This Privacy Policy explains how the FortisWallet application handles information. FortisWallet is a self-custody wallet built around the principle of data minimisation: most of what you do stays on your device or on public blockchains, not with us. It is provided by FortisNet LTD (company number 14130132, registered in England & Wales).
1. Data Controller
For any limited personal data we process, the controller is FortisNet LTD (company number 14130132, registered in England & Wales). You can reach us at legal@fortisnet.io. This Policy is written to meet the UK GDPR and the Data Protection Act 2018, and we apply equivalent standards to users elsewhere.
2. Our Core Principle (Self-Custody)
- We do not create user accounts.
- We do not require identity verification (KYC) to use the core wallet.
- We do not store or have access to your recovery phrase, private keys, passwords, PINs, or funds.
Because of this design, we hold little or no personal data about you by default. Most data generated by your use of the wallet is stored locally on your device or published by you to a public blockchain.
3. Data Stored Locally on Your Device
The wallet stores the following in the secure storage of your device (for example the operating-system keychain/keystore and local app storage). This data does not leave your device unless you choose to export, back up, or transmit it:
- Encrypted recovery phrase, private keys, and key material.
- Wallet, account, network, and token configuration.
- Address book / contacts and watch-only addresses.
- App settings, preferences, and cached display data.
This local storage is strictly necessary to provide the wallet functionality you request; it is not analytics or advertising storage and does not require a cookie banner. You can erase it by removing the relevant profile or uninstalling the application.
4. Data Revealed When You Use a Blockchain
To show balances, build and broadcast transactions, and synchronise wallet state, the application must communicate with blockchain nodes and related services. When it does, those services may process:
- Your network (IP) address and basic request metadata.
- Your public addresses, public keys, transaction data, and transaction hashes.
Depending on configuration, these requests may go to default providers, to providers you select, or to your own node. We aim not to link IP addresses to wallet addresses for profiling, but the operators of those nodes process this technical data under their own policies.
5. Third-Party Services
The application integrates optional third-party services so that you can use blockchain features. These are independent providers acting under their own terms and privacy policies; we do not control their processing. Depending on the features you use, these may include:
- Blockchain RPC nodes, indexers, and block explorers used to read chain state and broadcast transactions.
- Market-data and price providers used to display values.
- Swap and bridge aggregators and decentralised exchanges used to build the transactions you choose to sign.
- On- and off-ramp providers and decentralised applications you choose to connect to.
When you use such a feature, technical parameters needed to fulfil your request (for example a public address, asset, amount, or slippage setting) may be shared with the relevant provider. Any resulting transaction is returned to your device for you to review and sign — we never sign or execute it for you.
6. Optional AI Features
If you use any optional AI-assisted features, the inputs you provide for that feature may be sent to the configured AI provider to produce a response. Do not enter recovery phrases, private keys, or other secrets into AI features. These features are only active when you use them and are subject to the relevant third-party AI provider's own terms and privacy policy, which govern that processing. We do not control how such providers process the inputs you submit.
7. Public Blockchain Data
Transactions you sign are broadcast to public blockchains. Data recorded on a blockchain — including addresses, amounts, metadata, and transaction hashes — is public, immutable, and globally distributed. We cannot change or delete it. As a result, the right to erasure may be technically impossible for on-chain data.
8. Legal Bases for Processing
Where we process limited personal data, we rely on the following legal bases under the UK GDPR:
- Performance of a contract (Art. 6(1)(b)) — to provide the wallet functionality you request.
- Legitimate interests (Art. 6(1)(f)) — to keep the application secure, available, and free from abuse.
- Legal obligation (Art. 6(1)(c)) — where we must comply with the law.
- Consent (Art. 6(1)(a)) — for any optional feature that asks for it, which you can withdraw at any time.
9. Analytics and Tracking
The application does not include third-party advertising or cross-app behavioural tracking, and we do not sell your personal data. We may process limited, privacy-respecting diagnostic or stability information to keep the application working and secure; where such processing is optional, you can disable it in the application or your device settings. Any analytics collected by app stores or operating-system providers is outside our control and is governed by their own policies.
10. App Stores and Platform Providers
If you obtain or run the application through an app store or operating system (for example Apple, Google, or Microsoft), that provider may process installation, update, diagnostics, and purchase information independently under its own privacy policy. We do not control such processing.
11. Recipients and International Transfers
We do not sell or rent personal data. Limited technical data may be processed by the third-party service providers described above, and by law-enforcement or regulatory authorities where we are legally required to disclose it. Some providers operate outside the UK/EEA; where transfers occur, we rely on an adequacy decision or appropriate safeguards (such as the UK International Data Transfer Agreement or Standard Contractual Clauses). Public blockchain data is globally accessible by design.
12. Retention
Device-local data persists until you delete the profile or uninstall the application. We keep correspondence you send us for as long as needed to handle your request and to meet legal, accounting, or dispute-resolution obligations. We do not retain server-side logs of your IP address linked to your wallet addresses beyond what is needed for security and abuse prevention.
13. Automated Decision-Making
We do not carry out solely automated decision-making that produces legal or similarly significant effects on you.
14. Your Rights
Subject to legal limits, you have rights to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. For users in the United States, we do not sell personal information or share it for cross-context behavioural advertising, and you may request access to or deletion of your information. These rights are subject to the technical reality that on-chain and device-local data is largely outside our control. To make a request, contact legal@fortisnet.io.
15. Data Security
We rely on local encryption of key material, transport encryption (TLS) for network requests, and data minimisation by design. The security of your device, operating system, backups, and recovery phrase is your responsibility; no software can protect funds if your credentials are exposed.
16. Children
The application is not intended for, and may not be used by, persons under 16 years of age. Users aged 16 or 17 who are below the age of majority where they live may use it only with the consent of or under the supervision of a parent or legal guardian, where permitted by law. Third-party services may impose a higher minimum age.
17. Changes to This Policy
We may update this Privacy Policy to reflect changes to the software or legal requirements. The current version will be available in the application and at https://wallet.fortisnet.io/privacy. Material changes will be notified as required by law.
18. Contact and Complaints
For privacy questions, contact FortisNet LTD (company number 14130132, registered in England & Wales) at legal@fortisnet.io. If you are in the UK and believe we have not handled your data lawfully, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk; if you are elsewhere, you may contact your local data protection authority.