Rabby Wallet: The Hidden Privacy Features Compared to MetaMask and Phantom

An Ethereum user holding significant balances faces a practical choice: which wallet software truly protects financial activity from observation, and which merely claims privacy while collecting data in the background. MetaMask, the dominant browser extension, has long functioned as a default option despite its ownership by Consensys and documented telemetry practices. Phantom, popular among Solana users but now supporting multiple EVM chains, operates under similar data collection frameworks. Yet a third category exists: open-source self-custodial wallets that operate without corporate infrastructure, maintain source code visibility, and eliminate unnecessary data transmission—a model increasingly represented by alternatives designed specifically for users who want to verify rather than trust.

The difference between these architectures is not academic. When a wallet collects user data—whether IP addresses, transaction patterns, connected addresses, or interaction frequencies—that information becomes a permanent record that can be subpoenaed, breached, sold, or analyzed by third parties. A truly privacy-preserving wallet should minimize what it transmits, allow users to control their own infrastructure choices, and publish its code so that security claims can be independently verified. This comparison examines how Rabby Wallet, a browser-based Ethereum and EVM-compatible wallet, stacks against mainstream alternatives on the specific dimension that matters most: what information leaves your device, and whether you can prove it doesn’t.

MetaMask’s telemetry architecture and what leaves your browser

MetaMask collects a range of data that extends far beyond transaction signing. When a user connects to a decentralized application, approves a transaction, views their balance, or even simply opens the extension, MetaMask transmits events to Consensys infrastructure. The wallet logs feature usage, enabled networks, connected addresses, and timestamps. This telemetry is defended as “anonymized,” but anonymization is imperfect: an observer with contextual knowledge—such as knowing which address a user controls—can often re-identify patterns. MetaMask’s privacy policy discloses that the company collects “information about how you interact with the Services,” which is deliberately broad language.

The company also partners with Infura, a centralized RPC provider owned by Consensys, to relay blockchain queries by default. This means that when a MetaMask user checks their balance, swaps tokens, or views transaction history, Infura sees the IP address making the request and can correlate it with the Ethereum addresses being queried. A user’s IP address, combined with their wallet addresses and transaction patterns, forms a precise profile of financial activity. Consensys has stated that Infura does not log IP addresses indefinitely, but the infrastructure still creates a chokepoint through which most MetaMask traffic flows unless users manually switch to a custom RPC endpoint—a step most users never take.

In practice, MetaMask’s model treats privacy as a secondary feature rather than a foundational design principle. The wallet is engineered for convenience and adoption, with privacy considerations layered on afterward. Users can eventually configure a custom RPC and disable analytics, but these are non-default opt-outs rather than opt-in collection. The burden of privacy falls entirely on the user to understand the settings, remember to change them, and maintain those settings across browser updates. For the vast majority of MetaMask users, the combination of Infura RPC, telemetry collection, and network analysis produces a detailed record of their on-chain behavior held by a corporate entity.

Phantom’s data collection on Ethereum and EVM networks

Phantom began as a Solana-native wallet and has expanded to support Ethereum and other EVM chains, but its data collection framework remains unchanged from its origins. The wallet transmits user preferences, feature usage metrics, and connection data to Phantom’s servers. Like MetaMask, Phantom tracks which applications users connect to, which networks they use, and how often certain features are accessed. The wallet’s privacy policy acknowledges collection of “device identifiers,” “IP addresses,” and “information about your interaction with the wallet.”

Phantom also relies on a combination of default RPC providers, though it has built more granular control into its settings than MetaMask offers. A user can specify a custom RPC endpoint, but the wallet still transmits some metadata to Phantom’s infrastructure. The company has been acquired by Galaxy Digital, a cryptocurrency investment firm, which adds another layer to the ownership structure. Unlike Consensys, which operates primarily as a software company, Galaxy Digital is a financial institution with incentives to analyze user behavior for market intelligence or portfolio optimization.

The practical distinction between Phantom and MetaMask is therefore one of degree rather than kind. Both collect user data by default, both route transactions through corporate-controlled infrastructure, and both make privacy an optional configuration rather than a default property. Phantom may offer slightly more granular network controls, but the fundamental architecture remains: a centralized company operates the servers, controls the default RPC routes, and maintains access to transaction metadata. A user’s privacy depends entirely on remembering to configure settings that most users never discover exist.

Why open-source code matters more than privacy promises

The central weakness of MetaMask and Phantom’s privacy claims is that users must trust the companies’ statements about what the code actually does. When Consensys or Phantom publishes a privacy policy, users have no independent way to verify that the actual software matches the disclosed practices. The code could transmit additional data, maintain longer retention periods, or correlate information in ways not disclosed in public documentation. This is not paranoia; it is a recognition that the only reliable privacy guarantee is one that can be verified by reading the code and understanding its behavior.

A wallet built as open-source software and published on a public repository such as GitHub creates a completely different verification model. Any user, security researcher, or developer can examine the exact code running in the wallet, trace how data flows through the application, and confirm what information is transmitted to external servers. If the code transmits telemetry, that transmission is visible in the source. If the wallet contacts a specific RPC provider by default, that choice is written plainly in the configuration. This transparency does not guarantee perfect privacy—an open-source wallet could still be poorly designed—but it eliminates the possibility of hidden data collection practices.

Open-source wallets also benefit from community scrutiny. When a Rabby Wallet or similar alternative publishes its code, independent security researchers and developers can review it, identify potential improvements, and contribute fixes. This distributed review process has historically caught vulnerabilities that corporate security teams missed. More importantly, it prevents the hidden surveillance that centralized companies might otherwise conduct. If a corporate wallet transmits suspicious data, the company controls the narrative and users must guess whether the practice is legitimate. If an open-source wallet attempts hidden data collection, the code immediately reveals it and the community can fork the project and remove the problematic behavior.

Rabby Wallet’s architecture as a MetaMask alternative

Rabby Wallet is designed from the ground up as a privacy-first alternative to mainstream options. Available as a browser extension for Ethereum and EVM-compatible networks including Arbitrum, Optimism, Polygon, and BNB Smart Chain, Rabby Wallet maintains private keys locally and does not transmit them to external servers. Unlike MetaMask, which relies on Infura by default, Rabby Wallet provides users with granular control over RPC provider selection and allows configuration of custom endpoints without complex navigation. The wallet’s source code is published on GitHub, making its data collection practices—or lack thereof—verifiable by technical users and security researchers.

Rabby Wallet’s privacy architecture specifically addresses the RPC provider problem that affects both MetaMask and Phantom users. By default, the wallet supports multiple RPC options and allows users to specify their own endpoints, including locally-run nodes. This means that a user’s blockchain queries do not necessarily pass through a single corporate chokepoint. When you check your balance or execute a transaction in Rabby Wallet, you control whether that query goes to a public RPC provider, a private endpoint, or your own infrastructure. This choice is available to MetaMask and Phantom users as well, but Rabby makes it the default assumption rather than an obscure setting.

The transaction simulation and human-readable transaction details in Rabby Wallet serve another privacy function beyond security: they reduce the need to query external sources for transaction interpretation. When a user reviews what a transaction will do before signing, they do not need to visit a block explorer or ask an external service to decode the transaction data. This keeps transaction details local rather than transmitting them to third-party analytics platforms. Combined with the open-source codebase, this design philosophy makes rabby wallet meaningfully different from MetaMask not just in privacy promises, but in architectural choices that prevent the data collection problem from occurring in the first place.

Token approval management and what it reveals

One of the least-discussed privacy leaks in Ethereum wallet interactions is token approval transactions. When a user approves a decentralized exchange, lending protocol, or other smart contract to spend their tokens, that approval creates a permanent on-chain record visible to anyone. The approval’s amount, timing, and the specific token contract all become part of Ethereum’s public ledger. However, what happens before and after that approval—the user’s decision-making process, hesitation, rejected approvals, or changes of mind—should remain private.

Mainstream wallets like MetaMask do not meaningfully address this privacy surface. They simply broadcast approvals to the network without giving users detailed visibility into what they are approving or warning them about unusually high allowances. Rabby Wallet’s approach is different: the wallet provides explicit token approval management, showing users what approvals are currently active and allowing revocation of permissions that are no longer needed. More importantly, Rabby Wallet displays the approval amount and contract address in human-readable form, so users can verify exactly what permissions they are granting before signing.

This feature intersects with privacy in a specific way. By understanding and managing approvals locally, users are less likely to accidentally grant excessive permissions due to confusion or social engineering. Fewer accidental approvals mean fewer unnecessary on-chain records created. The privacy benefit is not that the approval itself becomes hidden—it remains public on Ethereum—but that users can make more informed decisions about which approvals to create in the first place. This is a subtle but important distinction: privacy-preserving design often works by reducing unnecessary information creation rather than hiding information that already exists.

Hardware wallet support and the custody verification problem

Both Rabby Wallet and MetaMask support hardware wallets like Ledger and Trezor, which offload private key storage to a physical device. However, the wallet extension still controls what transactions are presented to the hardware wallet for signing. A user with a Ledger connected to MetaMask faces an architectural problem: MetaMask collects telemetry about which addresses are being used, which networks are active, and which applications are connected, even though the private keys themselves remain on the hardware device. The hardware wallet protects against key theft, but MetaMask still observes everything except the signing operation itself.

A privacy-conscious user connecting a hardware wallet to Rabby Wallet gains an additional advantage: the wallet’s open-source code allows verification that no hidden transmission occurs during the connection process. When a hardware wallet is connected to MetaMask, the user must trust MetaMask’s promises that only necessary data is transmitted. When the same hardware wallet is connected to Rabby Wallet, technical users can review the code and confirm the actual data flow. This verification becomes especially important for users managing large balances or conducting business-sensitive transactions where metadata about activity patterns could reveal valuable information to competitors or adversaries.

The hardware wallet integration also highlights another privacy consideration: RPC provider visibility. When a user with a hardware wallet queries Ethereum state—checking balances, viewing transaction history, or broadcasting transactions—that query still depends on an RPC provider’s response. The hardware wallet ensures that only the device owner can authorize transactions, but it does not hide which addresses are being queried or from which IP address the queries originate. A Rabby Wallet user can pair hardware wallet security with privacy-preserving RPC choices, including local nodes or privacy-focused public endpoints. MetaMask defaults to Infura regardless of whether a hardware wallet is connected.

NFT display and metadata privacy

Wallets display NFT metadata—images, collections, floor prices, and ownership information—by querying external services. When MetaMask or Phantom displays your NFT collection, it typically contacts centralized NFT metadata providers that log which addresses are being queried and when. This creates a record of which NFTs you own and when you access them. The NFT image itself may be hosted on a service like IPFS or a centralized CDN, both of which can log access patterns. For users holding NFTs with recognizable value or status significance, these access patterns can reveal wealth information or collection interests to third parties.

Rabby Wallet’s NFT display includes similar functionality but with configurable metadata sources. Users can specify where NFT data is retrieved from, reducing reliance on a single third-party service that sees all their NFT queries. This granular control does not eliminate metadata leakage—the query still happens—but it distributes the information across multiple services rather than concentrating it in a single provider’s logs. More importantly, Rabby Wallet’s open-source codebase allows users to verify that no additional metadata is being collected beyond what is necessary for display. A user can review the code and confirm that the wallet does not transmit their full address portfolio to a marketing analytics service or collect data about which collections they view.

Practical setup and privacy defaults in Rabby Wallet

The operational difference between Rabby Wallet and MetaMask becomes evident during setup. When a new user creates a MetaMask wallet, the extension automatically connects to Infura and begins collecting telemetry. The user has a wallet that works immediately, but it is not a private wallet without explicit configuration. In contrast, when a user first installs Rabby Wallet, they must make conscious choices about RPC providers and network configuration. This creates friction that many users dislike, but it is friction with a purpose: it makes privacy the active choice rather than requiring a privacy-conscious user to perform opt-outs.

For users setting up Rabby Wallet with privacy as a primary concern, the ideal configuration involves running a personal Ethereum node and specifying that node’s RPC endpoint as the primary connection method. This requires technical knowledge and hardware resources, but it eliminates the centralized chokepoint entirely. For less technical users, Rabby Wallet allows specification of privacy-focused public RPC endpoints that do not log IP addresses or collect identifying information. The wallet then rotates queries across multiple endpoints to avoid any single provider seeing a complete picture of activity.

The recovery process also reflects different privacy priorities. MetaMask’s backup and recovery are designed for ease, with options to sync to cloud services and use account recovery flows managed by Consensys. Rabby Wallet emphasizes local backup: the recovery phrase is generated locally and should be written down or stored offline, never uploaded to cloud services. This approach is less convenient but substantially more private, as it ensures that not even the wallet developers have access to recovery information. For users who value privacy over maximum convenience, this trade-off is preferable.

Open-source verification and the limits of privacy audits

The most significant advantage of an open-source wallet is not that it has been audited—many centralized wallets undergo security audits that remain confidential—but that it can be audited continuously by anyone. When a security researcher discovers a potential issue in Rabby Wallet’s code, they can publish their findings and the community can immediately verify the issue or its absence. When the same researcher discovers an issue in MetaMask, they face a responsible disclosure process where Consensys controls whether and how the vulnerability is shared with users. Open-source governance is not perfect, but it eliminates the possibility of hidden vulnerabilities being patched without users’ knowledge.

Privacy in particular benefits from open-source transparency because privacy violations are easy to hide in compiled code but visible in source. A closed-source wallet could transmit private data through multiple obfuscated channels and users would never know. An open-source wallet cannot hide transmission: every network request is visible in the code, and any user with basic technical knowledge can identify what leaves the application. This asymmetry is why corporate wallets often resist open-source publication—not because of legitimate security concerns, which are actually stronger with open-source review, but because hidden data collection becomes impossible to maintain.

Users evaluating Rabby Wallet should understand that open-source code creates accountability but not absolute safety. A wallet with visible code can still have design flaws, configuration issues, or user errors that compromise privacy. The difference is that these problems are discoverable and fixable, rather than permanently hidden by corporate control. Privacy also remains a shared responsibility: even the most privacy-preserving wallet cannot protect a user who reuses addresses across multiple services, connects to privacy-invading applications, or sends funds to regulated exchanges that perform identity verification.