Moneyness venue overlay, the Chrome extension. Last updated 14 September 2026.
The short version. To show you what a contract trades for elsewhere, the extension has to tell our server which contract you are looking at. That is the only thing it sends. It never sends, and cannot read, your wallet address, your balances, your positions, your orders or your keys.
When you open an option ticket on a supported venue, the extension sends four
fields to moneyness.xyz:
| Field | Example | Why |
|---|---|---|
| underlying | HYPE | These four identify one contract. Without them we cannot look up what the other venues quote for it. |
| expiry | 18 Sep 2026 | |
| strike | 78 | |
| type | put |
Because this is an ordinary web request, our servers also receive what every web server receives: your IP address, the time, and your browser's user agent string. We are naming that explicitly rather than leaving it implied. That reaches Google Cloud Logging, which is where our infrastructure records requests, and is retained there on Google Cloud's default retention.
The four contract fields are not in that log line. They travel in the request body, which is not recorded, so what is retained is that somebody asked, not what they asked about.
storage permission.We answer the request and that is all. The four contract fields are used to query our own public options index and return the result to your browser. We do not build a profile, we do not attach the request to an identity, and we do not sell, rent or share this data with anyone.
The same query is available to anyone without installing anything:
curl "https://moneyness.xyz/api/chain?underlying=HYPE&expiry_ts=1789718400"
The extension contains no analytics, no tracking pixel and no third party script. The moneyness.xyz website does use Google Analytics and Microsoft Clarity, and this policy does not cover the website. It covers the extension, which loads neither.
Only while you have a supported venue page open and visible. It queries when the contract you are looking at changes, and refreshes once a minute so a quote does not go stale. A hidden or background tab sends nothing.
| Permission | Reason |
|---|---|
host_permissions: https://moneyness.xyz/* |
To fetch the cross venue board. Our API sends no CORS header, so the request must be made from the extension's service worker rather than the page. |
content_scripts on app.paradex.trade and
www.derive.xyz |
To read the contract symbol from the ticket you have open and draw the panel. These are the only sites it runs on. |
There is no permissions array at all. No storage, no tabs, no cookies,
no scripting, no history, no <all_urls>.
Manifest V3 forbids executing remotely hosted code and the extension ships none. The JavaScript you install is the JavaScript that runs, and it cannot be changed without a new version that Chrome updates and you can inspect.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Specifically, data received through the extension is:
That third line is not boilerplate for us. Stormbit Labs also builds credit products. Nothing this extension observes reaches them, now or later.
The contract fields are sent in a POST body, not in a URL or a
header, precisely so they do not appear in web server access logs. The public
GET form of the same endpoint still exists for anyone calling the API
directly, and carries no user data because there is no user.
The extension is a tool for trading venues and is not directed at anyone under 18.
If we ever change what the extension transmits, this page changes first and the date at the top moves. A change that widens what is collected will also require a new version of the extension, which Chrome will show you.
Stormbit Labs Pte. Ltd., Singapore. Write to us through moneyness.xyz.