// AUTO DESKTOP
Privacy policy
This policy covers Auto Desktop, the native wallet and dApp browser for macOS and Windows, and this website at auto-wallet.nannan.app.
Auto Desktop is not a hosted wallet. Signing happens on your computer. The requests below do not include your recovery phrase, your wallet password, or your private keys. The one exception is an OKX API secret, and only if you choose to save one: that secret is sent to OKX so the app can read the account you connected.
There is no advertising SDK in the app. Operators of the services below still see your IP address and ordinary connection data, plus the fields named here. Their own policies apply to what they store.
What stays on your computer
- The encrypted vault (Argon2id and AES-256-GCM), recovery phrase, private keys, and the password that unlocks them.
- Portfolio history, settings, connected sites, and diagnostic logs. Logs are written to a local file and are not uploaded by the app.
- OKX account credentials, if you save them, in the operating system credential store. Ledger signing stays on the USB connection to the device. The app does not contact a Ledger cloud service to sign.
Chains, dApps, and explorers
These contacts happen because you use the wallet or open a page.
- RPC endpoints. Balances, contract reads, and broadcasts go to the RPC URL configured for each chain. Built-in chains use public endpoints, including PublicNode (
*.publicnode.com) and chain operators such as BNB Chain, zkSync, Sonic, X Layer, World Chain (a public Alchemy endpoint), Astar, Wanchain, Metis, Celo, and Polygon zkEVM. A request can include your public address and the call or transaction you make. You can replace an RPC URL in Settings. PublicNode requests may include the project’s API key in the URL. PublicNode privacy policy. - dApp browser. Pages you open load inside the app. Those sites can set cookies and see your IP address. If you approve a connection, the site receives the public address you selected. Icons for built-in and saved dApps are requested from those sites.
- Block explorers. Opening a transaction or token follows a link to that chain’s explorer, such as Etherscan. The explorer receives the address or hash in the link.
Prices and DeFi positions
- CoinGecko (
api.coingecko.com). The wallet asks for USD prices by asset id, such asethereum. These requests do not include your wallet address. CoinGecko privacy policy. - Zerion (
api.zerion.io) and DeBank (pro-openapi.debank.com). DeFi positions are off until you enable them for an account. When you do, the app sends that account’s public address. Zerion is the primary source. DeBank is used for positions Zerion does not return, including some Uniswap v4 liquidity. The project’s API keys authenticate those calls. Some built-in positions, such as Wanchain XStake, are read from the chain RPC instead. Zerion privacy policy. DeBank privacy policy.
Swaps, Safe, and OKX
These run when you use the feature.
- Relay (
api.relay.link). A swap quote includes the wallet address and recipient you set, the tokens, and the amount. Status checks use Relay’s request id. - XFlows (
xflows.wanchain.org). A quote, a built transaction, or a status check includes the from and to addresses, the tokens, and the amount. - OKX DEX (
web3.okx.com). Token lists and quotes send token addresses and amounts. Building a swap also sends your wallet address. History checks send the transaction hash. - OKX account (
www.okx.com, or the US, EEA, or Turkey host you pick). Only if you save an OKX API key. The app sends that key to OKX to read assets and related earn data. OKX privacy policy. - Safe (
api.safe.global, or a service URL you enter). If you import a Safe, the app sends the Safe address. Confirming a Safe transaction submits your confirmation signature. Safe privacy policy.
Transaction preview
When an approval window opens for a transaction, the app sends that transaction — chain, your public address, destination, calldata, value, and gas — to balance-change-simulate-api.wanscan.org so the window can show estimated balance changes. The app does not offer a separate switch to turn this preview off. Contract deployments are not sent, because the preview needs a destination.
Updates
While Auto Desktop is open it checks for a new version about once an hour and may download it before you choose to install. You can dismiss a downloaded update. Checks and downloads use GitHub (github.com and api.github.com) for Auto-Wallet/auto-wallet-desktop. They do not include your wallet address or keys. GitHub privacy statement.
This website
auto-wallet.nannan.app is a static site. It does not ask you to connect a wallet. Pages load fonts from Google (fonts.googleapis.com and fonts.gstatic.com). The home page also loads a telemetry script from VibeCafé (vibecafe.ai). Google privacy policy.
Code signing
Windows code signing for Auto Desktop is described in the Code signing policy.