Overview

W2QR performs all cryptographic operations entirely in your browser. Your seed phrase, password, and private keys are never sent to any server. In Advanced mode, the W2QR server stores only encrypted material that cannot be used to access your wallet without your password.

Data that stays on your device

• Your seed phrase (exists in browser memory only during derivation — never stored)
• Your password (used only for key derivation — never stored or transmitted)
• Encrypted QR payloads (generated and decoded locally)
• Derived signing keys (held in browser memory or wallet extension, session-scoped)
• WebAuthn credentials and device-bound authorization secret (Advanced mode)
• R2 recovery share (Advanced mode, stored locally via WebAuthn)

Data we never receive

• Your seed phrase or any derivative private keys
• Your password
• Your Recovery Code (no longer generated for new wallets)
• Your Ethereum addresses or transaction data
• Any analytics on cryptographic operations or signing sessions
• Browser fingerprints or device identifiers

Data stored on the W2QR server (Advanced mode only)

When you use Advanced mode with Google sign-in, the following encrypted data is stored on the W2QR server:

• KEK-wrapped authorization secret (S) — encrypted with a server-side key envelope
• KEK-wrapped R1 recovery share — one of three Shamir shares
• KEK-wrapped TOTP secret — encrypted authenticator secret for Google Authenticator unlock, never included in QR codes
• Encrypted QR backup — your encrypted payload, retrievable via Google sign-in
• A hashed Google subject ID — used to link your records, not your Google email or name
• Device credential public keys — WebAuthn public keys for registered biometric devices
• A random wallet identifier (w2qrId) — never your wallet address

This data is encrypted under a KEK (Key Encryption Key) and cannot be decrypted by the server. Without your password, the stored authorization secret is useless. Without 2 of 3 recovery shares, the R1 share alone cannot recover your wallet. TOTP secrets are associated with w2qrId (not wallet address) and are KEK-encrypted at rest.

When verifying a TOTP code, the server checks the 6-digit code against the stored encrypted secret. If valid, it releases the encrypted authorization secret. The server never learns your password, seed phrase, or what the authorization secret protects — it only confirms the time-based code is correct.

W2QR Cards produce wallets through honey encryption. The server cannot determine which wallet a card will produce — every password yields a valid mnemonic. Card activation follows the same privacy model as regular Advanced wallet creation.

Google sign-in

When you sign in with Google in Advanced mode, W2QR receives your Google subject ID (a unique identifier) to link your encrypted records. W2QR does not access your Google contacts, files, browsing history, or any other Google data. The OAuth scope is limited to basic profile identification.

Wallet extensions

The W2QR Remote Signer extension and the W2QR Connect Snap (for MetaMask) run locally in your browser. They store imported account data in the extension's or MetaMask's encrypted state. Neither makes external network requests. Signing sessions are time-limited and expire automatically.

Third-party services

The application is hosted on Vercel, which may log standard HTTP access data (IP address, user agent, request timestamp) as part of normal CDN operation. The Find Non-zero Balances feature sends your public address (not private keys) to the Ankr API on the server side for balance lookups. No third-party analytics, tracking, advertising, or telemetry scripts are included in the application.

Cookies and local storage

W2QR does not use tracking cookies. Local storage is used only for user preferences (theme, display settings) and optionally for wallet history (names and receive QR codes of previously opened wallets) — all controlled by toggles in Settings. Authentication sessions (NextAuth) use secure, HTTP-only cookies.

Rate limiting

API routes that release encrypted secrets (authorization secret, recovery shares) use per-user, per-wallet, and per-IP rate limiting. IP addresses used for rate limiting are processed in memory and not stored persistently.

Data deletion

You can delete your security record from the W2QR server at any time. Deletion permanently removes all server-stored data associated with your w2qrId: the encrypted authorization secret, the R1 recovery share, the TOTP secret, device credential public keys, and the Google subject hash. After deletion, server-assisted unlock and recovery are no longer available — only your QR code and password remain. Deletion cannot be undone.

Changes to this policy

If this privacy policy changes, the updated version will be posted on this page with a revised date.

Contact

For questions about this privacy policy, contact alex@vir-tec.net.