BAKvault

BAKvault Privacy Policy

BrainArk's Self-Custodial Cryptocurrency Wallet

Applies to BAKvault 1.6.4 and later

1.Who We Are

BAKvault is a self-custodial cryptocurrency wallet developed for the BrainArk ecosystem. It is provided as part of the BrainArk infrastructure ecosystem and supports BrainArk Chain and other supported blockchain networks.

For purposes of this Privacy Policy, “BAKvault,” “we,” “us,” and “our” refer to the BAKvault wallet application and the entity responsible for operating the BAKvault services. “You” or “user” means the person using BAKvault.

BAKvault is available in multiple forms: a browser extension (Google Chrome and Mozilla Firefox), an Android application, and a web wallet. These versions share the same core wallet logic while using platform-specific storage and session mechanisms.

2.Scope of This Policy

This Privacy Policy applies to information processed through BAKvault, including the wallet's user interface, local wallet storage, supported wallet features, the Vault/co-signing functionality, and the BAKvault web wallet and related service infrastructure.

This Policy does not govern third-party websites, decentralized applications (DApps), blockchain networks, exchanges, token issuers, analytics providers, or other services that you may access through BAKvault. Those services have their own privacy practices and terms.

3.Our Privacy Principles

• Self-custody: Your recovery phrase and private keys stay under your control and are encrypted on your device.
• No advertising: BAKvault shows no advertising.
• No analytics or behavioral tracking: BAKvault contains no telemetry, analytics, or tracking.
• Minimal service data: The Vault co-signing service stores only information necessary to operate passcode authorization and recovery functions.
• Transaction transparency: Blockchain transactions are recorded on public networks and may be publicly visible independently of BAKvault.

4.Information We Do Not Collect or Control

Because BAKvault is self-custodial, we never receive or hold your wallet's private keys or recovery phrase. They are encrypted with your password and stored only on your device.

We cannot recover a user's ordinary wallet private key or recovery phrase. If a user loses the recovery phrase and does not have another supported recovery method, access to the corresponding self-custodial wallet may be permanently lost.

BAKvault does not collect telemetry, advertising identifiers, behavioral analytics, or tracking data.

5.Information Processed Locally on Your Device

To provide wallet functionality, BAKvault necessarily processes certain information locally on your device. Depending on the features you use, this can include:

• Recovery phrase and/or imported private keys.
• Public wallet addresses and account information.
• Encrypted wallet data and wallet settings.
• Selected blockchain networks and custom network configuration.
• Token, NFT, transaction-history, and balance information retrieved from supported networks.
• Wallet connection permissions and per-site DApp preferences.
• Vault configuration and locally maintained session state.

Private keys and the recovery phrase are encrypted using PBKDF2-SHA256 with 310,000 iterations and AES-GCM-256, with a fresh salt and nonce for each encryption operation. Your password is never stored.

6.Wallet Encryption and Key Handling

By default, the decrypted key is kept only while the wallet is unlocked. In the browser extension it is held by the extension's background process (the Manifest V3 service worker in Chrome, the background page in Firefox) rather than the popup. In the Android application it is held in application memory. In the web wallet it is held in the open page. When the wallet locks — the Lock button, the auto-lock timer you choose, or closing the browser or app — the decrypted key is discarded.

Wallet screens receive public addresses rather than raw private-key material, to reduce unnecessary exposure of sensitive wallet information.

Optional: "Ask for password to open the wallet" (Settings → Security, on by default). If you turn it off, BAKvault keeps the unlocked wallet — its private key and recovery phrase — on your device so that it opens without your password, and it no longer locks itself when idle:

• in the browser extension, in the browser's extension storage (chrome.storage.local) for your browser profile;
• in the Android application, in a separate file in the app's private storage that is excluded from Android backups and device transfers;
• the web wallet never keeps it, whatever the setting.

This kept copy is not protected by your password: anyone who can use your device account or browser profile can open the wallet and move its funds. It never leaves your device. Pressing Lock, or turning the setting back on, deletes it immediately. The wallet warns you before you turn this off.

Optional: "Ask for password when sending" (on by default). If you turn it off, Bitcoin and Solana sends are signed with the recovery phrase from the unlocked session instead of asking for your password each time. This works only while the wallet is unlocked; nothing extra is stored.

No security system can guarantee absolute security. Users are responsible for protecting their device, password, recovery phrase, private keys, and other authentication information.

7.The BAKvault Vault and Co-Signing Service

BAKvault includes an optional smart-contract Vault that adds a second authorization layer to protected funds. A protected withdrawal requires the user's wallet signature and a second signature from the BrainArk co-signing service.

The co-signing service does not receive the user's private key and, by design, its signature alone cannot move funds. The smart contract verifies both signatures and binds the authorization to transaction-specific information such as destination, amount, network, nonce, and approved call data.

To operate this feature, the co-signing service may process:

• A salted and peppered hash of the user's Vault passcode.
• An optional email address, where supplied for recovery.
• Failed-attempt information and temporary lockout information.
• Short-lived password/passcode reset codes.
• Technical information necessary to process a specific co-signing request, such as the relevant vault, network, nonce, transaction parameters, and signature authorization data.

The service never stores the passcode itself and never writes it to logs.

8.Passcode Recovery

If you use the Vault passcode-recovery feature, BAKvault processes an email address and a temporary recovery code. Resetting a passcode costs a one-time fee of 1 BAK, paid on the BrainArk blockchain. Recovery information is used only for the recovery process and never for advertising or behavioral profiling.

Users should ensure that the email address used for recovery is controlled by them and adequately protected. BAKvault cannot guarantee the security of third-party email providers.

9.Blockchain and Publicly Available Information

Blockchain networks are generally public ledgers. When you send, receive, stake, bridge, swap, mint, approve, or otherwise interact with a blockchain, transaction data may be permanently recorded on that network and publicly accessible.

Public blockchain information may include wallet addresses, transaction hashes, token amounts, contract interactions, timestamps, and other information defined by the relevant blockchain protocol. This information is not controlled by BAKvault and may be copied, indexed, analyzed, or combined with information from other sources by third parties.

Because blockchain transactions can be immutable, deleting information from BAKvault does not delete information already recorded on a public blockchain.

10.Supported Networks and Assets

BAKvault supports BrainArk Chain (chain ID 1236), BNB Smart Chain (chain ID 56), Ethereum (chain ID 1), Bitcoin, and Solana, and lets you add other EVM networks.

Users can also add networks from the BAKvault network registry, a public list of EVM networks whose operators have listed them ("Community listed"). BAKvault checks that a listed network's RPC endpoints answer for the stated chain ID and that its explorer is reachable; it does not vouch for the network itself or the assets on it. When a network operator lists a network, the registry records the listing details and the wallet address that paid the listing fee (which is also visible on the BrainArk blockchain).

Information obtained from blockchain nodes, RPC endpoints, token contracts, NFT contracts, and DApps is processed to display balances, transactions, assets, and other wallet functionality.

Services your device contacts directly. To read balances and send transactions, the wallet talks to public blockchain services. Each of them receives your public address and, when you send, the signed transaction — never your private key, recovery phrase or password:

• BrainArk: rpc.brainark.online (operated by BrainArk).
• BNB Smart Chain: Binance / BNB Chain public nodes (bsc-dataseed.binance.org, bsc-dataseed.bnbchain.org, bsc-dataseed1.defibit.io), PublicNode, dRPC and 1RPC.
• Ethereum: PublicNode, dRPC, 1RPC and Flashbots Protect (rpc.flashbots.net).
• Bitcoin: Blockstream (blockstream.info), mempool.space and BlockCypher, to read balances and fees and to broadcast transactions.
• Solana: PublicNode (solana-rpc.publicnode.com).
• Networks you add yourself: the RPC address you enter or choose.
• Images: some meme-coin and NFT images on BrainArk are loaded from BrainArk's IPFS gateway on Pinata (mypinata.cloud), which sees your IP address but not your wallet address.

Links you open yourself — for example "View on explorer", which opens explorer.brainark.online, mempool.space or Solscan — are ordinary web pages governed by those sites' own policies.

11.Token, NFT and Price Information (BAKvault Asset Service)

To show the tokens and NFTs a wallet holds, with their names, logos and prices, BAKvault uses the BAKvault asset service operated at bakvault.brainark.online. When the wallet's home screen loads, the app sends the service the wallet's public address and the network (chain ID) to check. No private key, recovery phrase, password or passcode is ever sent.

• What the service does with the address: it looks up which tokens and NFTs the address holds — on BrainArk from its own index of public blockchain transfers; on other networks by asking public Blockscout block explorers and public RPC nodes (for example, checking the address's balance of tokens on public token lists). Those providers therefore receive the address in the course of the lookup, from our server rather than from your device.
• Prices and logos: prices are fetched by token contract address from CoinGecko, DexScreener and directly from decentralized-exchange pools (such as PancakeSwap, Uniswap and QuickSwap); logos come from CoinGecko, Trust Wallet's public assets list, token lists and ChainList. These requests contain token and network identifiers only — never your address. Images are copied to and served from bakvault.brainark.online, so your device does not contact those third parties to display them.
• Spam protection: tokens and NFTs flagged as scams, and tokens that falsely report a balance for every address, are hidden.
• Retention: lookup results are kept in the service's memory for a few minutes so repeated screens load faster, and are not written to a database. The web server's access logs, which record the requested address of each lookup together with the visitor's IP address, are kept for 14 days (see section 16).

You can avoid the lookup only by not using the wallet's home screen on a network connection; it is part of how BAKvault shows your assets. The public RPC nodes your wallet uses to read balances and send transactions likewise see your address, as with any blockchain wallet.

12.DApp and Website Connections

BAKvault supports the EIP-1193 provider standard and EIP-6963 wallet discovery. When a website or DApp requests access, BAKvault is designed to require user approval for the connection and for individual signing or transaction operations.

The wallet may remember connection preferences on a per-site basis. Users can select whether a DApp should interact with a plain wallet account, a Vault account, or an automatic account-selection mode.

When interacting with third-party DApps, the DApp may receive the wallet address and other information that is necessary for the requested interaction. Users should review the privacy policy and terms of each DApp before connecting their wallet.

13.Browser Extension Permissions

The BAKvault browser extension requests the following:

• storage — to keep the encrypted wallet, settings and approved sites on your device.
• alarms — to lock the wallet automatically after the inactivity period you choose.
• sidePanel (Chrome) / sidebar (Firefox) — to let you open the wallet in the browser's side panel.
• Access to bakvault.brainark.online — the co-signing, asset and network-registry services described above.
• A script on https websites. Like other Web3 wallets, BAKvault places a small provider script on web pages so that decentralized applications (DApps) can find the wallet (EIP-1193 / EIP-6963). The script does not read, record or change page content, and does not track the sites you visit. A website receives nothing — not even your public address — until you approve it in a BAKvault window, and every signature or transaction requires its own approval. The extension determines which site is asking from the browser itself, so one site cannot pose as another you approved. You can review and disconnect approved sites at any time in the extension under Settings → Connected sites.

Firefox data-collection declaration. In Firefox, BAKvault declares the data it transmits: financial and payment information (required — your public wallet address and the assets and transactions associated with it, sent to the asset service and blockchain providers as described above); authentication information (optional — your Vault passcode, sent to the co-signing service only if you enable Vault protection); and personally identifying information (optional — an email address, only if you set up passcode recovery).

Extension permissions may change in future releases when new functionality is introduced. Any updated extension permissions should be reviewed against the functionality they support before installation.

14.Android Application

The BAKvault Android application is built with Capacitor. It stores the password-encrypted wallet in the app's private storage, which other apps cannot read. While unlocked, the decrypted key is held in application memory (see section 6 for the optional "stay unlocked" setting).

The Android application includes an in-app DApp browser. Websites opened in it may collect information under their own privacy policies. Text typed in its address bar that is not a web address is sent to DuckDuckGo as a search.

WalletConnect (Android only). To connect to a website opened in your phone's regular browser, the app uses WalletConnect. Connection requests and approvals travel end-to-end encrypted through WalletConnect's relay servers (operated by Reown), and WalletConnect's Verify service is asked whether the requesting site's domain is genuine. The relay sees encrypted messages and connection identifiers, not your private key. From version 1.6.4, WalletConnect's optional usage reporting is switched off; earlier Android versions (up to 1.6.3) left the library's default on, which sent WalletConnect anonymous connection events such as pairing errors. The browser extension and the web wallet do not include WalletConnect.

15.Web Wallet

The BAKvault web wallet is available at bakvault.brainark.online/app. The web version is convenient but has a different security model from the packaged extension because its application code is delivered from the web server when the site is visited.

Users should understand this distinction and consider the extension or another appropriately secured wallet environment for higher-value long-term storage. This statement is a security consideration, not a guarantee of the security of any particular environment.

16.Information We May Receive From Service Interactions

Where the BAKvault co-signing or recovery service is used, the service may necessarily receive technical request information needed to authenticate and authorize the requested operation. This may include request timestamps, vault and network identifiers, transaction authorization parameters, passcode verification results, rate-limiting state, and temporary recovery information.

Like most web servers, the BAKvault servers keep access logs: the visitor's IP address, the time, the requested path (which, for asset lookups, includes the public wallet address being looked up), the response status and the browser's user-agent string. These logs are used for security, abuse prevention and troubleshooting, are rotated daily and are deleted after 14 days. They are not used for analytics, advertising or profiling.

17.How We Use Information

Information processed by BAKvault is used for purposes including:

• Providing wallet creation, import, unlocking, account, transaction, token, NFT, and network functionality.
• Encrypting, storing, and retrieving wallet data locally.
• Processing Vault authorization and co-signing requests.
• Detecting failed passcode attempts and applying rate limits or temporary lockouts.
• Providing passcode recovery where the user chooses to use that feature.
• Displaying blockchain balances, transactions, NFTs, and other public ledger information.
• Maintaining DApp connection and signing functionality.
• Protecting the security and integrity of the wallet and related services.
• Complying with applicable legal obligations where such obligations apply.

BAKvault is not designed to use wallet activity for advertising, behavioral profiling, or sale of personal information.

18.Information Sharing and Disclosure

BAKvault does not sell or rent users' personal information, and contains no advertising, analytics, telemetry, or tracking.

Information may nevertheless be disclosed or become accessible in the following circumstances:

• Blockchain networks: transactions and public addresses are visible on the relevant public ledger.
• Third-party DApps: information you authorize a DApp to receive is shared with that DApp.
• Blockchain data providers: to find the tokens and NFTs a wallet holds, the BAKvault asset service sends the public wallet address to Blockscout block explorers and public RPC nodes (section 11). Price and logo providers (CoinGecko, DexScreener, decentralized-exchange pools, Trust Wallet assets, ChainList) receive token and network identifiers only.
• Blockchain service providers your device contacts: the RPC nodes and Bitcoin/Solana services listed in section 10 receive your public address and the transactions you send.
• WalletConnect / Reown (Android app only): relays encrypted connection messages and checks site domains (section 14).
• Infrastructure providers: our hosting providers (including Contabo), DNS, email delivery for passcode recovery, and similar technical providers process technical information to operate the services.
• Legal requirements: information may be disclosed where required by applicable law, legal process, court order, or to protect legal rights and security.
• Business changes: information may be transferred as part of a merger, acquisition, restructuring, asset transfer, or similar transaction, subject to applicable law.

19.Data Retention

Wallet secrets stored locally remain on the user's device until the user removes them or the application/device storage is otherwise cleared. A kept unlocked session (section 6) is deleted when you press Lock or turn "Ask for password to open the wallet" back on. Blockchain records are retained by the relevant blockchain network according to that network's protocol and cannot generally be deleted by BAKvault.

Vault recovery codes are short-lived, and failed-attempt and lockout information is kept by the co-signing service. Web-server access logs are deleted after 14 days; asset-lookup results are held in memory for minutes only; network-registry listings are kept while the network is listed. Where a specific retention period is not stated, information is intended to be retained only as reasonably necessary for the purpose for which it is processed, security, legal compliance, dispute resolution, and legitimate operational needs.

20.Data Security

BAKvault protects wallet and service data with local encryption, AES-GCM integrity protection, password-based key derivation, session auto-locking, limited extension permissions, transaction-specific co-signatures, nonces, expiring co-signing approvals, and an emergency Vault exit mechanism. All communication with BAKvault services and the built-in blockchain providers uses HTTPS (TLS).

Security testing. The BrainArk team tests BAKvault with industry-standard open-source security tools:

• Vault smart contracts: static analysis with Slither and Aderyn (no critical, high or medium issues confirmed), and more than 500,000 calls of Echidna property fuzzing run as an attacker who holds the owner key — no BAK left a protected vault, no forged co-signature was accepted, and the emergency exit never opened early.
• Wallet and server code: Semgrep code scanning, gitleaks secret scanning and osv-scanner dependency checks; every finding was fixed or reviewed, and the co-signing service fixes were deployed on 12 October 2026.
• Live service: OWASP ZAP web scanning of bakvault.brainark.online.
• Every release: 591 automated tests (smart-contract, unit and end-to-end tests in a real browser), plus an automatic check of the built extension's permissions and of its dependencies against published security advisories.

Things to be aware of:

• The Vault co-signer runs on one BrainArk server with one key. If that server is down, withdrawals from a protected Vault wait until it is back, or you can use the emergency exit (section 21) after four days. The co-signer can never move your funds on its own.
• "Ask for password to open the wallet" protects your funds. If you turn it off, anyone who can use your computer or phone can open your wallet and send your funds (section 6). Leave it on unless the device is used only by you and has its own screen lock.
• The web wallet loads its code from our website every time you open it. The browser extension and the Android app are installed on your device instead, so they are the safer choice for larger amounts.

Users remain responsible for device security, operating-system updates, browser security, password security, recovery-phrase security, and verifying transactions before signing.

21.Emergency Vault Exit

The Vault includes an emergency exit mechanism. If the co-signing service becomes unavailable, the contract lets the user request an exit and, after a four-day silence period, withdraw using the wallet key without the co-signer.

This mechanism is implemented at the smart-contract level and is subject to the rules of the deployed contract and underlying blockchain.

22.Browser Extension Store Disclosures

BAKvault's use of information received through its browser extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements, and to Mozilla's add-on policies. Specifically: information is used only to provide and improve the wallet features described in this Policy; it is not sold; it is not transferred to third parties except as described in this Policy to provide those features, for security, or as required by law; it is not used for advertising, credit-worthiness or lending decisions; and no human reads it except with your permission, for security purposes, or as required by law.

23.Children's Privacy

BAKvault is not directed to children. Users should not use the service where doing so would violate the laws applicable to them. BAKvault does not collect children's personal information for advertising or profiling.

24.International Use

BAKvault may be used by people in different countries. Blockchain networks and technical service providers may operate across jurisdictions, and information processed through those systems may therefore be transmitted or accessible internationally.

Users are responsible for determining whether use of cryptocurrency, blockchain, tokenized assets, staking, bridging, or related services is lawful in their jurisdiction.

25.Your Privacy Rights

Depending on your jurisdiction, you may have rights relating to personal information, such as rights to access, correction, deletion, restriction, objection, portability, or withdrawal of consent where applicable.

Because BAKvault is self-custodial and blockchain data may be immutable and public, some requests cannot technically be fulfilled in relation to blockchain records. Where BAKvault or a service provider controls personal information and applicable law provides a corresponding right, requests may be submitted using the contact information published with the service.

26.Cookies and Similar Technologies

BAKvault uses no analytics, telemetry, tracking or advertising cookies.

The wallet uses your device's local storage only for what it needs to work: the encrypted wallet, settings, approved sites and, if you choose, a kept unlocked session (section 6). If BAKvault ever adds analytics or other non-essential technology, this Policy will be updated first and, where required, you will be asked for consent.

27.Third-Party Services and Links

BAKvault may connect to or display information from third-party services, including blockchain networks, RPC endpoints, DApps, email infrastructure, decentralized exchanges, and other Web3 services. These third parties are independent from BAKvault and may process information under their own policies.

BAKvault does not control the privacy, security, availability, or data practices of third-party services. Users should review those services' policies before using them.

28.Changes to This Privacy Policy

We may update this Privacy Policy when BAKvault's functionality, infrastructure, legal requirements, or data practices change.

For material changes, BAKvault may provide notice through the website, application, extension listing, or another reasonable channel where appropriate.

29.Contact Information

Send privacy questions, requests or concerns to:

• Privacy contact: privacy@brainark.online
• Website: bakvault.brainark.online
• Service: BAKvault — BrainArk self-custodial wallet

30.Security and Risk Disclosure

BAKvault is software for interacting with blockchain networks and smart contracts. No software, cryptographic system, blockchain network, device, browser, or online service is completely risk-free. Users should independently verify addresses, transaction amounts, network selections, contract interactions, DApp permissions, and signatures before approving them.

Known limitations include reliance on a single co-signer key for protected Vaults, the optional "stay unlocked" setting described in section 6, and the different security characteristics of the web wallet. The security testing done so far is described in section 20. These may change as the project develops.

31.Summary of Data Categories