Attest collects nothing.

Your private key is generated or imported in your browser and stored there, in the extension's own storage. It is never transmitted anywhere. With PIN protection enabled it is encrypted at rest with a key derived from your PIN; the PIN itself is held in memory only and is gone when Firefox closes.

The extension talks to no server of its own. There is none. It does not contact the developer, and there is no analytics, telemetry or error reporting of any kind.

Websites you visit can ask Attest to sign an event, and you are asked before that happens. A site learns only what you approve: your public key, and whatever you agreed to sign. The list of which sites you granted what is kept in your browser and goes nowhere.

Uninstalling removes all of it.