Wallet privacy policy

1. In short

Qlyphs Wallet is a self-custody wallet. Your recovery phrase and keys stay in your browser. The extension has no analytics, no tracking and no advertising, and the developer collects no personal data through it.

2. What stays on your device

• Recovery phrase and keys: encrypted with your password (AES-256-GCM, key derived with PBKDF2, 600,000 iterations) in the extension’s local storage. They are never sent anywhere.
• Wallet data: account names, connected sites, transaction history, pending transactions and display settings, in the extension’s local storage.
• Passkey unlock (optional): a separate encrypted copy that your passkey can open, kept in this browser only.
• Backups (optional): an encrypted file you export and keep yourself.

Nothing is synced to a browser account or to any server of ours.

3. What is sent, and where

To work, the wallet talks to two fixed endpoints, without cookies:

• https://indexer.qlyphs.com, to read balances and history for your public addresses.
• https://rpc1-mainnet.quantus.com, a public Quantus network node, to read chain state and submit the transactions you signed.

These requests contain your public addresses and the signed transactions you approved. Like any web server, the endpoints see your IP address. Transactions are recorded on the Quantus blockchain, which is public and permanent.

4. Connected sites

The wallet offers its connection only to app.qlyphs.com and otc.qlyphs.com. Connecting shares your public address with that site. Every transaction still opens a review in the wallet and is sent only if you approve it.

5. Notifications

Off by default. If you turn them on, the browser shows a local notification when one of your transactions is final, fails or expires. Notifications contain no address or balance and are not sent through any server.

6. Sharing

No data is sold, shared for advertising, or used for anything unrelated to the wallet’s function, including credit decisions.

7. Your control

Removing the extension deletes everything it stored in the browser. Keep an offline copy of your recovery phrase: nobody, including us, can recover it for you.

8. Contact

Questions about this policy: see the contact page. Changes to this policy will be published on this page with a new date.