SQ-W01
WALLET PRIVACY FILE
MetaMask
A self-custody wallet whose MetaMetrics, RPC and security-simulation paths make privacy depend on configuration and transaction context.
- REVIEW DATE
- STATUS
- partially verified
- CONFIDENCE
- medium
Written by SignalQuoin Editorial TeamIndependently reviewed by SignalQuoin Review TeamPublished by SignalQuoin Team
EDITORIAL ASSESSMENT
MetaMask is not accurately described as either private or data-free. It keeps transaction authority with the user, while optional telemetry, provider-assisted recovery and security integrations create observable paths that should be mapped per configuration.
- MetaMetrics controls are publicly documented
- Recovery models are explained
- Public repositories and scoped security assessments exist
- No fresh-profile packet capture yet
- New social onboarding changes dependency assumptions
- Open repositories do not prove complete binary reproducibility
CLAIM → EVIDENCE → LIMIT / 5
The privacy ledger
Authority is local
- CLAIM UNDER REVIEW
- MetaMask is self-custodial, so transaction authorisation remains with the user's wallet setup.
- EVIDENCE FOUND
- MetaMask's guide distinguishes password, private key and recovery material.
- DO NOT INFER
- Self-custody does not mean no servers, RPC providers or malicious signing risk.
Sources: MetaMask is a self-custodial wallet ↗ · Recovery phrases, passwords and private keys ↗
MetaMetrics linkability
- CLAIM UNDER REVIEW
- Selected product events may be associated with wallet addresses or transaction hashes.
- EVIDENCE FOUND
- The MetaMetrics guide describes collected event types and user settings.
- DO NOT INFER
- The guide does not by itself prove what a particular version transmits under every configuration.
Sources: Manage MetaMetrics settings ↗
Security simulation
- CLAIM UNDER REVIEW
- Transaction protection can add a request path to MetaMask or Blockaid services.
- EVIDENCE FOUND
- MetaMask documents its security programme and related protective services.
- DO NOT INFER
- Added simulation may improve warnings but cannot guarantee detection or data minimisation.
Sources: MetaMask Security Program ↗ · Manage MetaMetrics settings ↗
Swap visibility
- CLAIM UNDER REVIEW
- Integrated swaps reveal transaction intent to the routing environment and add a stated service fee.
- EVIDENCE FOUND
- The Swaps guide describes routing and a 0.875% MetaMask fee as reviewed on 15 August 2026.
- DO NOT INFER
- Gasless does not mean private or free, and route behaviour still needs direct observation.
Sources: MetaMask Swaps guide ↗
Source versus shipped build
- CLAIM UNDER REVIEW
- Public code improves scrutiny but cannot alone establish the privacy of a store-distributed binary.
- EVIDENCE FOUND
- The extension repository exposes source and release history under its current licence terms.
- DO NOT INFER
- Repository access is not proof of reproducible builds, complete audit coverage or permissive licensing.
Sources: MetaMask extension repository ↗
EXPERT PRIVACY REVIEW / 8 FLOWS
From identity edge to revision trigger.
MetaMask extension/mobile/Portfolio analytics, traditional and social recovery, RPC and integrated swap permissions. Every dapp and embedded provider remains its own data controller or recipient question.
Users prepared to manage approvals, recovery material, RPC exposure and MetaMetrics settings deliberately.
Users who equate local keys with anonymity, ignore approvals and RPC metadata, or cannot manage analytics and recovery settings deliberately.
MetaMetrics controls are publicly documented
Trust Wallet documents a different privacy controller and device-data model; a hardware wallet changes key exposure but not RPC, dapp or public-chain observability.
IDENTITY / AUTHORITY BOUNDARY
Traditional self-custody need not begin with civil identity, yet wallet addresses and transaction hashes are durable public identifiers. Social login and MetaMetrics can add account and analytics linkage.
- 01
Create two empty wallets—traditional SRP and social login—then compare MetaMetrics defaults, network requests, one benign approval and a clean-device recovery rehearsal.
- 02
Analytics choice: Onboarding → MetaMetrics default/choice → feature event → opt out/delete
- 03
Social recovery: Social account + password → encrypted shard retrieval → wallet recovery
- 04
Alternative path: Trust Wallet documents a different privacy controller and device-data model; a hardware wallet changes key exposure but not RPC, dapp or public-chain observability.
| FLOW QUESTION | BOUNDED FINDING | PROOF STATE | VERIFICATION PLANNED |
|---|---|---|---|
| Is civil identity required? | Traditional wallet creation can be pseudonymous, while social-login recovery introduces a Google, Apple or Telegram account dependency. MetaMask is a self-custodial wallet ↗Recovery phrases, passwords and private keys ↗ | SUPPORTED RECORD | Compare onboarding fields and defaults for both empty-wallet paths. |
| Who can sign or recover? | The user controls signing. Traditional SRP loss is not recoverable by support; social recovery shards encrypted material across servers and requires account plus password. MetaMask is a self-custodial wallet ↗Recovery phrases, passwords and private keys ↗ | SUPPORTED RECORD | Rehearse both recovery paths on clean devices with no assets. |
| What can MetaMetrics link? | Segment and Mixpanel receive selected events when participating; some actions can be associated with addresses or transaction hashes. Defaults differ by onboarding method. | SUPPORTED RECORD | Observe destinations and event classes with analytics on and off. |
| What does a signature disclose? | Dapp connections, approvals and signed transactions reveal addresses and intent to sites, RPCs and public networks even when no KYC exists. | PARTIAL RECORD | Use a benign contract to compare requested permissions, decoded intent and later revocation. |
| Does open source prove the delivered build? | The repository aids auditability but does not by itself bind a store binary to a reviewed commit. | PARTIAL RECORD | Record version, signature and any published build provenance. |
| What privacy cost comes with swaps? | Integrated swap routing introduces quote providers and public transaction data in addition to service and network costs. | PARTIAL RECORD | Map provider requests and quote identifiers without sending a material transaction. |
| Can deletion erase on-chain data? | Analytics deletion can address provider-held data; it cannot erase public blockchain history or data independently held by dapps. | PARTIAL RECORD | Test analytics deletion with synthetic data and document scope and timing. |
| Which defaults can change the verdict? | Analytics participation, RPC, simulation and recovery defaults can change between versions and onboarding methods. Manage MetaMetrics settings ↗MetaMask extension repository ↗ | SUPPORTED RECORD | Diff clean-install defaults on each substantive release. |
| SCENARIO | SEQUENCE | DATA DISCLOSED | OPEN QUESTION |
|---|---|---|---|
| Analytics choice | Onboarding → MetaMetrics default/choice → feature event → opt out/delete | Usage events and potentially linked public addresses or transaction hashes when participating. | What is sent before consent or opt-out, and what is deleted from each recipient? |
| Social recovery | Social account + password → encrypted shard retrieval → wallet recovery | Social-account identifier, recovery requests and encrypted shard operations. MetaMask is a self-custodial wallet ↗Recovery phrases, passwords and private keys ↗ | Which servers, retention, rate limits and account-loss remedies govern the path? |
Use empty wallets and packet-level destination observation without intercepting secrets. Record version, onboarding choice, analytics setting, RPC, permission, address/hash linkage, recovery dependency and deletion control.
High for the current official self-custody and MetaMetrics disclosures; medium for repository visibility; insufficient for shipped-build equivalence, actual endpoint behaviour and social-recovery failure handling.
- MetaMetrics defaults, recipients or deletion controls change.
- Recovery architecture or cloud/server allocation changes.
- Observed builds or network traces materially contradict the disclosed flow.
CHANGE / REVISION TRAIL
Rechecked self-custody and MetaMetrics guidance; added onboarding-default, deletion and social-recovery scenarios.
Opened the telemetry and recovery dossier.
MetaMetrics defaults, recipients or deletion controls change.
DECISION FAQ
Are private keys sent to MetaMetrics?
The cited disclosure says private keys and recovery phrases are not collected.
Does opting out erase blockchain data?
No. Provider analytics and immutable public-chain data are different stores.
Was network traffic observed?
Not yet. The disclosure is reviewed; controlled endpoint observation is planned.
What would change this privacy conclusion?
MetaMetrics defaults, recipients or deletion controls change. Recovery architecture or cloud/server allocation changes. Observed builds or network traces materially contradict the disclosed flow.
PRIMARY SOURCE REGISTER
6 records
Source access and applicable scope were recorded on 16 August 2026; records are attributed by class.- productMetaMask is a self-custodial wallet ↗Retrieved 2026-08-16
- productRecovery phrases, passwords and private keys ↗Retrieved 2026-08-16
- privacyManage MetaMetrics settings ↗Retrieved 2026-08-16
- productMetaMask Swaps guide ↗Retrieved 2026-08-16
- codeMetaMask extension repository ↗Retrieved 2026-08-16
- productMetaMask Security Program ↗Retrieved 2026-08-16