Fortis Wallet
Privacy Policy
Fortis Wallet is a non-custodial wallet for Bitcoin XBT and Bitcoin BTC. Your keys and recovery phrase are generated on your device, encrypted under a password you choose, and never leave the device. We cannot access your funds and cannot move them for you.
This policy explains the limited data the app and its backend handle.
1. What stays on your device
Stored only in the app's private storage on your phone, never transmitted:
- Your 12- or 24-word recovery phrase and optional BIP-39 passphrase, encrypted (Argon2id key derivation + XChaCha20-Poly1305) under your app password.
- Wallet settings: which chain you use and the address counters needed to re-derive your addresses.
- A per-install token (see below).
Uninstalling the app, or using Forget this wallet, deletes all of it. If you lose your recovery phrase we cannot recover it.
2. What the app sends to the backend
To show your balance and history and to broadcast payments, the app contacts the
fortis backend at api.fortistechlabs.com. It sends:
- A per-install token — a random string created the first time the app connects. It is not linked to your name, email, phone number, or any device identifier. It exists only so the service can rate-limit abuse. It is replaced automatically if it stops working.
- Your wallet addresses — public bech32 addresses derived from your keys, sent so the service can return their balances, unspent outputs, and transactions. These addresses and their transactions are already public on the blockchain.
- Signed transactions you choose to send, for broadcast to the network.
- Fee-rate requests.
- Connection metadata (your IP address) — used transiently to rate-limit requests. It is not written to durable per-request logs and is not used to build a profile of you. The service keeps only aggregate counters.
The backend keeps no account for you: no sign-up, no email, no password held on a server.
3. Third parties
Cloudflare
The backend is served through Cloudflare (TLS, CDN, DDoS protection). Cloudflare processes connection data (IP address, request metadata) on our behalf under its own privacy policy.
Public explorers (fallback only)
If api.fortistechlabs.com is unreachable, the app queries a public block
explorer directly until the backend is available again —
mempool.space for Bitcoin,
mempool.guide for XBT. During that time the
explorer receives the same wallet addresses and your IP address, governed by its
own privacy policy.
4. Camera
The camera permission is used only to scan a QR code containing a payment address, entirely on your device. No image is stored or transmitted.
5. Crash diagnostics
If the app crashes it sends a diagnostic report to a Fortis Tech Labs endpoint containing the app version, your Android version, your device model and manufacturer, the error stack trace, and (recorded server-side) your IP address. No wallet addresses, keys, transactions, or your recovery phrase are included. Reports are stored in a plain log file and are not linked to any account or identifier.
6. What we do not do
- No analytics or usage-tracking SDKs.
- No advertising, no ad identifiers, no third-party trackers.
- No sale or sharing of personal data for marketing.
7. Service fee
To fund the hosted backend, payments made through it carry a service fee: 1% of the amount sent, minimum 400 sat, paid to a Bitcoin address operated by Fortis Tech Labs. The app adds this as a separate output in the transaction and shows the exact amount on the confirmation screen before you sign. It is part of the transaction you approve — not something we can charge afterwards.
8. Data retention and your choices
- On-device data: removed on uninstall or Forget this wallet.
- Backend: no per-user account exists; per-install tokens are random and short-lived; connection metadata is not retained per-request.
- To ask about or request deletion of any residual server-side records, email support@fortistechlabs.com.
9. Security
Keys are encrypted at rest with a key derived from your password. Screens that show the recovery phrase or a password block screenshots and screen recording.
10. Children
Fortis Wallet is not directed to children under 13, or under the age of digital consent where you live.
11. Changes
We will post any changes on this page and update the effective date above.
Data safety summary
For reference, matching Google Play's Data safety categories:
- Data collected: approximate/precise location — none; personal info — none; financial info — wallet addresses and on-chain transaction data (public), submitted transactions; app activity — none; device IDs — none.
- Data shared: wallet addresses and IP address are processed by Cloudflare (infrastructure) and, during a backend outage, by mempool.space / mempool.guide (fallback data source).
- Security practices: data encrypted in transit (HTTPS); on-device secrets encrypted at rest; users can request deletion.
- Data collection is: not required to be linked to identity; the per-install token is not an identifier of the user.