Privacy Policy — Caribou

Caribou is built so that we learn as little about you as possible — ideally nothing. The wallet runs on your device and keeps your keys there. This website keeps no record of your visit: it counts how often each page is requested, and nothing about who asked. This policy explains what that means, precisely, and names the few places where a third party you choose to interact with will see something.

1. The short version

The Caribou wallet has no accounts and no sign-up. Your keys and recovery phrase never leave your device, and we never receive them.
The wallet sends no analytics or telemetry to us.
This website sets no cookies, runs no trackers, embeds no third-party content, and does not log your IP address. It keeps anonymous totals — such as how many times each page was requested in a day — and no record of any individual visit.
When you use any blockchain — with Caribou or any other wallet — the network's peers and providers necessarily see network-level information such as your IP address. That is inherent to using a network, and we neither control nor collect it.
The optional fiat on-ramp is run by a third party that will collect information from you under its own policy, only if you choose to use it.

2. Who we are and what this covers

Caribou is published by Bisoncraft LLC, a limited liability company organized under the laws of the State of Wisconsin ("Bisoncraft", "we", "us"). This policy covers the caribou.you website and its subdomains (the "Site"), and the Caribou wallet software we distribute (the "Software"). It does not cover third-party networks, services, or websites you may reach through the Software or by following a link — those are governed by their own policies.

Where a law such as the EU or UK GDPR asks who the "controller" of personal information is, for the limited processing described in section 5 it is Bisoncraft LLC, at the address in section 10.

3. The wallet software

Caribou is a self-custodial wallet that runs locally on your device. It is designed to keep your information with you:

Keys stay local. Your recovery phrase and private keys are generated and stored on your device. They are never transmitted to Bisoncraft, and we have no way to obtain them.
No account, no profile. There is no registration, no login, and no user profile held by us.
No telemetry to us. The wallet does not send usage analytics, crash reports, or device identifiers to Bisoncraft.
Local data. Wallet data — such as your addresses, transaction history cache, and settings — is stored on your device under your control. You can remove it by removing the application's data.
Nothing is routed through us. The wallet's connections go directly to the networks and services described below. None of them passes through a server of ours, and we do not see what passes over them.

Network interactions are not private by nature. To show balances and broadcast transactions, the wallet must talk to blockchain networks, and some features talk to other services. This is true of essentially all crypto wallets. What each kind of connection discloses, and to whom:

Blockchain peers and node providers. Depending on the asset and your configuration, the wallet connects either to a network's public peers through a built-in light client, or to independently operated node or RPC endpoints. Whoever is on the other end can see your IP address and the requests your wallet makes, which can include the addresses it asks about and the transactions it broadcasts.
Price and fee data sources. To show values in your local currency and to estimate fees, the wallet requests data from third-party sources. They can see your IP address and what was asked for.
Block explorers. When you open a transaction or an address in a block explorer, the explorer can see your IP address and what you looked up.
Swap counterparties and services. Where the wallet offers swaps, the parties and services involved in a swap can see your IP address and the details of that swap — the assets, the amounts, and the addresses used to settle it.
The optional fiat on-ramp provider, described below.

Blockchains themselves are public ledgers on which your transactions are permanently visible. Where a choice of backend exists, Caribou prefers those that do not impose identity requirements, and surfaces the trade-off when a privacy-preserving option is not available. To reduce what network providers can see, you may route the wallet's traffic through a privacy network such as Tor or a VPN.

The optional fiat on-ramp. If you choose to buy or sell crypto through the wallet's optional fiat gateway, that transaction is handled by an independent third-party provider. The feature is off by default and no other feature depends on it. The provider is named, with links to its own terms and privacy policy, at the point where you choose to enable it. If you use it, your wallet's deposit address and the details of the transaction are sent to the provider, which performs its own identity verification and will associate that address with your verified identity in its records. Your identity documents and payment credentials go to the provider directly; they are never received by, transmitted to, or accessible to Bisoncraft. No provider is named in this version of the policy because none has been finalized. Before the feature is offered in a release, this policy will be revised to name the provider and to state what, if anything, it makes available to us.

4. What we do not collect

Through the wallet and this website, Bisoncraft does not collect:

your name, email address, or any identity documents (unless you email us directly — see section 10);
your keys, recovery phrase, addresses, or balances;
advertising identifiers, device fingerprints, behavioral profiles, or any analytics tied to you or your device (section 5 describes the anonymous totals this website keeps);
cookies or other client-side tracking state from this website.

5. This website

We hold this website to claims you can test. As served from caribou.you:

No visitor IP logging. Your IP address is not written to any web access log, error log, or other file. Standard request logging is disabled, error logging is configured so that it does not record visitor addresses, and no record of any individual request is kept.
No cookies, no trackers, no beacons. The site sets no cookies and stores nothing else in your browser. It runs no third-party analytics, tag managers, pixels, or tracking beacons.
No third party in front of the site. The site is self-hosted on infrastructure we control. There is no content-delivery network, reverse proxy, or other third party positioned between you and our server.
No third-party requests. Every asset the pages load — fonts, images, styles, and any scripts — is served from this domain. Loading a Caribou page causes your browser to make no requests to any other host.
Encryption in transit. The site is served over HTTPS with certificates from a public certificate authority. Certificate-transparency logs publicly record the domain name (this is how certificate transparency works everywhere); those logs are about the certificate, not about you.

Rate limiting, in memory only. To keep the site available, the server counts recent requests per visitor in memory, so that one source cannot crowd out everyone else. There are two such counters. The first, in the web server that receives your connection, is keyed on your address and holds nothing but a request rate; its entries are dropped as later requests arrive. The second, in the program that builds the pages, is keyed on a scrambled form of your address rather than the address itself. For IPv6, where one device usually has many addresses, the scrambling is applied to your network prefix (the first 64 bits) rather than to the full address. An entry in the second counter is discarded within minutes of your last request, and the whole table is cleared at least once an hour regardless. Both counters live only in memory: neither is ever written to disk, neither survives a restart of the server, neither leaves the machine, and neither is used for anything but this.

Anonymous totals. So that we know whether the site is working and which pages are useful, the server adds to a small set of running totals as it answers requests:

how many times each page was requested each day;
on the download page, how many of those requests came from each operating system family the page tells apart (Windows, macOS, Linux, FreeBSD, OpenBSD, or unrecognized), which the server already works out in order to show you the right download;
when your browser names the website that linked you here, that website's name — the name of the site only, never the address of the page you came from — and how many page requests arrived from it each day. A referring site that is a bare IP address, or a name on a private network, is not counted at all;
how many requests each hour received each kind of answer: served, redirected, not found, refused, or failed.

A total is a number, added up over a day or, for the last of these, over an hour, and written to the server's own log when that day or hour ends or when the server is restarted. It holds no IP address and no identifier, and the time of an individual request is never recorded. Totals are not kept per visitor, and we do not count unique visitors, because doing so would mean remembering something about you. Nothing in them can tell one visitor from another or reconstruct a visit. They stay on our server and are not shared with anyone.

The one thing your browser unavoidably reveals to our server, as with any website, is the network connection needed to deliver the page — and beyond the brief counting described above, we do not keep it. Because the site keeps nothing about you, there is nothing for us to sell, share, or hand over, and there is no cookie banner because there are no cookies to consent to.

6. Third parties you may reach

Some actions take you to a third party, whose own privacy practices then apply:

Software downloads. Release binaries are hosted on GitHub. When you follow a download link, GitHub receives that request and applies its own privacy policy. We host our own primary assets (like the logo) ourselves.
The optional fiat on-ramp provider, as described in section 3, if you use it.
Blockchain networks, node providers, data sources, block explorers, and swap services your wallet connects to, as described in section 3.

We do not control these third parties and are not responsible for their handling of your information.

7. Children

Caribou is for adults. The Terms of Service require you to be at least eighteen (18) years old, or the age of majority where you live, to access the Site or use the Software. Neither is directed to children, and we do not knowingly collect personal information from anyone under that age. Because we do not collect personal information through the wallet or the website in the first place, there is nothing for us to knowingly collect from anyone.

8. Your rights

Depending on where you live, you may have rights over personal information — such as to access, correct, delete, or port it, to restrict or object to its processing, and to complain to your local data-protection authority — under laws like the EU and UK GDPR and the California Consumer Privacy Act. Because we do not hold personal information about you through the wallet or this website, in most cases there is nothing for us to retrieve, change, or erase.

The one place this website handles your IP address at all is the in-memory rate limiting described in section 5. Where the EU or UK GDPR applies, the legal basis for it is our legitimate interest in keeping the site secure and available (Article 6(1)(f); Recital 49 names network and information security as such an interest). It is brief and exists only in the server's memory, so there is nothing we could look up, export, or delete for a particular person. The anonymous totals described in section 5 are not personal information.

If you have emailed us, we hold that correspondence; you can ask us about it, or ask us to delete it, at the address below. We do not sell or share personal information, and we do not use it for targeted advertising.

9. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date above and publish the new version here, keeping the prior version available at its dated permanent link. Each published version carries a version identifier equal to its effective date, so that a specific version can be referred to unambiguously.

10. How to contact us

Privacy questions and data-subject requests can be sent to privacy@bisoncraft.org. Security reports can go to security@bisoncraft.org (see also our security.txt). By post: Bisoncraft LLC, 2800 E. Enterprise Ave STE 333, Appleton, WI 54913, USA.

This is version 2026-09-21 of the Caribou Privacy Policy. The permanent link to this exact revision is caribou.you/privacy/2026-09-21/.