What this site loads, and what it reads.

The optional email and Google sign-in door. It is not loaded when the page loads. It is fetched only after a visitor presses the email/Google button inside the sign-in panel; a visitor who signs in with a browser wallet, or who never signs in, never loads it. Dynamic provisions an embedded, self-custodial wallet, and NFTeria then signs a standard Sign-In-with-Ethereum message over that wallet. NFTeria runs no server and stores no account — the session lives in this browser.

The email address or Google account identifier used to sign in, sign-in method metadata, session metadata, the wallet address, the IP address inherent to any HTTPS request to Dynamic, and a device fingerprint (see the next entry).

• app.dynamicauth.com
• app.dynamic.xyz
• logs.dynamicauth.com
• relay.dynamicauth.com
• waas-keyshares-relay.dynamicauth.com
• iconic.dynamic-static-assets.com

Not a vendor we chose. @thumbmarkjs/thumbmarkjs 0.16.0 is a hard-pinned direct dependency of @dynamic-labs/sdk-react-core 4.89.0 (declared at its package.json line 10). It is listed separately because it reads more about your browser than anything else in this site.

When the Dynamic provider mounts and no fingerprint is already stored, the SDK imports the library and calls getFingerprint(). It performs no consent check, and it does not wait for a sign-in to be attempted or completed.

1. Canvas — draws a gradient and fixed text to a 280x20 canvas and hashes the pixels; skipped on Firefox.
2. Installed fonts — measures a fixed string at 72px against 89 named font families inside a hidden iframe and reports the families whose metrics differ, which is an installed-font list; skipped on Firefox.
3. Audio — runs a 1000 Hz oscillator through a compressor in an OfflineAudioContext and hashes the resulting samples.
4. WebGL — renders a shape through custom shaders, reads the pixels back and hashes them.
5. Graphics hardware — GPU vendor and renderer including the unmasked strings exposed by WEBGL_debug_renderer_info, device memory, the JavaScript heap size limit, and endianness.
6. Screen and input — colour depth, touch-point count, and media-query results for pointer, hover, update, forced-colors, inverted-colors, prefers-contrast, prefers-reduced-motion and prefers-reduced-transparency, which together form an accessibility-settings profile.
7. System — platform, user agent, browser name and version, logical CPU count, whether cookies are enabled, and the highest Apple Pay version this browser supports.
8. Locale — language and IANA time zone.
9. Plugins — the navigator.plugins list.
10. Permission states — the current granted/denied/prompt state of 28 permissions, including camera, microphone, geolocation, bluetooth, NFC, MIDI, notifications, clipboard read and write, local-fonts, display-capture, the motion and light sensors, payment-handler, storage-access and window-management. Nothing is requested; only the existing state is read, and reading it shows you no prompt.
11. Math — floating-point results for 16 functions.

The library sends nothing itself — the shipped bundle contains no fetch, XMLHttpRequest, sendBeacon or WebSocket call. It returns a single hash. The SDK stores it in this browser under the localStorage key dynamic_device_fingerprint, and attaches it to its API requests to Dynamic as the HTTP header x-dyn-device-fingerprint (measured in the installed package at src/lib/client/extension/hooks/useInitializeSdkClient/getApiHeaders/getApiHeaders.js). What Dynamic does with it is governed by Dynamic’s privacy policy. NFTeria does not read the value, does not send it anywhere else, and does not use it for analytics or advertising.

Where a sign-in uses a passkey, the browser’s WebAuthn API creates or asserts a credential that is bound to this site’s origin and to your authenticator — Touch ID, Windows Hello, a security key, or your phone. What leaves your device is a public key, a credential identifier, an attestation from the authenticator, and a signature over a challenge. The private key never leaves the authenticator. No biometric ever reaches this page, Dynamic, or us: your platform verifies the fingerprint or face locally and returns only a signature. The credential is scoped to this origin and cannot be used to identify you on another site.

The credential stays on your device; the public key and credential identifier go to Dynamic (United States).

An embedded wallet has to be able to sign without anyone holding a whole private key. Dynamic’s wallet-as-a-service splits the signing key into shares — the vendor’s own package naming and documentation describe this as multi-party computation — and the browser exchanges share and session material with relay.dynamicauth.com and waas-keyshares-relay.dynamicauth.com. NFTeria holds no share, runs no server in this path, and never sees a private key. We are describing the endpoints this browser contacts, which we measured; the internal scheme is Dynamic’s and is documented by them.