Tokomask

───────────────────────────────────────
WHAT TOKOMASK DOES
───────────────────────────────────────

🔐 WALLET MANAGEMENT
- Create a new HD wallet secured by a 12-word seed phrase (BIP-39 / BIP-44 standard)
- Import any existing wallet using a seed phrase or private key
- Manage multiple accounts from a single seed
- Export and back up your private keys (password-protected)

🌐 DEFAULT NETWORK — CLUBMOS (Chain ID 2255)
TokoMask ships with Clubmos as the default network — a high-performance EVM chain with native token CMX. A matching testnet (Chain ID 1166) is also built in for developers. You can add any custom EVM network at any time in Settings → Networks.

⛓️ MULTI-CHAIN EVM SUPPORT
TokoMask works with any EVM-compatible blockchain. Clubmos is the built-in default, and you can connect to other EVM networks or add your own — just enter the RPC details in Settings → Networks. Switching networks takes one tap, and testnets are supported alongside mainnets for development.

💸 SENDING & RECEIVING
- Send native tokens and ERC-20 tokens on any supported chain
- View your wallet address and QR code for receiving
- Real-time balance display using the configured RPC endpoint
- Gas fee estimation before confirming

🔌 dAPP CONNECTIVITY
TokoMask injects a standard window.ethereum provider (EIP-1193) into every web page, making it compatible with thousands of decentralized applications without any additional setup. It also announces itself via EIP-6963, the modern multi-wallet detection standard, so it appears in wallet selectors in apps built with RainbowKit, Web3Modal, ConnectKit, and others.

✅ TRANSACTION APPROVAL
- Every transaction, message signing, and dApp connection request requires explicit user approval
- Balance change preview before you sign
- Clear display of the target contract address and chain
- One-tap reject on any request

⚙️ SETTINGS
- Add and manage custom networks
- View and revoke per-site connection permissions (Settings → Connected Sites)
- Configure auto-lock timeout (default: 15 minutes)
- Switch between multiple accounts

───────────────────────────────────────
SECURITY MODEL
───────────────────────────────────────

- AES-256-GCM encryption with PBKDF2 (600,000 iterations) protects your vault at rest
- Your encrypted vault is stored only in Chrome's local extension storage — never uploaded anywhere
- Private keys never leave the extension service worker; the UI only ever handles your public address
- Auto-lock after inactivity protects you if you step away from your computer
- Strict Content Security Policy: no remote code, no eval(), no inline scripts
- Zero telemetry: the only outbound network calls TokoMask makes are to the RPC endpoints you configure

───────────────────────────────────────
SELF-CUSTODY — YOU OWN YOUR KEYS
───────────────────────────────────────

TokoMask is non-custodial. There is no TokoMask server, no account registration, no email address required. Your seed phrase is the only backup. If you lose it, no one — including the TokoMask team — can recover your wallet. Write it down and store it offline.

───────────────────────────────────────
OPEN SOURCE & AUDITABLE
───────────────────────────────────────

TokoMask is built on audited cryptographic libraries:
- @scure/bip39 and @scure/bip32 for HD wallet derivation
- @noble/secp256k1 for elliptic curve operations
- @metamask/browser-passworder for AES-256-GCM vault encryption
- viem and ethers for EVM chain interaction

The extension uses Manifest Version 3 (MV3), the most secure Chrome extension platform available.

───────────────────────────────────────
PRIVACY — ZERO DATA COLLECTION
───────────────────────────────────────

TokoMask collects no personal data. There is no analytics, no crash reporting, no usage tracking. The extension does not communicate with any TokoMask-operated server. The full privacy policy is available at https://tokomask.com/privacy.