Lightning in Fortis Wallet

How it works

Lightning is a wallet of its own. On Home, tap Add wallet → Lightning. It gets its own recovery phrase, separate from your BTC wallets, so your on-chain coins and your Lightning channel never share keys.

Receive: Enter an amount and tap Create invoice. Your first payment opens a channel with the Fortis Lightning provider (LSP). The fee for that (0.5% of the payment, minimum 1,000 sat) is shown before you share the invoice. After that, payments that fit in your channel cost nothing to receive.
Get paid while the app is closed: Your phone doesn't need to be online. The LSP holds an incoming payment for you and sends a notification. Open Fortis and the payment arrives in your channel. If you don't open the app within a few hours, the payment goes to your Fortis balance (see below).
A reusable address (BOLT12): One address you can share once and be paid to again and again, even while your phone is off. Payments to it go to your Fortis balance. Paying it needs a wallet that supports BOLT12.
Send: Scan or paste a BOLT 11 invoice, a BOLT 12 offer, an LNURL-pay code, a Lightning address (name@domain) or a bitcoin: link that carries an invoice. The most you could pay in routing fees is shown before you confirm, and a payment is never sent twice. Scan a Lightning invoice in a BTC wallet and Fortis offers to pay it from your Lightning wallet.
Move between on-chain and Lightning: A BTC wallet's Move tab puts funds into Lightning, either opening your channel or adding to it. The Lightning wallet's Move tab sends funds back, and you choose which BTC wallet receives them. Move all closes the channel cooperatively and sends everything on-chain. The fees are shown before you confirm.
A history that works like a ledger: Every payment, every move in or out and every fee, in time order, with the balance after each entry. Fees are itemised: the network fee (paid to miners), the Fortis transfer fee and the routing fee. A move shows what left Lightning and what arrived on-chain, so you can reconcile both sides to the sat. If the entries ever don't add up to the balance, the history says so.
Backed up, one phone at a time: Your channel state changes with every payment. Before each change, your phone saves an encrypted copy to our backup service (VSS), using keys derived on the phone from the wallet's phrase. We can't read it. Lose your phone and you restore from that phrase in Fortis. Running one channel on two phones at once could lose funds, so only one device runs a Lightning wallet at a time. Another device can take over from the wallet's settings.
Always a way out: Close the channel and move everything on-chain from the Lightning wallet. Fortis asks the LSP to close cooperatively. If the LSP can't be reached, you're offered a force close. That works without us, but it locks your funds for a while and costs a higher network fee. Fortis never force-closes for you.

The Fortis balance: what we hold for you

One part of Lightning in Fortis is custodial, and we want to be plain about it.

A channel only makes sense above a minimum size. Below it, the network fee to open the channel would eat the payment. So small payments that arrive before you have a channel are held by Fortis on your Fortis balance. So are payments to your BOLT12 address, and payments you didn't collect within a few hours. Fortis holds this money, not your phone, so you're trusting us with it.

The Lightning wallet shows the Fortis balance separately from your own channel.
Once it adds up to more than 50,000 sat, Fortis moves it into a channel of your own, minus a fee of 1% (at least 1,000 sat).
Fortis holds at most 300,000 sat for all users together. Above that, you're asked to receive enough to open your own channel.
You can pay from it. Every movement in and out appears in your history.

Money in your own channel is different: only your phone can sign for it.

What Lightning needs from us

Notifications: Notifications about incoming payments use Google's Firebase Cloud Messaging, so they need Google Play Services. Without it, Lightning still works, but you only see a payment when you open Fortis.
Routing data: To find routes for your payments, the phone downloads a public snapshot of the Lightning network graph from Lightning Dev Kit's Rapid Gossip Sync server.
Privacy: The LSP sees your node's ID and the payments that pass through it. The privacy policy lists everything it sees and stores.

Lightning is in beta: a payment that opens your channel can be up to 100,000 sat, and a channel you fund yourself up to 1,000,000 sat. Start with small amounts.