Privacy Policy

0xio software is designed as a self-custodial wallet. Your keys are encrypted on your device. We, the developers, do not have access to your funds or any database of your private keys.

Extension (Chrome & Firefox): an encrypted JSON vault in browser local storage; decrypted keys live in volatile session memory only while unlocked. Mobile: keys held in the iOS Keychain or Android Keystore, readable only while the phone is unlocked and never synced or included in backups, with biometrics for local authentication. Desktop: an AES-256-GCM encrypted vault file, Touch ID / Windows Hello, key zeroing on lock. SDK: a bridge between dApps and the wallet that requests only your public address and signatures, and cannot access data without your approval.

On the Extension and Desktop, the vault is encrypted with AES-GCM (256-bit) under a key derived from your password with PBKDF2 (SHA-256): 900,000 iterations on the Extension, 600,000 on Desktop. On Mobile, keys stay in the Keychain or Keystore and your PIN is checked against a PBKDF2 (SHA-256) hash with 100,000 iterations. Each wallet locks itself after a set time, by default 5 minutes on the Extension and Mobile and 15 minutes on Desktop; the Extension and Desktop then clear the decryption keys from memory.

To function, 0xio communicates with an Octra Network RPC node: octra.network on mainnet, devnet.octrascan.io on devnet, or a node you add yourself. When you check a balance or send a transaction, your IP address and public wallet address are visible to that node's operator. The rpc-proxy.0xio.xyz relay we operate is used only when you turn it on in settings, for mainnet and devnet. It is never used as a fallback, and a node you add yourself never goes through it.

We minimize external dependencies. Code may contact: GitHub and jsDelivr (token lists, logos and the dApp directory), octrascan.io (explorer and the devnet RPC), rpc-proxy.0xio.xyz (optional relay, off unless you turn it on), oracle.0xio.xyz (OCT prices), bridge.0xio.xyz & solver.0xio.xyz (cross-chain), IPFS gateways (NFT media), push.0xio.xyz + Expo (mobile notifications), 127.0.0.1 (extension<->desktop FHE compute), WalletConnect (relays encrypted messages between the wallet and a dApp you connect) and Sentry (crash and performance reports from the mobile and desktop apps, set to carry no personal information). We run no advertising, analytics profiling or cross-app tracking, and we do not sell or share data.

In crypto, "Don't Trust, Verify" is the golden rule. We are committed to transparency and have open-sourced our core cryptographic libraries.

The mobile wallet has no account and asks for no name, email address or phone number. Push notifications are optional: when you turn them on, the app registers your wallet address, the network, any token contracts you imported, a push token for your device and your wallet's public key with push.0xio.xyz so it can tell you about incoming transactions; turning notifications off or removing the wallet unregisters it. Crash reports and a sample of performance measurements go to Sentry, hosted in the European Union, with the app version, device model, operating system version and the technical details of the error, never keys, recovery phrases or PINs. The camera is used only to scan QR codes, on the device; nothing is stored or sent. Face ID, Touch ID and fingerprint checks are done by the operating system, and the app learns only whether the check passed. Sites opened in the in-app browser receive what any browser sends them, searches typed in its address bar go to Google, and a dApp learns your address only when you approve its connection.

Push registrations are kept until you turn notifications off or remove the wallet. Crash and performance reports are kept for up to 90 days. Request logs on our servers are short-lived operational logs, used only to run and protect the services and never to profile users. Data recorded on the Octra Network itself is public and permanent by design, except the amounts and balances you keep private with the network's encryption.

You can use every wallet without notifications, and you can erase a wallet and all its data from a device at any time in Settings. Depending on where you live, you may have the right to ask what data we hold about you and to have it corrected or deleted. Because we do not link data to your identity, we may need your wallet address or device details to find it. Write to [email protected].

The 0xio Ecosystem is not intended for anyone under 18.

We post changes on this page and update the date above.