- Your master key, seed, passphrase and Touch ID seal never leave your device, in any form, ever.
- There is no account, no email, no cloud sync, no analytics and no telemetry. The app contains no tracking code of any kind.
- We keep no record of who uses the wallet. There is no user list, because there is nothing to put in one.
- The app does talk to blockchain servers to show your balance. Those servers see your IP address and the addresses you look up. That is unavoidable for any wallet, and you can point it at your own node instead.
What never leaves your device
All of it stays in local storage on your own machine, and none of it is transmitted anywhere under any circumstance:
- Your 64 character master key and the seed derived from it
- Your passphrase, and the Argon2id and AES-256-GCM encrypted blob it protects
- Your Touch ID seal, which lives in the macOS Keychain on that one device
- Your address book labels, wallet names, theme and every other setting
We could not hand these over to anyone if we were asked, because we never receive them.
What the app sends, and to whom
A wallet that shows a balance has to ask a server about the blockchain. Here is every network request the app makes. There are no others.
| Request | Goes to | Which reveals | Turn it off |
|---|---|---|---|
| Chain data | Your chosen server. By default api.btxscan.io, which we run, failing over to community servers. |
Your IP address, the addresses and transactions you look up, and the app version and OS name. | Point it at your own node in Settings. |
| Broadcasting a send | The same server. | The signed transaction, which is public on the blockchain the moment it is broadcast anyway. | Unavoidable if you want to send. |
| Update check | pq-wallet.com/version.json |
Your IP address, the app version and OS name. Nothing else is sent and no code is downloaded. | Block the domain if you prefer. |
| Artifact artwork | btxscan.io or an IPFS gateway. |
Your IP address and which artifact you are viewing. | Settings, Artifact artwork, Sigil only. Then nothing is fetched at all. |
| qID sign-in | Only the site you chose to sign in to. | One address you pick, and a signature. Never a key. A login proof cannot move funds. | Only happens when you press Sign. |
About the app version and OS name
Requests identify themselves as, for example, BTX-Wallet/1.0.0 (macos).
That tells a server which release is talking to it, which is how we know whether an old version is still in
use and needs support. It contains no identifier for you, your machine or your wallet.
Our own server keeps ordinary access logs
We run api.btxscan.io. Like effectively every web server on the
internet, it writes standard access logs: IP address, timestamp, the path requested and that version string.
We use them only to keep the service running and to get a rough sense of how many people use the wallet.
They are not joined to any identity, because we hold no identities to join them to. If that bothers you,
the honest fix is not our promise, it is running your own node, and the app supports that.
What we never collect
- No name, email address, phone number or postal address
- No account, login or identifier of any kind
- No analytics, crash reporting, advertising SDK, cookie or fingerprint. The app ships with none.
- No contact list, location, camera, microphone or file access beyond files you pick yourself in a dialog
- No wallet registry. We genuinely cannot tell you how many wallets exist.
Children
The wallet is not directed at children and we knowingly collect nothing from anyone, including children.
Third parties
We do not sell, rent or share data, because we do not have any to sell. The servers listed above receive requests as described and nothing more. If you choose a community server or your own node, the operator of that server is the one receiving those requests, on their terms, not ours.
You are already in control
- Use your own node. Settings, Network. Then no server of ours sees anything.
- Turn artwork off. Settings, Artifact artwork, Sigil only. The app then fetches nothing for artifacts.
- Delete everything. Removing the app and its local data erases every trace on your side. Nothing survives on our side, because nothing was ever there. Keep your master key backed up first, or your funds go with it.
There is no "delete my account" button because there is no account. There is no data export request to file because we hold nothing about you. Rights to access, correct or erase personal data have nothing to act on here.
Changes
If this ever changes, the date at the top changes and the change is described in the changelog. We will not quietly start collecting something.
Contact
BTX PQ wallet is published by Bonuz Technology DMCC, Dubai, United Arab Emirates, which signs the macOS build.
Questions about this policy, or about anything the app does on the network: open an issue on GitHub or reach us on Telegram.