YOUR DATA, EXPLAINED

Privacy Policy

Last updated: October 14, 2026

This policy describes how Bro Wallet (“Bro”, “we”, or “us”) handles information when you use the Bro Wallet Android app and this website. Bro Wallet is a self-custody wallet: your recovery phrase and private keys are created and stored on your device and are never sent to us.

1. Information Bro Wallet handles

• Public wallet information. Public addresses, selected networks, and the requests needed to show balances, transaction history and prices or to prepare a transaction. Public addresses are not secret, but they can be linked to activity on public blockchains.
• Proof that you control an address. To stop someone else from claiming your wallet on our server, the app signs a short ownership message with your wallet key on your device and sends the signature with your public address. The signature proves control of the address; it cannot move funds and does not reveal your key.
• App and installation data. A per-install identifier derived from an Android device identifier where available, the app version, the app's language, and basic settings such as the selected display currency. The app also records usage events, such as opening a screen or starting a send or swap, with timestamps. We use this to operate, troubleshoot and improve the app. Event names and labels are designed not to include recovery phrases, private keys or transaction amounts.
• Swap orders. When you request a quote or a swap, our server keeps the order needed to build and track it: the tokens and networks, the amounts, the addresses involved, the provider that answered and the order's status.
• Push notification data. If you turn on notifications and allow them in Android, the app sends a Firebase Cloud Messaging token and the wallet and network subscription needed to tell you when funds arrive or leave, and, if you turn it on, when a new token reaches your wallet. Turning notifications off in the app asks our server to remove the push registration.
• App integrity. Requests from the app carry a Firebase App Check token, issued through Google Play Integrity, so our server can tell the genuine app from automated traffic.
• Camera input. If you grant camera permission, the camera is used to scan QR codes (addresses and WalletConnect links). The scan is processed in the app; camera frames are not sent to our servers.
• WalletConnect sessions. When you connect a website or app (“dapp”) with WalletConnect, the app exchanges encrypted messages with that dapp through the WalletConnect relay operated by Reown. The dapp receives your public address and the requests you approve. The list of connected sites is kept on your phone.
• Deletion requests. When you delete your data, we keep a minimal record that the request was made and honoured: a random receipt number, the channel, the times, the outcome and a row count per step. It holds no installation ID, wallet address, secret, IP address or message text. See Delete data.
• Support emails. If you write to us, we receive your email address and what you send, and use them only to answer you.
• Website request data. When you visit this site, Cloudflare processes the network request to deliver and protect the site, including technical information such as IP address, request headers and security events, under its own policies. This site sets no advertising or analytics cookies.

2. Information we do not receive

Your recovery phrase, private keys, PIN and other wallet secrets stay on your device and are not sent to our servers. Signing takes place on your device. Bro Wallet does not hold your crypto and cannot sign, move or reverse a transaction for you.

3. Why we use information

We use the information above to show wallet data and quotes, build swaps you request, submit transactions you have signed to the network, deliver notifications you turn on, answer you when you write to us, protect the service against abuse, and understand app reliability and feature usage.

4. Service providers and blockchain networks

To provide wallet features, the app or our server sends public addresses, signed transactions or quote requests to blockchain networks and to infrastructure, pricing, portfolio and swap providers. Depending on the feature and network you use, these can include Alchemy, QuickNode, DeBank, CoinGecko, CoinPaprika, DexScreener, Blockscout, Mempool.space, TON Center and TronGrid (balances, history, prices and broadcasting), and LI.FI, 0x, Jupiter, Relay, Symbiosis and STON.fi (swap and bridge quotes and routes), as well as the relevant public blockchain network. These services receive the data needed to answer the request and handle it under their own terms and privacy practices.

Google Firebase Analytics processes app events and associated app and device information. Firebase Cloud Messaging processes push tokens and delivers notifications you turn on. Firebase App Check and Google Play Integrity check that requests come from the genuine app. WalletConnect (Reown) relays messages between the app and dapps you connect. Our API runs on Railway, which receives the requests the app sends to it and keeps routine server logs. Cloudflare delivers and protects this website. We do not control the independent privacy practices of these services.

5. Sharing and sale

We do not sell personal data or share it for cross-context behavioural advertising. We give the service providers listed above only what the feature you use needs. Blockchain transactions and public addresses can be seen by anyone using the relevant public network.

6. Storage, security and retention

Wallet secrets remain on your device. Our API uses HTTPS in transit and access controls for server operations. No internet service can be guaranteed completely secure.

Our server stores installation records, public wallet addresses and network subscriptions, usage events, swap orders and push registrations to provide the service. We keep them while needed to operate and protect the service, and you can delete them at any time in the app or on our Delete data page. Addresses that stay silent and unopened for 90 days are dropped from our blockchain watch list. Routine database backups and server logs are not edited record by record and age out on the hosting providers' schedules. Turning notifications off removes the associated push registration.

7. Your choices and deletion requests

You can deny camera or notification permission in Android settings; some features may then be unavailable. You can turn notifications and new-token alerts off in the app at any time.

To delete the information we hold, open Your space in the app and choose Delete my data. The app deletes the server-side records for your installation first, and only after the server confirms does it erase the wallet and local data from the phone. If you no longer have the app, start a deletion on our Delete data page, either by approving a code in the app or by signing a message with your wallet address. The wallet route deletes the records tied to that address; records that belong to an installation itself can only be deleted from that installation. Neither route needs an email address, and neither asks for a recovery phrase or private key.

Logging out removes your wallets from the phone and asks our server to unlink them from your installation and to drop your push registration. It does not by itself erase the other data already on the server, such as usage events and stored balances and history; use Delete my data for that. Deleting your data does not remove public blockchain records or copies held by independent service providers. The Delete data page lists what remains.

8. Children

Bro Wallet is not designed for children, and we do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy as the app changes. We will post the current version on this page and update its “Last updated” date.

10. Contact

For privacy questions, contact support@browallet.app. You do not need to email us to delete your data: use the app or the Delete data page.