Privacy Policy

Last updated: July 17, 2026

1. Who we are

This policy describes how NozyWallet (developed by LEONINE DAO) handles information when you use our website, desktop app, mobile app, browser extension, CLI, or related documentation. NozyWallet is an open-source Orchard / Ironwood (shielded) Zcash wallet. We do not operate a custodial exchange and we do not hold your funds.

Contact: support.team@nozywallet.com. Security / vulnerability reports: support.team@nozywallet.com (responsible disclosure — do not post exploits publicly before coordination).

2. On-chain vs off-chain privacy (Orchard/Ironwood vs API/node logging)

On-chain (Orchard / Ironwood): Shielded transactions hide sender, receiver, and amount on the public Zcash ledger. NozyWallet is shielded-only by design — transparent addresses are not supported. Ironwood (NU6.3) migration and related wallet tools follow the same shielded privacy model on-chain.

Off-chain (API / node logging): Orchard and Ironwood do not hide your IP address, sync schedule, or the fact that you contacted an API or node. Anyone who runs the infrastructure you use may log connection metadata. For strongest privacy, run your own Zebrad node and your own NozyWallet API on hardware you control.

3. NozyWallet Mobile (companion app)

The mobile app is a companion client. It does not download the full blockchain. It sends HTTPS requests to a NozyWallet API server you configure (for example your home PC or a VPS). That API connects to a Zebra node for sync, proving, and broadcast.

Stored on your phone

• API server URL and optional API key (device storage / AsyncStorage)
• Session preferences (for example unlock state, display theme)
• No wallet seed is required to stay on the phone in companion mode; wallet files live on the API server you connect to

Stored on your API server

• Wallet scan data, notes, and transaction history needed to show balance and send shielded ZEC
• Seed phrase and keys if you create or restore a wallet through that API

If you use someone else’s hosted API (including any Nozy-operated service), that operator can see when you connect, your IP address, and wallet data stored on their server. Read the in-app hosted-mode disclosure before using a third-party API.

Current product note: NozyWallet does not yet operate its own Zebrad node for public mobile hosting. Sync requires a Zebrad reachable from the API you use — typically your own home or VPS setup, or another operator you trust.

4. Desktop app, browser extension, and CLI

Desktop and command-line builds run wallet logic locally or against a node you configure. Wallet files and keys are stored on your machine under your user profile unless you choose a remote API deployment. The same on-chain / off-chain distinction applies: your Zebrad operator (often you) may see RPC and sync metadata.

Browser extension (Chrome / Edge / Brave): Orchard / Ironwood crypto runs as WASM inside the extension. Your mnemonic stays in the extension service worker and, when a background scan is active, in browser session storage only (cleared on lock). Pending dApp approvals are kept in session storage so they survive a service-worker restart (about five minutes). The optional local companion API (nozywallet-api on loopback only) is used for sync/send and never receives your seed; if you set an API key, it is stored in session storage for that browser session. Permanent host access is limited to localhost companion ports; broader hosts (Zebrad RPC / dApp pages) require an explicit optional permission grant. Sites must ask you to connect — connect is not silent. Optional USD price display may call CoinGecko from the popup (no wallet identifiers are sent).

5. What we collect

We do not sell personal data. NozyWallet software does not include third-party advertising or in-app analytics SDKs.

• Mobile app: No telemetry is sent to NozyWallet by default. Connection settings stay on your device unless you configure an API that logs requests on its server.
• This website: Our hosting provider may collect standard web logs (IP address, browser type, pages visited). If analytics are enabled on the marketing site, they are used only to understand traffic to this website — not to track wallet usage.
• Support: If you email us or open a GitHub issue, we receive the information you choose to send.

6. Third-party services

You may choose to connect NozyWallet to:

• Zebra nodes — for blockchain sync and transaction broadcast
• lightwalletd — optional compact sync (experimental mobile paths)
• Your own or third-party API hosts — for mobile companion mode
• Block explorers — when you open transaction links from the app
• CoinGecko (optional) — browser extension popup may fetch a ZEC/USD rate for display; no addresses or keys are included

Each service has its own privacy practices. We do not control what a remote node or API operator logs.

7. Security

• Use HTTPS for any API URL exposed on the public internet.
• Protect your recovery phrase and API keys. We cannot recover them for you.
• Uninstalling the mobile app removes local settings; server-side wallet data remains on whichever API host you used until you delete it there.

8. Children

NozyWallet is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children.

9. Your choices

• Run your own API and Zebrad for maximum control.
• Clear mobile connection settings in the app or uninstall the app.
• Use a new wallet profile or server if you no longer trust a host.

10. Changes to this policy

We may update this page when the product or law changes. The “Last updated” date at the top will change. Continued use after an update means you accept the revised policy.

11. More detail

Technical privacy architecture: NozyWallet privacy model (documentation)

Canonical store URL: https://leonine-dao.github.io/Nozy-wallet/privacy/