	Analytics is disclosed in the policies. The app is closed and no trace was run. Judgment call: disclosed and presumed on by default, so 1.
Zcash (shielded transfers)	2 Partial	The reference mobile wallet's store build includes Firebase Crashlytics, off by default and enabled only through an opt-in screen; the FOSS build has none. Zebra and Zallet are server software with no analytics SDK found. We ran no trace and did not inspect the iOS app in the same depth. Scored 2: present, off by default, opt-in visible in code.
zERC20 (zBNB on BNB Chain)	1 Weak	Neither the served app bundle nor the SDK package contains analytics; the app explicitly disables Reown's analytics. The app source is not public, and the SDK is published only as compiled npm output, so this rests on documented-tier reads of build artefacts. No trace was run. Judgment call: the substance fits 2 or 3, but without verified or trace evidence the documented cap applies, so 1.