Last updated 15 November 2026
Tint Wallet privacy
This policy covers the Tint Wallet app for Android and iPhone and the Tint Wallet browser extension, published by Watafast LLC. In short: the app has no account, we receive no data about you, and below is every service the app talks to.
Scope
This policy applies to the Tint Wallet app for Android and iPhone and to the Tint Wallet browser extension for Chrome, published by Watafast LLC. Everything below is about the app, except the section The browser extension. The website has its own policy: site privacy. Questions: support.
What the app collects
- No account and no sign-up. We ask for no e-mail address and no phone number.
- No analytics, no advertising, no crash reporting and no trackers in the app.
- The developer receives no data about you. The app sends nothing to a server of ours, except to the node of Tint's own test network when you use that network.
- The address book, preferences, notification settings, the list of addresses you paid in the last 30 days and the large-payment pause stay on your phone.
Your keys
The recovery phrase and the keys are created and kept only on your device, encrypted. On iPhone, if you turn it on, an encrypted copy is stored in your own iCloud Keychain, which is Apple's service. We never see the phrase or the keys and cannot restore them.
Every service the app talks to
The app talks directly from your device to the services below. None of them is run by us except Tint's own node. Each of them sees the IP address of your connection, by the nature of the request, and the data listed here. Their own privacy policies apply. The app sends no keys, no recovery phrase and no passcode to any of them.
| Service | What it receives | Why |
|---|---|---|
| publicnode.com: Ethereum, BNB Chain, Arbitrum, Polygon, Base, Avalanche, OP Mainnet, Celo, HyperEVM, and the Sepolia and BNB Chain test networks | Your public address, balance and history requests, and the transactions you send | Node access: showing balances and sending payments |
| rpc.zora.energy and rpc.xlayer.tech: the official nodes of Zora and X Layer | The same | Node access |
| Backup nodes, asked only when a node above does not answer: 1rpc.io (Ethereum, Polygon), bnbchain.org (BNB Chain), arbitrum.io (Arbitrum), base.org (Base), avax.network (Avalanche), optimism.io (OP Mainnet), celo.org (Celo), hyperliquid.xyz (HyperEVM), drpc.org (Zora), okx.com (X Layer), tenderly.co (Sepolia) | The same | Node access when the first node is down |
| blockstream.info and mempool.space: Bitcoin | Your public addresses and the transactions you send | Balances, history and sending |
| litecoinspace.org: Litecoin | Your public addresses and the transactions you send | Balances, history and sending |
| api.mainnet-beta.solana.com: Solana | Your public address and the transactions you send | Node access |
| api.trongrid.io (TronGrid): Tron | Your public address and the transactions you send | Node access |
| Public Monero nodes (xmr-node.cakewallet.com, xmr.privex.io, node.sethforprivacy.com) | The blocks the wallet asks for and the transactions you send. The view key stays on the phone: the blocks are checked there | Finding your balance and sending |
| open-api.openocean.finance (OpenOcean) | For a swap or a meme coin trade on an Ethereum-family network: your address, the coins, the amount and the network. Its token list also gives the dollar prices the app shows | Swap routes and the transaction to sign, token list and prices |
| app.across.to (Across) | For a transfer between networks: your address, the coins, the amount and both networks; later the status of the transfer | Quotes and tracking of transfers |
| 1click.chaindefuser.com (NEAR Intents) | For a transfer through NEAR Intents: your refund address, the recipient address, the coins, the amount and the networks; later the status. Its token list gives some dollar prices | Quotes, deposit address and tracking of transfers |
| public.pimlico.io (Pimlico) | Only when you pay a network fee in USDC: the operation to be sent, which is public on the network | Sending with the fee paid in USDC |
| lite-api.jup.ag (Jupiter) | For a meme coin trade on Solana: your public address, the coins and the amount | Swap quotes and the transaction to sign |
| api.dexscreener.com and cdn.dexscreener.com (DexScreener) | The contract addresses of tokens and their networks: the token you look at and the coins of the meme market. Not your address | Liquidity mark on tokens; prices, market cap, 24-hour change and pictures in the meme market |
| eth.blockscout.com and celo.blockscout.com (Blockscout) | Only when you make a tax report: your public address on Ethereum or Celo | Reading your transfer history for the report |
| coins.llama.fi (DefiLlama) | Only when you make a tax report: the coins' contract addresses and the dates. Not your address | Dollar prices on the dates of your operations |
| tokens.uniswap.org (Uniswap) | Nothing but the request itself: the app downloads the curated list of official tokens, at most once a day | The tick on official tokens |
| node.tint.top (Tint's own node) | When you use the Tint test network: the finished payment and the IP address it came from. Not your keys or amounts | Tint test network payments and balance checks |
While the app is open it checks your balances on the networks about once a minute, to tell you about money that arrived. Those checks go to the same node services as above.
The built-in browser (iPhone)
The browser opens the websites you type in, so those sites see your IP address and what you do on them, and the search engine you choose (DuckDuckGo by default; Startpage, Brave, Yandex and Google are the others) sees your search words. The lists that block ads, trackers and known scam sites are part of the app and are not downloaded. Pages cannot reach the wallet. Browsing data is kept in memory and erased when you close the browser or press “Burn”.
Fees
The fee Tint takes on swaps, transfers, meme coin trades and the return of SOL rent is part of the transaction you sign. It is shown before you confirm, and it is visible on the public network like the rest of the transaction.
The faucet button
The faucet button opens tint.top in your phone's browser. There the site privacy policy applies.
Notifications
Notifications are made on the phone by the app while it is open. The app sends nothing to Apple's or Google's notification servers and has no push messages.
Permissions
- Internet access, to reach the services above.
- Face ID or fingerprint, if you use it, is checked by the phone. The app gets only a yes or no.
- Notifications, if you turn them on. The phone asks.
The browser extension
The Tint Wallet extension for Chrome works with the 11 Ethereum-family networks, the Sepolia and BNB Chain test networks, Bitcoin, Litecoin, Solana, TRON and Monero, and makes swaps inside a network and transfers between networks. It talks straight from your browser to the services below, each only when the feature that needs it is used. Every one of them sees the IP address of your connection. None of them receives your recovery phrase, keys or passcode.
- No account and no sign-up. No analytics, no advertising, no crash reporting, no trackers and no code loaded from outside the extension. The developer receives no data about you.
- The recovery phrase is created or imported in the extension and kept only on your computer, encrypted with your passcode (XChaCha20-Poly1305, with the key derived by Argon2id). There is no cloud copy.
- While the wallet is unlocked, only the key derived from your passcode is held in the browser's session storage, in memory. It is removed when the wallet locks or the browser closes. The wallet locks itself after 15 minutes without use, or after 5, 60 or 240 minutes if you choose.
- Unlocking with the computer's own sign-in (Touch ID, Windows Hello) is off until you turn it on. When it is on, a second copy of that session key is stored, sealed with AES-256-GCM under a key the computer gives only after it has verified you. Anyone who can sign in to the computer can then open the wallet without the passcode.
- Stored on your computer, in the extension's own storage: the encrypted phrase, the wallet's public addresses, the list of sites you connected with their network, your settings (language, network, lock time and glass transparency), the swaps and transfers in progress, and for Monero what the wallet has read of the chain, sealed with the session key. The balances shown last are kept only in session storage and are removed when you lock the wallet.
- Ethereum-family networks: the publicnode.com nodes (Ethereum, BNB Chain, Arbitrum, Polygon, Base, Avalanche, OP Mainnet, Celo, HyperEVM, and the Sepolia and BNB Chain test networks), rpc.zora.energy (Zora) and rpc.xlayer.tech (X Layer). Only when one of them does not answer, the same request goes to a second node run by someone else: the network's own public node, dRPC for Ethereum, Polygon and Zora, or Tenderly for Sepolia. These nodes receive your public address, balance, fee and gas requests and the transactions you send.
- TRON: tron-rpc.publicnode.com, then api.trongrid.io when that one does not answer. Bitcoin: blockstream.info, then mempool.space. Litecoin: litecoinspace.org. Solana: solana-rpc.publicnode.com and public.rpc.solanavibestation.com. They are asked only while that network is shown, and they see that network's address and the payments you send.
- Monero: xmr-node.cakewallet.com, then node.sethforprivacy.com, asked only while Monero is shown. They see which blocks the wallet reads, the payment it hands over and when the wallet is in use, but never a key or your address.
- Swaps and transfers, only when you ask for one: LI.FI (li.quest) for transfers between Ethereum-family networks, OpenOcean (open-api.openocean.finance) for swaps on Ethereum-family networks, and NEAR Intents 1Click (1click.chaindefuser.com) for swaps and transfers with TRON, Bitcoin, Litecoin or Solana. LI.FI and OpenOcean see your address and the swap or transfer asked about. 1Click sees your addresses on both networks and the order.
- A network fee paid in USDT or USDC on Ethereum, BNB Chain, Arbitrum, Polygon, Base or OP Mainnet: Pimlico (public.pimlico.io), asked as soon as such a fee is worked out. It sees your address and the payment.
- Websites: a site sees nothing, not even your address, until you approve it in the wallet's window. Sites connect on Ethereum-family networks only. An approved site sees your address and the network, and can ask for signatures and payments, which you confirm one by one. You can disconnect a site in the extension's window.
- Permissions it asks the browser for: storage (to keep the data above), alarms (for the automatic lock) and access to publicnode.com, rpc.zora.energy, rpc.xlayer.tech and li.quest. The other services answer any page, so they need no permission. On https websites, and on local pages for developers, it adds a small script that only passes a site's requests to the wallet, with the site's address so you see who is asking. It does not read or send the content of the pages you visit.
- Remove the extension and its data on your computer is removed with it. Write down your recovery phrase first.
Age
The app is not intended for people under 18.
Deleting your data
Delete the app and the keys on the device are removed with it. Write down your recovery phrase first, because without it the funds cannot be recovered. We hold no data about you, so there is nothing to delete on our side. The services above keep their own records under their own policies.
Contact
Questions about this policy: hello@wata.fast.