Script Safety & Transparency

A full breakdown of what the StakeClaimer userscript does, what it accesses, and how your data is handled.

Script Permissions

Tampermonkey scripts declare permissions via @grant directives. Here's exactly what StakeClaimer requests and why:

Permission	Purpose
GM_xmlhttpRequest	Makes network requests from the script. Used to connect to our WebSocket relay server for live code drops and to check your subscription status. Without this, the script cannot receive codes.
GM_getValue	Reads locally stored settings and claim history from your browser's Tampermonkey storage. Used to remember your preferences and track claimed codes across sessions.
GM_setValue	Saves settings, claim history, and subscription data to your browser's local Tampermonkey storage. This data never leaves your device.
GM_openInTab	Opens claim URLs in a background tab so codes are submitted automatically without interrupting your browsing.
GM_addStyle	Injects CSS to display the HUD bar, status indicator, and settings panel on the Stake.com page. Purely cosmetic — no tracking or data collection.
unsafeWindow	Allows the script to access the page's JavaScript context. Needed to interact with Stake.com's internal UI elements (like the reload claim button) and to read page data such as your logged-in username. This is a standard Tampermonkey permission for scripts that interact with page functionality.

What Data the Script Accesses

Your Stake.com session token — Read from the page's JavaScript context to make authenticated API calls to Stake.com. This token never leaves your browser.
Your Stake.com username — Extracted from the page UI to identify your account. Sent to our server once to verify your subscription status.
UI elements on the Stake page — Such as the reload claim button, balance display, and notification areas. Used to detect available claims and display the HUD overlay.
Claim URLs and code values — Received from our relay server and opened in background tabs to submit claims on Stake.com.

What Data is Sent to Our Server

The only piece of personal data sent to our server is your Stake username, and only to verify that your account has an active subscription. We do not receive or request your password, 2FA codes, wallet addresses, private keys, email address, or any other sensitive information.

During normal operation, the script connects to our WebSocket relay to receive code drops. This connection is inbound only — your browser subscribes to receive codes, it does not upload data. The server logs connection metadata (IP address, connection time) for operational purposes, which is standard for any WebSocket service.

What Data is Stored Locally

Claim history — A record of codes your account has successfully claimed (or attempted to claim). Stored in your browser's Tampermonkey storage. Useful for tracking earnings and debugging.
User settings — Your preferences such as notification sounds, claim intervals, multi-account configuration, and UI options. All local.
Subscription status — A cached copy of your subscription expiry date, so the script can work even if the server is temporarily unreachable.

You can clear all locally stored data at any time by opening Tampermonkey's dashboard, finding StakeClaimer, and clicking the storage tab to delete values.

🛡 We never see your Stake password, private keys, or wallet info.

StakeClaimer does not ask for, access, or transmit your Stake.com password, 2FA codes, wallet addresses, private keys, seed phrases, or any cryptocurrency holdings. You log into Stake.com normally — the script only interacts with the page you're already logged into.

💻 The script runs in your browser. Your Stake session stays on your device.

All interactions with Stake.com happen directly between your browser and Stake's servers. The script does not proxy, intercept, or relay your authenticated traffic through any third party. Your session tokens are never exposed to our infrastructure.

Open Source & Code Review

The script is obfuscated to protect our proprietary code and prevent unauthorized copying. The obfuscation is for code protection, not to hide malicious functionality. The script only communicates with Stake.com and our relay server at stakeclaimer.world — no other domains.