Salvage (“Salvage”, “we”, “us”) is a non-custodial recovery protocol for stranded ERC-20 tokens. This page explains what data the app at usesalvage.xyzand the Base App Mini App collect, why, and who it's shared with. We built Salvage to need as little data as possible to work — most of what it touches is already public on-chain.
We do not collect names, email addresses, or physical addresses unless you email us directly. We do not use advertising cookies or ad-tracking pixels.
The Salvage Chrome extension (“Stranded Token Warning”) watches text and textarea fields on every page you visit for a pattern that looks like an EVM address (0x followed by 40 hex characters) as you type or paste. It does not read, store, or transmit anything else you type — only a matched address pattern, and only once one appears.
When a match is found, the extension sends that address to Salvage's own usesalvage.xyzAPI to check whether it has contract code on Ethereum or Base — the same check the scanner on this site performs. The extension's host_permissions are scoped to usesalvage.xyz only, so it cannot send data to, or fetch code from, any other destination. Nothing is sent to third-party analytics, and no browsing history or page content beyond the matched address is ever collected. Address checks may be cached locally in your browser (chrome.storage.session) for up to 10 minutes to avoid redundant checks; this cache is cleared automatically and never leaves your device.
Our hosting and infrastructure providers (Vercel, Alchemy, Etherscan, Supabase) may log standard technical/operational data as part of running their services — things like IP address, request timestamps, and user-agent strings. This is normal infrastructure logging, not something Salvage requests or has special access to beyond what's needed to keep the app running.
Once a recovery claim is registered or settled on-chain, that transaction is part of the public, permanent record of Ethereum or Base — it cannot be edited or deleted by us or by you. Anything we store off-chain (Supabase records backing the finds/claims registry) exists to support that on-chain process and the leaderboard; it is not sold, and it is not used for anything beyond operating Salvage.
You can use most of Salvage's scanning features without connecting a wallet at all. If you'd like an off-chain record we hold (e.g. a find registration) removed from our database, email us and we'll act on it — with the caveat that we can't remove anything already committed on-chain, since no one can.
Salvage is not directed at children under 13, and we do not knowingly collect data from them.
If this policy changes materially, we'll update the date at the top of this page. Continued use of Salvage after a change means you accept the updated policy.
Questions about this policy or your data: gethelp.salvage@gmail.com.