For dApp teams
Find the leak before your users do.
Most teams don't know their analytics script collects wallet addresses. Under the EDPB's July 2026 blockchain guidelines, a wallet address linkable to a person is personal data, and hashing it doesn't change that.
Open your own app
Load the extension, connect a test wallet to your dApp, and click through your main flows: connect, swap, sign in.
See every recipient
The popup lists every company that received the address, where it was hidden, how it was encoded and which script sent it.
Export the evidence
Download a Markdown or JSON report with every finding, ready for your engineers or your data-protection lead.
Evidence report
Not a vibe. A receipt.
Each finding names the request, the field, the encoding and the script responsible, so the fix is obvious: remove the identify call, stop sending the address, or hash nothing at all.
# 0xRay evidence report - Page: https://app.example.xyz - Leaks: 3 (3 exposed, 0 stopped) | Recipient | Where | Encoding | |--------------------|-------|-------------------| | collect.tracker.io | query | plain | | collect.tracker.io | body | base64 → plain | | id.tracker.io | body | sha256(lowercase) | Sent by script: tracker.io/sdk.js Addresses and hashes are redacted.
Try it on the demo dApp first.
A deliberately leaky dApp: watch 0xRay catch a plain, a Base64 and a hashed leak, then block all three.