Privacy policy: First CA browser extension
Last updated 13 November 2026.
First CA shows the pump.fun coins launched about the posts on your X screen. It reads public chain data. The extension itself never asks for a wallet, a key or a signature.
What the extension sends
- Posts on your screen. For each post on your screen on x.com, the extension sends the post's id, the words of the post (and of a post it quotes, and the title of a link preview in it), and any coin address written in it, to our server so it can find the coins launched about it. It never sends the post's author, your account or anything else on the page. While a new post stays on screen it asks again every second or two, so new coins show up; older posts are asked rarely. To send nothing until you ask, choose "Only when I tap" in Settings, or switch First CA off there. Nothing is sent before your saved settings are read.
- Status. The toolbar button asks our server whether its live feed is running. That request carries nothing about you.
Every request is made without cookies. Like any web request, each one shows your IP address to our server.
What the extension does not collect
Outside the Buy page, it does not read or send your X account, your name, email, messages, who you follow, wallet addresses, balances, cookies, passwords, keys or signatures. It reads nothing on x.com beyond the id and words of posts on your screen and does not run on any other site. It has no analytics and no advertising.
What is stored on your device
Your Settings are kept in Chrome's local extension storage. Answers are kept in the extension's memory for about a second so a post is not asked twice at once. None of this leaves your browser.
The Buy page
When buying is open, each coin in the list has a Buy button. It opens a page on firstca.fun in a small window; the extension sends nothing extra. If you choose to buy there:
- You sign in with your own Solana wallet through Privy (privy.io), our sign in provider. Your wallet signs one message to prove it is yours. Privy keeps your wallet address and sign in record under its own privacy policy. No email, phone or password is asked.
- Our server receives your wallet address, the coin and the amount, checks your Privy sign in, and builds the swap: on the pump.fun curve itself, or through Jupiter (jup.ag) for coins that have left the curve, in which case Jupiter receives your wallet address, the coin and the amount. The server never holds a key and cannot move your funds; your wallet signs and sends every buy.
- We keep counts of buys, not who bought. Your sign in session sits in your browser's storage for that page until you switch wallets.
What our server keeps
The server keeps public chain data about new coins for three hours. The words and ids you send are used in memory to answer and are not stored or written to our logs. To stop one address from flooding the service, the server holds each IP address in memory for about a minute, then forgets it. Our hosting provider keeps standard access logs (IP address, time, the address asked for, never the words sent) for up to 30 days to keep the service running. We do not build profiles, and we never sell or share request data. Market cap and volume come from public sources (the Solana chain and DexScreener): our server asks them about coin addresses only, never about you or the posts you see.
The use of information received from the extension follows the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to show which coins launched about the posts on your screen, is never used for advertising or credit decisions, and is never read by people except to keep the service running or when the law requires it.