What the app stores
Tor Wallet is a non-custodial wallet. Your recovery phrase, private keys, wallet addresses, balances, transaction history and address book are stored on your phone. The recovery phrase is encrypted with a key held by the Android Keystore and unlocked by your master password.
The app does not upload your wallet to a server and does not create a cloud backup. If you lose the device and have no written recovery phrase, the wallet cannot be recovered by us.
What the server sees
The control plane exists to deliver updates and measure whether the installed base is healthy. When the app registers or checks for updates, it sends:
- A random install ID generated on the device.
- App version and version code.
- Device model, Android version and locale.
- A timestamp and a ping counter.
That is the complete device record. It contains no wallet address, public key, balance, transaction, recovery phrase, private key or contact information. It is not linked to an account because there are no accounts.
Support conversations
Support is handled inside the app. When you open a ticket, the control plane stores a random ticket ID, the install ID already present in the device registry, the subject and messages you write, the app version and device model, and timestamps. It does not collect an email address.
Admin replies are stored so the app can display them. The app keeps a private bearer token on the device; the server stores only its SHA-256 hash. Messages are visible to the admin team and are retained until the ticket is resolved.
Do not include a recovery phrase, private key, password, wallet address or transaction you do not want stored. Support never needs those to help you.
What we never collect
- Recovery phrases, seed words or private keys.
- Wallet addresses, balances or transaction history.
- Names, email addresses or phone numbers from the app.
- Precise location, contacts, photos, microphone or camera data.
- Third-party analytics, advertising IDs or tracking pixels.
- IP addresses in the device registry. The reverse proxy processes connection metadata in memory to apply rate limits; it is not written to a device record.
Tor and your network
Blockchain RPC, price and update requests are routed through the embedded Tor client. DNS is resolved remotely inside Tor. The destination service sees a Tor exit node rather than your home or mobile IP.
Tor does not make on-chain activity private by itself. A blockchain is public: addresses, amounts and timing are visible to anyone. Tor protects the network path, not the ledger.
This website
This site is static. It sets no cookies, loads no third-party fonts or scripts, and contains no analytics. Server access logs are disabled. If you use the project contact form, the message and any name you provide are stored so the team can review it. It is not an email support channel.
Donation addresses are public blockchain addresses. If you donate, the transaction is public and permanent. We do not link donations to a user account.
Retention and deletion
Device records are kept while the install is active and for a limited period afterwards for aggregate counts. Support tickets are kept until the conversation is resolved. Project contact messages are kept until reviewed. You can ask us to delete a device record by opening an in-app support ticket with the install ID, or through the privacy request form. We cannot delete on-chain data.
Contact
Privacy questions and deletion requests can be opened as an in-app support ticket or sent through the privacy request form. Never include a recovery phrase or private key in a message.