Privacy Policy
VORA Wallet is self-custodial. There is no account to create, nothing to sign in to, and no profile of you anywhere — because the wallet was built so that there is nothing for us to hold.
Last updated 6 October 2026 · Applies to the VORA Wallet app for Android and iOS, the desktop wallet at desktop.vorawallet.com, the web wallet at app.vorawallet.com, and the VORA Wallet extension for Chrome.
The short version. Your recovery phrase and private keys are created on your device, encrypted with your PIN or passcode, and never sent anywhere. We run no account system, no analytics, no advertising and no tracking. The wallet does talk to VORA Chain's public node and explorer to show your balances and send your transactions, which means those services see your addresses — that is how every blockchain wallet works, and it is described below.
1. Your keys and recovery phrase
The wallet generates your recovery phrase and private keys on your own device. They are sealed with AES-256-GCM under a key stretched from your PIN with scrypt, and stored in the device's keystore (Android Keystore, iOS Keychain) or, in the web wallet, in that browser's storage.
They are never transmitted, never backed up to us, and never readable by us. Nobody can recover them for you — not VORA, not your phone's manufacturer. Write the twelve words down and keep them somewhere safe.
2. What stays on your device
- The encrypted wallet, your account list and labels, and any photo you set as an account picture.
- Your settings: currency, auto-lock, which tokens are shown, the networks you enabled.
- A local copy of recent activity so the history screen opens without waiting.
None of this is sent to us, except where account sync is on — see section 4.
3. What leaves your device
A wallet has to reach a blockchain to be useful. When you use VORA Wallet, your device makes requests to these services, which will see your IP address and what you asked for:
- VORA Chain's public node (vorascan.io) — to read balances, prices from VoraDEX pools, and to broadcast the transactions you sign. Requests contain your wallet addresses.
- VoraScan, the block explorer — for your transaction history and token lists. Requests contain your wallet addresses.
- DefiLlama and CoinGecko — for token prices and market figures. These requests carry token identifiers, not your addresses.
- open.er-api.com — daily currency rates, so balances can be shown in your currency. No personal data is sent.
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — the desktop wallet and this website load their typefaces from Google, which sees your IP address and browser. No wallet data is sent.
- WalletConnect (Reown) relay — only when you connect to an app by QR code or link. Messages are end-to-end encrypted between your wallet and that app.
Everything above is a direct request from your device to that service. We do not receive a copy, and we do not add identifiers of our own.
4. Account sync, and how to switch it off
The wallet can keep your list of accounts — how many you have added and what you named them — so that restoring your phrase on another device brings them back. It is on by default and works like this:
- The list is encrypted on your device with a key derived from your recovery phrase before it leaves.
- It is stored at app.vorawallet.com under an identifier derived from the same phrase. The server holds ciphertext and that identifier — no addresses, no names, no keys, and nothing we can decrypt.
- Switching it off in Settings → Account sync deletes the stored copy from the server.
Your recovery phrase and private keys are never part of this or any other upload.
5. Connecting to apps
When you connect the wallet to an app — by QR code, by link, in the in-app browser or through the browser extension — that app is given your wallet address and can ask you to sign. Every signature and every transaction is shown to you first and needs your approval, and your PIN, passcode or biometric check, before anything is signed. Connecting on its own moves nothing.
What an app does with your address is governed by that app's own privacy policy, not this one.
6. The in-app browser
The phone app can open web apps inside the wallet. Those pages are ordinary web pages: they see your IP address like any browser visit, and cookies or storage they create stay inside the app's browser. A site gets your wallet address only after you tap Connect for that site, and you can withdraw it at any time from dApps → Sites in the wallet browser → Forget.
7. The browser extension
The VORA Wallet extension for Chrome keeps the same promises as the other wallets, in the browser:
- On your computer only. The wallet is sealed with AES-256-GCM under a key stretched from your passcode with scrypt, and kept in Chrome's storage for the extension, together with your account list, the sites you connected and your auto-lock setting. Whether the wallet is unlocked, and the transactions you sent until they confirm, are kept in session storage that Chrome clears when the browser closes. The passcode itself is never stored.
- One outside service. The extension talks only to VORA Chain's node and explorer at vorascan.io — for balances, prices from VoraDEX pools, history and sending the transactions you approve. Those requests contain your wallet addresses. After you import a recovery phrase it also asks the explorer which of the phrase's addresses have been used before, so your accounts come back. Its typefaces and images ship inside the extension; there are no analytics and no other requests.
- Websites. The extension offers a wallet to the pages you visit, so that apps such as VoraDEX can ask to connect. It does not read, store or send the content of pages or your browsing history. A site learns your address only after you approve a connection for that site and that account, and every signature and transaction is shown to you and needs your passcode first. You can disconnect a site at any time in Settings → Connected sites.
- Permissions. Storage to keep the encrypted wallet and your settings; alarms for auto-lock; access to vorascan.io for the requests above; and running on websites, which is how a page can find the wallet.
8. Phone permissions
- Camera — only to scan QR codes. Images are processed on the device and never stored or uploaded.
- Photos — only if you choose a picture for an account. It stays on the device.
- Notifications — optional. Alerts are raised locally by the app about your own transfers and requests waiting for you; no push service is involved and nothing is sent to a server.
- Face ID / fingerprint — optional, to unlock the wallet. The check happens in the operating system; the wallet never sees your biometrics.
9. Children
VORA Wallet is not directed at children and is not intended for anyone under 18. We do not knowingly collect information from children.
10. Deleting everything
Uninstalling the app or the extension, or using Settings → Remove wallet, erases the encrypted wallet and every local record from that device. If account sync was on, switch it off first — that deletes the stored copy from the server as well. Anything already written to the VORA Chain blockchain is public and permanent, and cannot be deleted by anyone.
11. Changes and contact
If this policy changes, the date at the top of this page changes with it, and the new version is published here before it applies.
Questions about privacy in the wallet can go to the VORA team on Telegram or X.