Privacy Policy: NFT Rewards Calculator

Last updated: October 17, 2026

NFT Rewards Calculator is a browser extension built by a Karbon NFT holder for other Karbon NFT holders. It is an independent, unofficial tool. It is not affiliated with or endorsed by Karbon Collective.

This policy explains what data the extension collects, how it is used, how it is handled and stored, and every party it is shared with.

1. What data the extension collects

1.1 Authentication information

When you open the extension on the Karbon dashboard (nft.karbondx.com) while you are logged in, the extension reads the login session token that the Karbon website has stored in your browser. It reads this token each time it needs it. The extension never asks for, sees or stores your Karbon password.

1.2 Your Karbon account and financial information

Using that session token, the extension requests your own account data from Karbon's servers: your NFT list and purchase dates, NFT values and types, reward and balance history, commission totals, withdrawal records, and the crypto wallet addresses linked to your Karbon account, including earlier ones you have replaced.

1.3 Personal information about you and about people you referred

Your Karbon referral records, as provided by Karbon, can include the names and email addresses of people you referred, along with the dates and amounts of their activity. The extension reads these so it can show your referral earnings.

1.4 Your email address and Telegram username (required to use the extension)

The extension is available by approval only. The first time you open it, it asks for your email address and your Telegram username. You must provide both to request access. The extension cannot be used without them.

Once your access is approved, the extension asks you to confirm your email address on each computer you use it on. A six digit code is emailed to you, and you type it into the extension. Each approved email address can be used on a limited number of computers, set by the developer. When you enter the code, the developer is sent your email address and the name of your browser (for example "Chrome on Mac"), and a random device ID is created for that computer.

1.5 Your IP address and approximate location

The extension looks up the country your internet connection is in. To do this, your IP address is sent to a location lookup service (see section 4). The extension keeps only the two letter country code.

1.6 Public blockchain data

The extension requests the public transfer history of your wallet addresses from OpenSea, to find when a Karbon NFT was sold or bought back. To do so it obtains a temporary OpenSea API key. No personal information is sent to obtain that key. Your wallet addresses are sent to OpenSea to make these requests.

1.7 Your settings and notes

Display preferences (text size, filters, currency, the account profile you selected) and any notes you type into the extension.

The extension does not collect your Karbon password, your payment card or bank details, your browsing history, the content of any website other than the Karbon dashboard, or your keystrokes. It contains no analytics, advertising or tracking code.

2. How the data is used

• The session token (1.1) is used only to request your own account data from Karbon, on your behalf, while you are using the extension.
• Your account, financial and referral data (1.2, 1.3) is used only to calculate and display your rewards, growth, projections and referral earnings inside the extension, and to create spreadsheet exports that you choose to download to your own device.
• Your email address and Telegram username (1.4) are used only to decide whether you may use the extension, to confirm that your access is still active, and to contact you about your access request.
• Your country (1.5) is used only to show dates and currency in the format used where you are.
• Your wallet addresses and the OpenSea data (1.2, 1.6) are used only to work out when an NFT was sold or bought back.
• Settings and notes (1.7) are used only to keep the extension the way you left it.

Your data is not used for advertising, is not used to build a profile of you, is not used to assess creditworthiness or for lending, and is not used for any purpose other than the ones listed above.

3. How the data is handled and stored

3.1 Stored on your own device

Your Karbon account, financial and referral data, your wallet addresses and the public transfer history found for them, your settings and notes, your country code, the temporary OpenSea key, and the email address and Telegram username you entered are stored in the extension's local storage (chrome.storage.local) inside your own browser. They stay on your device. This data is not sent to the developer.

3.2 Never stored

The Karbon session token is read when needed and is not saved by the extension. Your IP address is not stored by the extension.

3.3 Stored by the developer

Only your email address, your Telegram username, the date of your request, your approval status, whether you have confirmed your email address, and for each computer you have unlocked a random device ID, your browser name and the dates it was added and last used are stored by the developer. They are kept in a private Google Sheet in the developer's Google account, written through a Google Apps Script web app that the developer operates. Only the developer has access to that sheet.

3.4 How long data is kept

• Data on your device stays until you remove the extension or clear the extension's data in your browser. Either action deletes all of it.
• The country code is refreshed about once an hour. The OpenSea key expires after about one week and is replaced.
• Your email address, Telegram username, approval status and device records are kept in the developer's access list for as long as you have access to the extension. If you ask for them to be removed, they are deleted within 30 days, and your access ends.

3.5 Security

All requests the extension makes are sent over encrypted HTTPS connections. The developer's access list is protected by the developer's Google account sign-in.

3.6 How the access check works

After you submit the access request, the extension sends your email address to the developer's Google Apps Script web app about once a day, when you open the extension, to confirm that your access has not been withdrawn. It also sends the device ID for that computer, so the developer can confirm the computer was unlocked with an emailed code. The sign-in code itself is sent from the developer's Gmail account through Google and expires after 10 minutes.

4. Who the data is shared with

The extension sends data to the following parties, and to no one else.

• Karbon (nft.karbondx.com). The extension sends your Karbon session token back to Karbon's own servers to request your own account data. This is the same information Karbon already holds about you.
• The developer of this extension, through Google Apps Script and Google Sheets (script.google.com), operated by Google LLC. Receives your email address, Telegram username, browser name and device ID, and sends your sign-in code email, as described in sections 1.4, 3.3 and 3.6. Google processes this data as the provider of the service the developer uses.
• ipwho.is. Receives your IP address in order to return your country. No other data is sent.
• OpenSea (api.opensea.io), operated by Ozone Networks, Inc. Receives the crypto wallet addresses linked to your Karbon account, in order to return their public transfer history on the blockchain. Wallet addresses are public blockchain identifiers. As with any internet request, OpenSea can see your IP address. No other account data is sent.
• Kraken (api.kraken.com) and CoinGecko (api.coingecko.com). Receive requests for the current public market rate of USDC, used to show amounts in other currencies. As with any internet request, they can see your IP address. No account or personal data is sent.

Apart from the wallet addresses sent to OpenSea as described above, your Karbon account data, your financial data and the personal information of people you referred are not sent to the developer or to any party other than Karbon itself.

No data is sold. No data is transferred to data brokers, advertisers or any other third party. Data is not shared with anyone for any purpose other than those described in this policy, except where required by law.

5. Limited use

The use of information received by this extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the single purpose of the extension, which is to show Karbon NFT holders their own rewards. Humans do not read your account data. The developer can read only the email address and Telegram username you submitted in the access request.

6. Your choices

• To delete everything stored on your device, remove the extension from your browser.
• To have your email address and Telegram username removed from the developer's access list, or to ask what is held about you, contact the developer using the details below.
• You can decline to provide your email address and Telegram username. In that case the extension cannot be used.

7. Children

The extension is intended for adults who hold Karbon NFTs. It is not directed at children and does not knowingly collect data from them.

8. Changes to this policy

If this policy changes, the new version will be published at this address with a new "Last updated" date.

9. Contact

Tuan Van Dang

Email: tvandang@gmail.com