Privacy Policy

Effective 5 Nov 2026 · applies to the Fortis Wallet mobile app and its backend service, operated by Fortis Tech Labs.

Fortis Wallet is a wallet for Bitcoin XBT, Bitcoin BTC and Lightning. Your keys and recovery phrases are generated on your device, encrypted under a password you choose, and never leave the device. We cannot access the coins in your wallets or your Lightning channel, and cannot move them for you. The one exception is the Fortis balance in a Lightning wallet: small Lightning payments that we hold for you (section 9).

This policy explains the limited data the app and its backend handle.

1. What stays on your device

Stored only in the app's private storage on your phone, never transmitted:

• Your 12- or 24-word recovery phrase and optional BIP-39 passphrase, encrypted (Argon2id key derivation + XChaCha20-Poly1305) under your app password.
• Wallet settings: which chain you use and the address counters needed to re-derive your addresses.
• A per-install token (see below).

Uninstalling the app, or using Forget this wallet, deletes all of it. If you lose your recovery phrase we cannot recover it.

2. What the app sends to the backend

To show your balance and history and to broadcast payments, the app contacts the fortis backend at api.fortistechlabs.com. It sends:

• A per-install token — a random string created the first time the app connects. It is not linked to your name, email, phone number, or any device identifier. It exists only so the service can rate-limit abuse. It is replaced automatically if it stops working.
• Your wallet addresses — public bech32 addresses derived from your keys, sent so the service can return their balances, unspent outputs, and transactions. These addresses and their transactions are already public on the blockchain.
• Signed transactions you choose to send, for broadcast to the network.
• Fee-rate requests.
• Connection metadata (your IP address) — used transiently to rate-limit requests. It is not written to durable per-request logs and is not used to build a profile of you. The service keeps only aggregate counters.

The backend keeps no account for you: no sign-up, no email, no password held on a server.

3. Third parties

Cloudflare

The backend is served through Cloudflare (TLS, CDN, DDoS protection). Cloudflare processes connection data (IP address, request metadata) on our behalf under its own privacy policy.

Google Firebase Cloud Messaging (Lightning only)

If you have a Lightning wallet, the app gets a push token from Google's Firebase Cloud Messaging and gives it to our Lightning service, so it can notify you of an incoming payment while the app is closed. Google delivers these notifications, and sees the token, your device's connection to Google, and the notification text, which includes the amount in sat. Google processes this under its own privacy policy. The token is sent to us only if you have a Lightning wallet. From version 0.6.1, the app doesn't contact Firebase at all until you add a Lightning wallet (version 0.6.0 also fetches a token from Google at start-up, but keeps it on the phone). Without Google Play Services, no token is created.

Lightning Dev Kit Rapid Gossip Sync (Lightning only)

To route Lightning payments, the app downloads a public snapshot of the Lightning network graph from rapidsync.lightningdevkit.org. That server sees your IP address and when you download. It learns nothing about your payments.

Public explorers (fallback only)

If api.fortistechlabs.com is unreachable, the app queries a public block explorer directly until the backend is available again — mempool.space for Bitcoin, mempool.guide for XBT. During that time the explorer receives the same wallet addresses and your IP address, governed by its own privacy policy.

4. Camera

The camera permission is used only to scan a QR code containing a payment address, entirely on your device. No image is stored or transmitted.

5. Crash diagnostics, error reports and support

If the app crashes it sends a diagnostic report to a Fortis Tech Labs endpoint containing the app version, your Android version, your device model and manufacturer, the error stack trace, and (recorded server-side) your IP address. No wallet addresses, keys, transactions, or your recovery phrase are included. Reports are stored in a plain log file and are not linked to any account or identifier.

Error reports. When the app shows you an error, it sends us a short report so we can fix it: the app version, where in the app it happened, the error message, a trimmed stack trace, and your per-install token. The same error is sent at most once every few minutes. No keys, recovery phrase or addresses are included. These reports are kept in our server logs.

Support tickets. If you use Settings → Help & support or Send to support, we receive your message and, if you give one, your email address. If you allow logs, the ticket also includes your device model, Android version, language and time zone; the kinds of wallets you have (chain and type, not addresses); the recent errors; your Lightning state and channel and Fortis balances; and the end of your Lightning node's log, which contains your node ID, your channel, and the amounts and payment hashes of recent Lightning payments. No keys or recovery phrases are included. Tickets are stored on our server, readable only by the operator, and forwarded by email to our support inbox (hosted by Google Gmail). We keep them as long as we need to resolve the issue; ask us to delete yours at any time.

6. What we do not do

• No analytics or usage-tracking SDKs. The only third-party SDK is Firebase Cloud Messaging, for Lightning payment notifications (section 3).
• No advertising, no ad identifiers, no third-party trackers.
• No sale or sharing of personal data for marketing.

7. Service fee

To fund the hosted backend, payments made through it carry a service fee: 1% of the amount sent, minimum 400 sat, paid to a Bitcoin address operated by Fortis Tech Labs. The app adds this as a separate output in the transaction and shows the exact amount on the confirmation screen before you sign. It is part of the transaction you approve — not something we can charge afterwards.

8. Swaps

Swaps (BTC ⇄ XBT with another person) are optional. They are atomic and non-custodial: your coins sit in a contract on chain that only you and the other person can spend, never with us. To arrange and follow a swap, the app sends the backend:

• Your offer: direction, amount, your limit price, whether it is private, a random request ID, and a recovery tag derived from your recovery phrase (we store only a hash of it), so a phone restored from your phrase can find a swap that still has your coins locked.
• The swap itself: the swap's public keys, the hashed secret that locks both contracts (and a random value that lets your phrase rebuild it), the transactions that fund the contracts, refund and claim transactions signed in advance for our watchtower (they can only pay you), and, if a match is cancelled, the release that returns the other side's coins. None of it can move your coins anywhere but to you.
• Swap step logs: the steps your phone took (for example "funded", "waiting for confirmations") with the transaction IDs involved, to diagnose a swap that goes wrong. They contain no keys, balances or other addresses.

Offers and matches are deleted 7 days after a swap ends, except what a pending refund still needs; the hashed recovery tags are kept so a swap index is never reused. To check prices and the other side's coins without relying on us alone, the app also contacts NeoxEX (neoxa.exchange, for a price reference) and the public explorers mempool.space, blockstream.info, mempool.kilombino.com and mempool.guide (transaction lookups); they see your IP address and the transactions looked up.

9. Lightning (beta)

Lightning is optional: it is a separate wallet you add with Add wallet → Lightning, with its own recovery phrase. Your phone runs its own Lightning node, with keys derived from that phrase, and connects to our Lightning Service Provider (LSP, lsp.fortistechlabs.com) and our Versioned Storage Service (VSS).

• What our LSP sees: your Lightning node's public key (node ID), your IP address while connected, the channel funding, splice and closing transactions between your node and the LSP, and the amounts and timing of payments that pass through it, with the next hop in the route. Because Lightning uses onion routing, the LSP does not see the final recipient or sender beyond its immediate hop, and it does not know who you are.
• What our LSP stores for your node ID: payments it is holding for you while your phone is offline; your Fortis balance and a ledger of every movement in and out of it (amounts, fees, times, payment hashes); the invoices and BOLT12 offer it issued for you; the fees you paid us; and your push token (section 3). This is tied to your node ID, not to your name or email.
• The Fortis balance is custodial. Small payments that arrive before you have a channel, payments to your BOLT12 address, and payments you didn't collect within a few hours are held by Fortis Tech Labs on your Fortis balance until they add up to more than 50,000 sat and are moved into a channel of your own. While they're there, we hold those funds, not your phone. We hold at most 300,000 sat for all users together.
• What VSS stores: encrypted copies of your channel state and payment records, plus a random device-lock token so two phones do not run the same channel at once. They're encrypted on your phone, with keys derived from the wallet's phrase, before upload. VSS and the backend cannot decrypt them.
• LNURL and Lightning addresses: when you pay an LNURL or a Lightning address (name@domain), your phone connects directly over HTTPS to the recipient's domain to fetch the invoice. That server sees your IP address and the amount requested.

10. Data retention and your choices

• On-device data: removed on uninstall or Forget this wallet.
• Backend: there is no sign-up account; per-install tokens are random and short-lived; connection metadata is not retained per-request.
• Lightning: the LSP keeps the records in section 9 for as long as your node has a channel or a Fortis balance with us, and the ledger of the Fortis balance for our accounts after that. A push token is deleted when Google reports it is no longer valid.
• To ask about or request deletion of any residual server-side records, email support@fortistechlabs.com.

11. Security

Keys are encrypted at rest with a key derived from your password. The app is locked with your fingerprint (or your password), locks itself after a minute in the background, and asks again before showing a recovery phrase or sending. Every screen is kept out of screenshots, screen recording and the recent-apps preview.

12. Children

Fortis Wallet is not directed to children under 13, or under the age of digital consent where you live.

13. Changes

We will post any changes on this page and update the effective date above.

---

Data safety summary

For reference, matching Google Play's Data safety categories:

• Data collected: approximate/precise location — none; personal info — none; financial info — wallet addresses and on-chain transaction data (public), submitted transactions, and, if you swap, your offers and the swap's public transaction data; with a Lightning wallet, your node ID, Fortis balance and the payments that pass through our LSP; app activity — error reports and, if you send one, support messages; device IDs — none, apart from the Firebase push token if you have a Lightning wallet.
• Data shared: wallet addresses and IP address are processed by Cloudflare (infrastructure) and, during a backend outage, by mempool.space / mempool.guide (fallback data source); during a swap, transaction lookups go to the public explorers and NeoxEX listed in section 8; with a Lightning wallet, the push token and notification text are processed by Google Firebase, and support tickets reach our inbox through Google Gmail.
• Security practices: data encrypted in transit (HTTPS); on-device secrets encrypted at rest; users can request deletion.
• Data collection is: not required to be linked to identity; the per-install token is not an identifier of the user.