Privacy Policy

Version 1.2.11 — effective «FILL: effective date»

This policy explains what happens to information when you use Nulo. The published source shows the extension's implemented data handling. Hosting, correspondence, authenticator and store processing also depend on the configurations and provider practices identified below.

The short version. Nulo has no accounts, no wallet telemetry, no analytics, no tracking, no advertising and no third-party scripts. The extension sends no wallet telemetry to the Developer; the Developer may receive information you voluntarily submit and the provider-account information described in § 5. Wallet secrets are protected locally as described below; some wallet metadata is stored without application-level encryption, and wallet operation sends the information described in § 5. A few things must leave your device for the wallet to work at all — requests to an Aztec node, downloads of public proving parameters and of the token list, and an optional price lookup — and this policy says what each one is, what it reveals, and which can be turned off or replaced.

This box is a summary. The sections below are the policy.

1. Who is responsible

Nulo is maintained by Alejo Amiras, a natural person resident in Argentina ("the Developer", "I"). There is no company.

Where applicable data-protection law applies, I am responsible as controller for processing carried out for the Nulo website, the passkey relying-party host, the token-list host, and correspondence described below. Independent providers are responsible for processing they determine themselves; providers acting on my instructions are processors.

In Argentina that processing is governed by Law No. 25,326 (Protección de los Datos Personales), and the supervisory authority is the Agencia de Acceso a la Información Pública (AAIP). Where the GDPR or UK GDPR applies to particular processing, the bases stated below apply to it.

Contact: hello@nulo.sh

2. No wallet telemetry; limited website and correspondence processing

I do not operate a backend for the wallet. The one host of mine it contacts by itself, tokens.nulo.sh, serves the same signed file to every wallet and receives no wallet data (§ 5.11). Nulo requires no Developer-hosted account or sign-up. It creates local identifiers for wallet operation, including profile identifiers, but does not use them for wallet telemetry.

Specifically, the extension contains no analytics SDK, no crash or error reporting service, no telemetry, no advertising or marketing tags, no cookies set by me, no fingerprinting, and no third-party scripts. Its content security policy forbids loading remote scripts.

I do not sell personal information or share it for cross-context behavioural advertising. I and the providers identified below process the limited website, correspondence and service data described in this policy. The website nulo.sh and its mailing list are described in the separate Website Privacy Notice.

3. What Nulo stores on your device

Nulo stores wallet state in browser-managed storage. Local storage and network disclosure are separate concerns: some locally stored information is also included in the requests or responses described in § 5.

A profile's data is converted to this form the first time it is unlocked after the update. Exceptions: profile names; a profile not yet unlocked since the update; older transaction entries the wallet cannot attribute to one profile; and records kept while a deletion, a network reset or an account-integrity block is in progress.

Deleting it. Uninstalling or clearing the extension's storage removes its local browser-managed data through the browser's deletion mechanisms. It does not delete exports, device backups, authenticator credentials, blockchain records or copies held by others, and it is not a guarantee of forensic erasure.

4. Your secrets

Normal wallet operation does not send your recovery phrase, master secret or password to the Developer, to RPC providers or to connected applications. Secrets are processed within the extension and your chosen authenticator as needed. User-requested exports and clipboard operations, authenticator synchronisation, and local-prover processing are described separately in §§ 5.8 and 9. Diagnostic redaction has the limitations described in § 8.

Do not send wallet secrets to support contacts, websites or forms. Enter them only into the verified extension's own unlock, import or export flow. I will never ask you for them by email, chat or form.

5. What leaves your device, and to whom

The extension's network functions and the destinations it can open on your request are described below.

5.1 The Aztec node you are connected to

What it is: to read chain data and submit transactions, Nulo sends requests to the configured Aztec node. Remote endpoints use HTTPS; loopback endpoints may use HTTP. Nulo ships with default endpoints operated by a third-party provider so the wallet works on first run.

What the node receives: protocol-defined transaction data, including proofs, public effects and encrypted data, plus ordinary request metadata — your IP address, user agent, timing, and the shape of your requests, which for some requests reveals the contracts and public addresses you are reading.

What Nulo does not send: your recovery phrase, password or master secret are never included in an RPC request. Private-note plaintext is processed locally unless an application or operation intentionally discloses it. Protocol privacy does not eliminate inference, and does not protect information that a transaction makes public.

Your control: Settings → Networks lets you replace any endpoint with one you trust or run yourself. When a network has more than one endpoint, Nulo uses the primary first and, while it fails, the others in the order Settings → Networks lists them. Each endpoint you add can receive the requests described above. Pending transactions may continue to be checked through the endpoint used to submit them, including after you change or remove that endpoint. Changing an endpoint does not withdraw information already disclosed.

What the Developer can see: the default Testnet endpoint uses a provider account belonging to the Developer. Information available to the Developer through that account is aggregate usage statistics — request counts, compute units and cost by network, method, key and request type, and average latency — over selectable periods, and an error log that groups failed requests from the past 3 days by error, method and network.

5.2 Price data (CoinGecko)

What it is: with fiat values enabled, Nulo requests prices for the price identifiers the signed token list names (§ 5.11), and for AZTEC, which prices Fee Juice.

What it reveals: the list is not selected from your holdings, and requests do not include your balances, account addresses or transaction contents. The request carries no cookies and no referrer, and bypasses the browser's HTTP cache. CoinGecko still receives ordinary request metadata and may infer application use from timing or other information.

When: refreshes are scheduled approximately every three minutes during unlocked use, and may also occur on unlock, on re-enabling fiat values, or when refreshing stale interface data. Transaction execution reads cached prices and never triggers a fetch.

Your control: turning off fiat values in Settings disables the feed and clears the cached prices.

5.3 Block explorer links

What it is: transaction rows can link out to a public block explorer.

What it reveals: nothing until you click. When you click, the explorer sees your IP address and the transaction hash you opened, like any website you visit.

Your control: the explorer can be disabled in Settings → Privacy, which removes the links.

5.4 passkey.nulo.sh — the passkey relying-party domain

If you protect a profile with a passkey, the WebAuthn ceremony is bound to the domain passkey.nulo.sh, which I operate. The application response served by my Worker is a static page without scripts and with restrictive response policies; it exists as a cryptographic anchor and contains no application code. Cloudflare may independently serve infrastructure or security responses on that hostname, including challenge pages containing its own scripts.

The extension does not fetch that page. Nulo's passkey ceremony code invokes the browser's WebAuthn API with passkey.nulo.sh as the relying-party identifier; it does not make an HTTP request to that domain or send the passkey secret or PRF output to its web server. Browser and authenticator services may perform their own communications under their providers' policies.

Your browser and selected authenticator process the credential identifier, a random identifier Nulo generates for the passkey, the profile's random value the passkey is used with, and the credential label, "Nulo wallet · " followed by the profile's name. Depending on your provider, passkey credentials and related metadata may be synchronised under that provider's own policies.

If you or a browser visit the domain directly, the hosting provider processes that request like any website request. I do not run analytics on that host.

Legal basis (GDPR): legitimate interests — keeping the domain available and secure — under Article 6(1)(f).

5.5 passkey.nulo.sh and tokens.nulo.sh hosting, contacting me, and the uninstall page

The website nulo.sh, including its mailing list, is described in the Website Privacy Notice. The extension opens it only on uninstall (below) and when you follow a link to it.

Hosting for passkey.nulo.sh and tokens.nulo.sh, the hosts the wallet's functions involve, is provided by Cloudflare, Inc. (privacy policy), which also hosts nulo.sh. Requests to them expose IP addresses, requested URLs and ordinary browser headers to the hosting provider. Information available to the Developer through hosting tools is aggregate traffic statistics (requests, bandwidth, unique visitors and countries) and, for up to the past 30 days, a sample of individual requests showing the time, IP address, country, network, user agent, method, protocol, hostname, requested path, and how the request was cached or filtered. Request logging on the passkey.nulo.sh and tokens.nulo.sh applications is turned off, and the hosting provider's browser analytics are not enabled. This processing supports delivery and security of the hosts, relying on legitimate interests where applicable. The retention information below and the international-processing information in § 12 cover these hosting records.

The Feedback, Report Issue and Report Scam items in the wallet open your own email client addressed to hello@nulo.sh; nothing is submitted to a form service, and no third-party form provider receives anything.

If you email me, I receive what you send — your message, your email address, and any attachments — through the email provider Google LLC (Google Workspace; privacy notice). I use correspondence to respond, investigate reported problems and maintain security, relying on legitimate interests where that basis is available and appropriate. Writing to me is entirely optional. Do not attach wallet secrets, recovery phrases or unencrypted backups.

Retention. Hosting and security records are kept only for as long as the hosting provider makes them available in its dashboard (currently up to 30 days); I do not export or copy them. Correspondence and attachments are retained until the matter is resolved and then for no more than two years. Provider retention is set by each provider's data processing terms: Cloudflare's and Google's. I may retain relevant records longer where necessary to comply with law or to establish, exercise or defend legal claims.

Uninstall page. If you remove the extension, your browser opens the site root, nulo.sh. There is no uninstall survey. The URL the extension configures contains no wallet address and no per-installation identifier. Opening it still exposes ordinary website request metadata, including IP address, browser headers and any cookies applicable to that site, as the Website Privacy Notice describes.

5.6 The extension stores

Google and Mozilla distribute Nulo and see installs, updates and whatever their platforms record, under their own privacy policies. Store dashboards provide aggregate distribution statistics. I may also see information you submit through reviews or support channels, including the account information those platforms display.

5.7 Applications you connect to

When you connect Nulo to an application, that application learns what you approve: typically your account address, and the details of what you ask it to do. Settings → Connected Apps shows what you have granted and lets you revoke it. Disconnecting removes an application's wallet connection permissions; it does not necessarily invalidate authorisations already issued or recorded on-chain. If you turn on Let every site see that Nulo is installed in Settings → Connected Apps, any site you open, and the scripts it runs, learns that Nulo is installed and its version without asking; connecting and sharing an account still ask you.

A bundled content script relays wallet-discovery and connection messages between participating web pages and the extension. It does not scrape page text and does not run browsing analytics. The wallet processes the requesting origin, connection messages and approved application metadata in order to establish and secure connections. The implementation is Nulo's own wrapper plus its bundled wallet-SDK dependency.

5.8 Optional local proving application

When the optional native prover is available, the extension sends proving inputs — which can include sensitive private transaction data — to a process on 127.0.0.1. Production proving requests use HTTPS; a limited HTTP health check may also occur, carrying no proving inputs.

The extension's connection is local. The native application's own processing, storage and network activity are governed by its implementation and its own privacy information, available at its licence (AGPL-3.0-only) and its privacy notice.

5.9 Public proving parameters

Browser-based proving may download public cryptographic reference data from crs.aztec-cdn.foundation, with crs.aztec-labs.com as a fallback, when the required data is not already cached. Those hosts receive ordinary request metadata, including your IP address, timing and the files or byte ranges requested.

These requests download public parameters; they do not upload transaction witnesses. Replacing the RPC endpoint or disabling fiat prices does not disable them.

5.10 The "Get Fee Juice" and "Get private gas" links

What it is: the send screens link to https://testnet.app.unleashed.systems, a bridge application I operate as a separate project: when an account cannot pay a transaction's fee, and on the review screen when paying the fee would publish your address as the fee payer. The link is the same on every network.

What it reveals: nothing until you click. The link carries no account address or other wallet data and opens without a referrer, so a click is an ordinary website visit: the site and Cloudflare, Inc., which hosts it, receive your IP address and browser headers.

After it opens: the application runs on its own. The requests it makes, for example to an Aztec node, are not Nulo's, and this policy does not describe them.

Your control: the site is contacted only if you follow the link.

5.11 tokens.nulo.sh — the token list

What it is: the tokens a wallet shows by default, and the price each one uses, come from one list I publish at https://tokens.nulo.sh/v1/list.json, signed with a key I hold. The extension downloads it once you have accepted the Terms, then about every six hours. After a failed attempt it tries again within minutes, then less often, at most a day apart. Once you have accepted the Terms, you can also ask for it in Settings → Tokens. It keeps a list only if the signature checks out against a key built into the extension and the list is newer than the one it holds; otherwise it keeps what it had.

What it reveals: every wallet requests the same file. The request carries no account address, balance, network, token or other wallet data, no cookies and no referrer. The request bypasses the browser's HTTP cache, so it carries no cached copy's validator. Cloudflare, Inc., which hosts the file, receives your IP address, the time and ordinary browser headers such as the user agent, and can infer from them that you use Nulo. Depending on the browser, the request may also carry an Origin header naming the extension; in Firefox that name is unique to your installation, and the requests of §§ 5.1 and 5.2 may carry it too.

What the Developer can see: what § 5.5 describes for its hosts: aggregate statistics and, for up to the past 30 days, a sample of individual requests, which can include requests for this file.

Your control: no request is made until you accept the Terms. While the extension is installed and the Terms accepted, the regular download cannot be turned off; the default tokens depend on it, and a token you remove stays removed.

Legal basis (GDPR): legitimate interests — delivering a verified list of default tokens and keeping its host available and secure — under Article 6(1)(f).

6. Browser permissions, and what they do and do not cover

Nulo does not request the dedicated history, bookmarks, identity, geolocation or clipboard-read permissions. Broad page access supports wallet discovery and messaging. The extension can receive connection-origin metadata, copy information to the clipboard at your request, and read files you select for import.

7. Cookies

The extension sets no cookies. The website sets no cookies of its own; the hosting provider may set a strictly necessary security cookie, subject to the deployed configuration.

8. Diagnostic logs

Nulo keeps a rolling in-memory log to help diagnose problems, capped in size.

• It is not sent anywhere — there is no remote logging endpoint in the extension.
• The logger redacts recognised sensitive fields and scrubs recognised endpoint URLs to their origin. Redaction is incomplete: logs may contain addresses, transaction identifiers, application details, or sensitive text carried in errors and dependency messages.
• Logs are written to session storage only if you turn on Developer Mode, and turning it off purges the stored copy. Session storage is cleared on a full browser shutdown and restart.
• You can export the log as a CSV file. Review and redact an export before sharing it — attaching it to a public bug report publishes it.

9. Backups and exports you create

Nulo supports both unencrypted and password-encrypted exports.

• For password-profile full backups, file encryption uses the profile password entered during export.
• For passkey-profile full backups, you choose a file-encryption password.
• Unencrypted password-profile and account exports may contain material sufficient to spend funds.
• A passkey-profile backup is always encrypted with the password you choose, and restores with that password alone.

Protect every export, and verify which format you saved. Nulo does not automatically send the Developer copies of your exports, and the Developer cannot revoke an exported copy.

10. Your rights

Depending on the law applicable to you and the processing concerned, you may have rights to access, correct, delete, restrict or obtain a copy of personal data, to object to processing, or to withdraw consent where processing relies on consent.

Contact hello@nulo.sh to exercise applicable rights. I will respond within the applicable legal period and explain any lawful limitation. I may request proportionate information needed to locate records or verify a request, but will never ask for wallet secrets.

I cannot remotely access or delete information held only in your extension. Local deletion does not remove blockchain records, exported files, or records held independently by other providers. You may complain to the competent data-protection authority — in Argentina, the Agencia de Acceso a la Información Pública (AAIP); elsewhere, where applicable, the authority where you live or work.

11. Children

Nulo is not intended for anyone under 18, and I do not knowingly collect anything from children. See the Terms of Use § 3.

12. International processing

Providers used for website hosting and correspondence may process personal data outside your country. For transfers for which I am responsible, the destinations and applicable safeguards are:

• Cloudflare, Inc. (hosting; the United States and Cloudflare's global network): the EU Standard Contractual Clauses with the UK Addendum, and Cloudflare's participation in the EU–US Data Privacy Framework, under Cloudflare's Data Processing Addendum.
• Google LLC (email; the United States): the Standard Contractual Clauses, or another recognised transfer solution, under Google's Cloud Data Processing Addendum, which covers EU, UK and Swiss data.

Contact me for information about those safeguards.

Independent providers — including the node provider, the price API and the block explorer you reach directly from your own browser — describe their own international processing in their privacy notices.

13. Security

Wallet secrets are encrypted at rest with modern authenticated encryption, derived from your password or passkey. The private execution database is encrypted with a profile-specific key. The extension loads no remote code. The token list it downloads is data, used only after its signature is checked (§ 5.11).

The Developer's passkey-host application response contains no scripts; hosting-provider responses and their limitations are described in § 5.4. Keeping that domain and its eligible subdomains secure is part of the passkey security model.

No software is perfectly secure. Nulo has not been audited by an independent security firm, and it cannot protect you from a compromised device. See the Terms of Use §§ 4.7 and 5.

To report a vulnerability, use GitHub's private vulnerability reporting at https://github.com/nulo-sh/nulo/security rather than a public form.

14. Changes to this policy

Each version carries a version number and an effective date, and the current version is published at nulo.sh/privacy. Before materially changing the personal-data processing described here, I will provide the notice required by applicable law and obtain any required consent before the new processing begins. Other changes take effect when published.

15. Contact

Alejo Amiras — hello@nulo.sh

Appendix: extension store data disclosure

For the data-handling declarations required by the Chrome Web Store and Firefox Add-ons. This table summarises handling; it is not a substitute for completing each store's own categories from the actual build.

Nulo's single purpose is to act as a self-custody wallet for the Aztec network. It handles data to provide its wallet features and the supporting functions described in this policy. It does not sell user data, use it for advertising or creditworthiness decisions, or transfer it for purposes unrelated to those disclosed functions. Disclosures to providers and connected applications are described in § 5.

Version history