Caribou
Download

Privacy Policy

Effective date: 15 July 2026 Version: 2026-07-15 Current version of this document

Caribou is built so that we collect as little about you as possible — ideally nothing. The wallet runs on your device and keeps your keys there. This website keeps no record of your visit. This policy explains what that means, precisely, and names the few places where a third party you choose to interact with will see something.

1. The short version

  • The Caribou wallet has no accounts and no sign-up. Your keys and recovery phrase never leave your device, and we never receive them.
  • The wallet sends no analytics or telemetry to us.
  • This website sets no cookies, runs no analytics, embeds no third-party content, and does not log your IP address.
  • When you use any blockchain — with Caribou or any other wallet — the network's peers and providers necessarily see network-level information such as your IP address. That is inherent to using a network, and we neither control nor collect it.
  • The optional fiat on-ramp is run by a third party that will collect information from you under its own policy, only if you choose to use it.

2. Who we are and what this covers

Caribou is published by Bisoncraft LLC ("Bisoncraft", "we", "us"). This policy covers the caribou.you website and its subdomains, and the Caribou wallet software we distribute. It does not cover third-party networks, services, or websites you may reach through the Software or by following a link — those are governed by their own policies.

3. The wallet software

Caribou is a self-custodial wallet that runs locally on your device. It is designed to keep your information with you:

  • Keys stay local. Your recovery phrase and private keys are generated and stored on your device. They are never transmitted to Bisoncraft, and we have no way to obtain them.
  • No account, no profile. There is no registration, no login, and no user profile held by us.
  • No telemetry to us. The wallet does not send usage analytics, crash reports, or device identifiers to Bisoncraft.
  • Local data. Wallet data — such as your addresses, transaction history cache, and settings — is stored on your device under your control. You can remove it by removing the application's data.

Network interactions are not private by nature. To show balances and broadcast transactions, the wallet must talk to blockchain networks, either through built-in light clients that connect to network peers or through node/RPC endpoints. Those peers and providers can observe network-level information, including your IP address and the requests your wallet makes, and blockchains themselves are public ledgers on which your transactions are permanently visible. This is true of essentially all crypto wallets. Where a choice of backend exists, Caribou prefers those that do not impose identity requirements, and surfaces the trade-off when a privacy-preserving option is not available. To reduce what network providers can see, you may route the wallet's traffic through a privacy network such as Tor or a VPN. [Counsel: confirm this description matches the shipping networking behavior and any bundled endpoints.]

The optional fiat on-ramp. If you choose to buy crypto through the wallet's optional fiat on-ramp, that transaction is handled by an independent third-party provider. You interact with the provider under its own terms and privacy policy; it — not Bisoncraft — collects and processes the identity and payment information it requires. We do not receive or store that information. The feature is off by default and no other feature depends on it.

4. What we do not collect

Through the wallet and this website, Bisoncraft does not collect:

  • your name, email address, or any identity documents (unless you email us directly — see section 10);
  • your keys, recovery phrase, addresses, or balances;
  • analytics, advertising identifiers, device fingerprints, or behavioral profiles;
  • cookies or other client-side tracking state from this website.

5. This website

We hold this website to claims you can test. As served from caribou.you:

  • No visitor IP logging. Your IP address is not written to any web access log, error log, or other store. Standard request logging is disabled, and error logging is configured so that it does not record visitor addresses.
  • No cookies, no analytics, no beacons. The site sets no cookies and runs no first- or third-party analytics, tag managers, pixels, or tracking beacons.
  • No third party in front of the site. The site is self-hosted on infrastructure we control. There is no content-delivery network, reverse proxy, or other third party positioned between you and our server. [Counsel/ops: this statement must remain true of the running configuration; any upstream filtering or CDN would require revising this section in the same change.]
  • No third-party requests. Every asset the pages load — fonts, images, styles, and any scripts — is served from this domain. Loading a Caribou page causes your browser to make no requests to any other host.
  • Encryption in transit. The site is served over HTTPS with certificates from a public certificate authority. Certificate-transparency logs publicly record the domain name (this is how certificate transparency works everywhere); those logs are about the certificate, not about you.

The one thing your browser unavoidably reveals to our server, as with any website, is the network connection needed to deliver the page — but we do not record it. Because the site collects nothing, there is nothing for us to sell, share, or hand over, and there is no cookie banner because there are no cookies to consent to.

6. Third parties you may reach

Some actions take you to a third party, whose own privacy practices then apply:

  • Software downloads. Release binaries are hosted on GitHub. When you follow a download link, GitHub receives that request and applies its own privacy policy. We host our own primary assets (like the logo) ourselves.
  • The optional fiat on-ramp provider, as described in section 3, if you use it.
  • Blockchain networks and node providers your wallet connects to, as described in section 3.

We do not control these third parties and are not responsible for their handling of your information.

7. Children

The Software is not directed to children, and we do not knowingly collect information from children. Because we do not collect personal information through the wallet or the website, there is nothing for us to knowingly collect from anyone. [Counsel: confirm any age threshold and wording, e.g. under 13 / under 16, per applicable law.]

8. Your rights

Depending on where you live, you may have rights over personal information — such as to access, correct, delete, or port it, or to object to its processing — under laws like the EU/UK GDPR and the California Consumer Privacy Act. Because we do not hold personal information about you through the wallet or this website, in most cases there is nothing for us to retrieve, change, or erase. If you have emailed us, we hold that correspondence; you can ask us about it at the address below. We do not sell or share personal information, and we do not use it for targeted advertising. [Counsel: confirm the specific rights statements and any required disclosures for your target jurisdictions.]

9. Changes to this policy

We may update this policy from time to time. When we do, we will change the effective date above and publish the new version here, keeping the prior version available at its dated permanent link. Each published version carries a version identifier equal to its effective date, so that a specific version can be referred to unambiguously.

10. How to contact us

Privacy questions can be sent to privacy@bisoncraft.org. Security reports can go to security@bisoncraft.org (see also our security.txt). Bisoncraft LLC, [Counsel: registered entity address and any required data-controller identification].

This is version 2026-07-15 of the Caribou Privacy Policy. The permanent link to this exact revision is caribou.you/privacy/2026-07-15/.