1 · Overview
This privacy policy explains what limited information Dark Wallet may collect, why it is collected and how it is protected. The wallet’s architecture is non-custodial; keys never leave your device and no personal data is required to use the software.
2 · Core Principles
- Data minimisation – collect only what is essential for reliability and security.
- End-to-end sovereignty – user holds all private keys, seeds, and recovery materials.
- Transparency – all client-side code and telemetry stubs are open-source.
- Revocability – opt-in signals can be revoked; data can be purged on request.
3 · Data We Collect
3.1 · Website
- Aggregated download statistics (file name & byte count).
- Truncated IP address (last octet erased) in HTTP logs, retained 7 days.
3.2 · Desktop / Mobile App
Collected only if you enable Anonymous Crash Reports:
- Stack trace & build hash.
- Operating-system version & UI locale.
- Randomised install ID (UUIDv4, non-linkable to wallet address).
4 · Legal Bases
We rely on two primary grounds under GDPR:
- Legitimate Interest (Art. 6 §1 f) – to maintain service availability, defend against abuse and DDoS.
- Consent (Art. 6 §1 a) – for optional telemetry, given via an in-app toggle.
5 · How We Use Data
- Calculate regional mirror bandwidth requirements.
- Identify and fix reproducible crash clusters.
- Spot malicious download patterns (e.g., scraping or botnets).
6 · Storage & Retention
All logs are encrypted at rest. Rotation policy:
- HTTP access logs – deleted after 7 days.
- Crash reports – kept 90 days, then automatically purged.
- Aggregate statistics (e.g., total daily downloads) – stored indefinitely but contain no personal data.
7 · Cookies & Local Storage
Dark Wallet’s website sets a single session cookie __dw_session
when you log in to the community portal; it contains an HMAC-signed nonce and expires after 12 hours. The wallet application uses the browser’s IndexedDB to cache chain metadata locally – these records never leave your device.
8 · Third-Party Processors
We keep the external surface minimal:
- Bunny CDN – mirrors static release files; receives the same truncated IP logs as our origin.
- Hetzner Cloud (EU) – hosts the bug-report ingestion endpoint.
- No Google Analytics, no advertising SDKs, no fingerprinting libraries.
9 · Technical Security
- All traffic served over TLS 1.3 with HSTS and preloading.
- Public binaries signed with Ed25519; corresponding signature file published alongside each release.
- Supply-chain attestation (Sigstore) for all GitHub Actions artefacts.
10 · Your Rights
You may request to:
- View any crash reports linked to your anonymous install ID.
- Erase that data permanently (right to erasure).
- Disable telemetry at any moment in Settings → Privacy.
11 · Children’s Privacy
Dark Wallet is not directed to persons under 16. We do not knowingly collect personal information from children. If you believe such data has been submitted, contact us and it will be removed promptly.
12 · Changes to This Policy
Any substantive modification will be documented in the policy’s Git history and announced one week prior to taking effect.
13 · Contact
Questions or concerns? Email the privacy steward at privacy [at] darkwallet60A2 E998 A7D4 83C3 F21C 7F45 91CE 34AA 4E0E F9A2
.