Yap SignerSelf-custodial wallet

Looking for Signer

Chrome Web StoreWe're live
Install

81installs

Yap Signer

Privacy policy

Last updated: October 24, 2026

Yap Signer is a Chrome extension. https://yap-pay.xyz is the website. There is no iOS or Android app. A Florida limited liability company operates both. This policy covers the extension and the website. The terms explain how you may use them.

Master wallet

The master wallet is self-custodial. The 24-word phrase and the wallet password stay on the device. The phrase is stored only in an AES-256-GCM vault. The vault key is derived from the wallet password with PBKDF2-SHA256 (600,000 iterations) and bound to the wallet address. Salt, IV, and ciphertext stay on the device as binary encodings. After you unlock, the private key is derived in memory. It is wiped on lock or when the browser restarts. Yap's servers do not receive a seed, a private key, or a wallet password.

Chrome local storage on the device can also hold the wallet address, a balances cache, signing rules, an activity log, and a hash of a platform access token. The plaintext token is shown once in the popup.

Member account

A member account is an email plus an 8-digit code. The code is stored only as a hash, it expires, and it is not returned in the HTTP response. The account password is stored only as a hash. It does not unlock the vault or approve a signature. A forgotten account password can be replaced after an emailed 8-digit code. That code does not reset the signer vault password. A linked wallet is a signature of a message that does not move funds. The account can also store one referral code, credit totals, the public username of the linked wallet, and a record of a purchase or of a swap or send (the asset, the amount, and the public signature).

One code belongs to each member. The desk referral link is a public @username link on yap-pay.xyz. A new install with that code adds 5 credits. An influencer code is remembered on install. It records nothing until a purchase or a Yap Cash deposit is reported. The influencer then gets a slice of Yap's share. Until a partner contract names the real cut, Yap's share is 1% of the order and the influencer's slice is 20% of that share. A $100 order records $1.00 for Yap and $0.20 for the code. paid stays false. Those figures are a worked example. They are not totals, not a leaderboard, and not proof that anyone has been paid. A yearly first-place prize is recorded as some SOL and is not sent. Public referral context: stevenlow.xyz/affiliate. Following another wallet does not grant signing. If you open a ?ref= link, the site may keep that public code in this browser so a later install can still credit the member. The installer id stored for that credit is a random token hash.

Buying crypto

People will buy SOL, ETH, or BTC in the wallet through MoonPay or Stripe. The coins land in their wallet. Yap's revenue on that buy is a share of what MoonPay or Stripe earn. It is not the customer's card payment. MoonPay is under review. Stripe Crypto Onramp is an application in progress. The hosted checkout domain is crypto.link.com. A live card checkout is closed. Yap does not store a bank account, a card number, a CVV, a card expiration date, or a seed. Yap does not credit a balance when a purchase is marked reported. A later sale turns crypto into Yap Cash. A partner ramp deposits that into the customer's bank. Yap records a cash-out bonus on that deposit.

KYC

KYC is opened only for an on-ramp purchase or a custodial agent slot. MoonPay, Stripe, Persona, or Sumsub keeps the name, date of birth, tax id, and images. Yap stores the provider subject id and a status. Self-custodial signing by itself does not open a KYC case.

Custodial records 1 through 500

One master wallet supports custodial wallet records numbered 1 through 500. A new account opens slots 1 through 5. Yap stores the public address and the policy for a slot. Yap does not hold the private key. The address is not derived from the signer phrase. A hold, swap, or trade is stored only after the customer has turned silent mode on for the master wallet and that slot, an approved custodial KYC case exists, and that slot's access code is used. That row is not signed and is not broadcast. The customer can freeze, revoke, or replace a slot from the master wallet.

Marks, quotes, and broadcasts

Sites that can talk to the extension

Yap Signer talks only to allowlisted Yap sites. Those pages can ask for public wallet status and username. They cannot create, import, export, delete, or reset the master wallet, and they cannot change signing rules. Activity logs are not exposed to pages. Silent signatures require the extension to be unlocked, silent mode, a live platform access token presented by the site, and a transaction inspection (fee payer, DEX allowlist, and SOL-out cap).

The in-wallet browser only opens member, desk, buy, and onboarding on yap-pay.xyz. It does not hold a key.

Hosting

https://yap-pay.xyz is served by Vercel. Vercel may process standard request logs such as IP address, user agent, and the requested URL in order to operate the site. This website includes Vercel Analytics for page views. A visible page on yap-pay.xyz also sends a presence ping to stevenlow.xyz so the header globe can count this site as its own channel. That record is a coarse area, kept for six hours. The Yap Signer extension does not include that SDK.

What we do not collect

Contact

Questions about this policy: founder@yap-pay.xyz. Read the terms for how the product may be used.