Privacy policy
Effective: 9 November 2026. This policy covers the Qkeep website, browser extension and the Android and iOS apps. Changes will be posted on this page.
Who we are
Qkeep is an independent wallet operated by Lux8 labs ltd. It is not affiliated with or operated by the Quantus Network project.
Your wallet stays on your device
Your private keys, recovery phrases, passphrases and passwords never leave your device. Your wallet is encrypted with your password in browser storage for that website address, in the extension’s own storage, or in the private storage of the Android or iOS app. We cannot recover your password or access your wallet.
In the Android app, biometric unlock uses a key in Android Keystore that never leaves the device and works only after a fingerprint or face check. The app turns off Android backups, so uninstalling it deletes the wallet from the phone: keep your recovery phrase. Copies made in the app are marked sensitive, so Android keeps them out of the clipboard preview, and screenshots of the app are blocked.
In the iOS app, Face ID unlock uses a key in the iPhone Keychain that stays on this device and stops working if the enrolled faces change. Wallet data is kept out of iCloud and computer backups, so a new or restored iPhone needs your recovery phrase. Copied recovery phrases and keys stay on this iPhone, are not shared with your other Apple devices and are removed after one minute. Screen recording, mirroring and the app switcher show a cover instead of the wallet.
In both apps you can also set a 6-digit PIN. It opens the wallet with a device key that never leaves the phone: the Secure Enclave on iPhone, Android Keystore on Android. After 5 wrong PINs only your password opens the wallet. Showing a recovery phrase or a private key always asks for your password.
What our relay receives
The web wallet sends requests to /api/ at the website address you are using. The extension and the Android app use wallet.qkeep.app/api/. Ordinary account requests include addresses for balance and history checks, fee estimates and transaction context. The relay also receives signed transactions to broadcast and transaction hashes to track. Broadcast transactions are public on the blockchain.
Extra privacy mode is off by default and is saved on this device for this wallet. With it off (Normal mode), Encrypted Account balances, deposits and history are read from recipient buckets: each request names eight first bytes of account IDs, at most four of them real and the rest decoys kept with your cached data, never an Encrypted Account address. Downloaded bucket data is cached in IndexedDB on your device. This is the faster default. Encrypted Accounts with more than 4,096 deposits are matched on the device from the full public data instead. In both modes, spent-marker checks request eight nullifier-prefix buckets, including at least four random decoy buckets, without an address or complete nullifier. Proof preparation requests 32 shuffled deposit indices, including decoys, without an address. Ordinary account requests are unchanged in either mode. Encrypted Account requests and ordinary account requests are sent in separate bursts, never at the same time.
With Extra privacy mode on, Encrypted Accounts download shared public deposit, account and history data and match addresses locally. Spent-marker checks request eight nullifier-prefix buckets at a time, with at least four random decoy buckets. Complete nullifiers and the Encrypted Account address are not included in these checks. Proof preparation requests 32 shuffled deposit indices, including decoys, without an address. Downloaded data is cached in IndexedDB on your device and checked against a recent finalized snapshot and content hashes. These hashes detect corrupted downloads; they do not remove trust in the relay's chain data.
The relay and Cloudflare still see your connection, timing, requested prefixes and padded index sets. Repeated observations can narrow which prefixes or deposits matter, and a spend following a proof request may be correlated by timing. This is limited metadata protection, not anonymity. Older installed versions may still send addresses and complete nullifiers in their checks. Switching off stops the full-feed sync and offers to delete cached public data; Normal mode still uses nullifier buckets and padded proof context. A send already in review keeps the mode it started with until it finishes or is cancelled. A failed Extra privacy check shows an error and never silently falls back to the default requests.
API requests are not logged by our web server or relay. The relay keeps IP addresses in an in-memory rate-limit table until eviction or restart, without writing them to disk. While processing a request, our server can technically link its addresses and checks to the connecting IP address. It does not retain that association.
The relay keeps anonymous daily totals: how many transfers and private transfers were submitted, and how many different ordinary accounts opened their history that day (Encrypted Accounts are not counted), counted separately for the website (including the Android app) and the extension. Only these numbers are stored. To count different accounts, the relay uses a random key that exists only in memory for one day and is never written to disk, so the totals cannot be linked to any account address or IP address.
Website logs and Cloudflare
Requests for website files, unlike API requests, are recorded in standard web-server access logs containing the host, IP address, time and request line. These logs are rotated daily and kept for 14 days to operate and secure the service. We count distinct daily visitors from them and keep only the counts.
Cloudflare proxies traffic to the website and API and processes connection data under its own privacy policy.
To show an approximate USD value, our relay fetches the QTC price from CoinGecko every two minutes. The request contains no user data.
If you use swaps, requests send addresses and amounts to NEAR Intents through our relay.
The camera is used only while the scanner is open to read a QR code locally; camera frames and selected images are never uploaded. The Android app asks for camera permission the first time you open the scanner.
No tracking
The wallet and extension contain no analytics code, trackers, advertising or cookies, and send no telemetry. The only usage figures are the anonymous daily totals described above. We do not sell data.
Public blockchain and external sites
Transfers, addresses and amounts are public on the Quantus blockchain. Private sends also disclose the recipient and amount, as shown before sending.
Links to the explorer at qtcscan.com opens an external site.
Contact
Email hello@qkeep.app. Never send a recovery phrase, private key, passphrase or wallet password.