Privacy & limitations

Monitoring and account sharing

StakeSafe uses the official Nimiq Mini App SDK to request shared account addresses only after you choose Connect Nimiq Pay. Monitoring requests no signature or transaction, and sharing an address does not prove ownership. Alternatively, enter a public mainnet address. We never request private keys, seed phrases or device identifiers.

Optional native staking

Choosing Continue in Nimiq Pay is separate from monitoring. After the data-source consent, Pay signs an account-check message (not a transaction). Its reported public key is converted to an address so StakeSafe can read the account’s balance and staking record and the selected validator’s live status. This response is not independently verified backend authentication or a wallet login. The signature and public key are not persisted or sent to a server. After your action/amount review, StakeSafe can request a new stake, add stake, explicitly change delegation with reactivation of eligible inactive stake, or separately deactivate, retire and withdraw stake. Unstaking steps never advance automatically; native Pay and network rules determine timing and eligibility. No private key leaves Pay; the server never signs or submits a transaction.

Check the selected Pay wallet and staking details

The SDK cannot bind a request to a particular sender. The account reported by Pay may differ from the watched address and could change after preview. The preview identifies the staking owner, not necessarily the funding From address: Pay can spend from its HTLC. Verify the selected Pay wallet, staking identity if shown, mainnet, validator, action, amount and actual fee. Cancel if anything differs or these details cannot be shown. StakeSafe charges no service fee; Pay chooses and must validate the network fee and available funds. The basic address balance is not the Pay wallet total; it can be 0 while HTLC funds exist. StakeSafe marks the wallet spendable total unavailable and does not use the basic balance to limit staking amounts. A hash is not confirmation. Read-only transaction checks match the expected basic sender or HTLC owner proof, staking action/owner and staking record, but remain RPC observations, not independent consensus/finality proofs.

Consent and data sources

Before monitoring or native account checks, you agree to public mainnet queries through /api/rpc to rpc.nimiqwatch.com. Hosting receives connection metadata and the queried address or transaction hash in the body; the RPC receives the query from the gateway. Queries may include watched addresses, the Pay-reported account, delegated/selected validators and transaction hashes. The gateway adds no request-body logging or database writes; operational platform logs follow the hosting provider’s policy. Monitoring balance may also be read through Pay. Other shared addresses are not queried automatically. Directory data comes from validators-api-main.je-cf9.workers.dev; its operator receives ordinary connection metadata. Search/filtering are local.

What stays on this device

Remember this address saves the selected public address and RPC/mainnet consent in local storage, not wallet authentication. Reload resumes read-only checks without another account-sharing prompt. Shared account lists, monitoring balances and up to 100 check events stay in tab memory and clear on reload. Theme and alert preferences are local.

Before requesting a native transaction, StakeSafe separately saves a public attempt record: Pay-reported account, validator address/name, action, amount, prior stake total and (for unstaking) baseline active/inactive/retired balances and intended active balance, time, status and optional transaction hash. This duplicate-request guard is saved even when Remember this address is off. It survives reload and ambiguous errors. When you explicitly begin another staking action, a read-only receipt check can release a matching mined request with a known execution outcome; an explicit native permission cancellation can also be released. This only opens a fresh review, never replays the old transaction. Pending, unavailable, mismatched or hashless-unknown outcomes remain blocked until resolved and explicitly cleared. A pending notice exposes these public financial details on this device; avoid shared devices. Disconnect & forget removes the monitoring address, not this separate guard. Clearing the record/site storage does not cancel a transaction and removes duplicate protection. No guarantee is made across devices or cleared storage. Never blindly repeat a pending or unknown request.

Profile

Profile shows the monitored staking owner and source-reported active, inactive and retired balances. Its total includes retired funds held in staking, not wallet spendable funds. Validator names are directory metadata matched by chain address; missing names remain unavailable. Use my Pay staking account is a separate read-only account-check message with optional public-address remembering. Every native profile shortcut checks the current Pay account against the displayed owner; a monitored public address does not authorize a transaction.

Limits and validator information

Monitoring runs every 60 seconds only while visible. No background monitoring, push/email/Telegram alerts, guaranteed delivery, returns, safety scores or guaranteed transaction execution. Failed reads retain labeled last-known values, never fake zero. Validator metadata and fee/payout terms may be stale or operator-supplied; listings are not endorsements. Flags are source observations, and historical jail markers do not prove current jail. Unstaking and validator changes can involve waiting and protocol restrictions. Never transfer NIM directly to a validator address.

Hosting, links and testing

No analytics, ads or marketing trackers are added. Optional external links are separately operated; opening the separate web wallet is not required for native Pay staking. Clipboard access is only used on Copy. StakeSafe is independent, not an official Nimiq service. SDK behavior is tested with simulated hosts; physical-device approval, final native transaction details and WebView behavior still require testing. Automated tests do not submit real transactions.

Questions and security reports

Public issue tracker: onad1ocrypto/stakesafe/issues. The owner still needs to enable GitHub private vulnerability reporting. Never post keys, seed phrases, personal information or sensitive security details publicly.