Laurel
Privacy policy
The short version. Laurel is a self-custodial Zcash wallet. We don't run servers for it, we don't have user accounts, and Laurel sends us nothing: no analytics, no crash reports, no identifiers. Your recovery phrase and keys are created and stored on your device, and we can't access them.
To work, Laurel talks to third-party services, listed below, and they see some data, such as your IP address.
What stays on your device
- Your recovery phrase, keys, wallet files, transaction history, contacts, notes and settings. Wallet files are encrypted with a key protected by your password. We never receive them.
- Laurel blocks screenshots and the app-switcher preview of its screens, and is set to exclude its data from Android backups and device transfers.
What leaves your device, and who sees it
| When | Who receives it | What they can see |
|---|---|---|
| Always, while Laurel syncs or sends. A payment that may not have gone out is sent again automatically (the same signed transaction) once the wallet catches up. | The Zcash server Laurel connects to (lightwalletd). By default an automatically chosen third-party server; you can set your own. | Your IP address and connection times; which blocks you download; the transactions you send; your wallet's transparent (public-pool) addresses, which it can link to your IP address. Shielded balances aren't looked up by address. |
| Automatic server selection (at first start, and when choosing a replacement) | Public Zcash servers, in successive batches of up to four | Your IP address and request timing. A server you set yourself is used exclusively. |
| When restoring by date, and when Laurel looks up your wallet's starting block time | The Zcash server | Roughly when your wallet was created |
| Only if you turn on prices (off by default) | CoinGecko (api.coingecko.com) | Your IP address, the price range asked for and Laurel's version. While a price alert is set, Laurel asks about every two minutes while it's running. No wallet data is sent. |
| Once, the first time you spend money held in Sapling, if no valid copy is on your phone | download.z.cash | Your IP address and Laurel's version, for a 48 MB public proving key. No wallet data is sent. |
| Only if you sweep a private key | The Zcash server | That key's address; the sweep links it to your wallet on the public blockchain. |
| Only if you turn on Sync | A folder you choose (for example your own cloud drive) and whoever hosts it | Encrypted contacts, notes and notification and price-display preferences. The provider sees file names containing a persistent random device identifier, file sizes and timing; contents need your sync key. |
| Only if you use offline signing | A file you save wherever you choose; if that's a cloud folder, its provider | Not encrypted: the wallet's viewing key (it reveals your balances and history), a view-only copy of its state and the payment. Keep it private: a signed file is a payment. |
| Only if you turn on notifications (off by default) | Android's notification system | Payment notices with account and wallet names (never amounts), reminders with the name you gave a repeating payment (it may name a person), and price alerts with the price, possibly on the lock screen. |
| Only if you tap a help or faucet link | Your browser and that website | Whatever that website collects |
Transactions you send are public on the Zcash blockchain. Shielded transactions hide amounts and addresses; transparent ones don't.
Data we receive
Laurel has no publisher-operated account, analytics or crash-reporting service. If you email us, we receive your email address and message and use them only to reply. If you ask to join the beta, we also use the Google account email you give us to add you to the Google Play testing list, and remove it when the beta ends or when you ask.
We keep support emails for 12 months after your issue is resolved, then delete them (longer only for an open security incident or a legal hold). To have your messages deleted sooner, write to privacy@laurel.cash.
This website, laurel.cash, uses no cookies, analytics or third-party scripts, and its fonts are served from laurel.cash itself. Our host, Cloudflare, processes visitors' IP addresses to deliver and protect the site.
Children
Laurel is not intended for anyone under 18.
Your choices
You can turn prices, sync and notifications off, choose your own Zcash server, and delete your wallets and data from Settings or by uninstalling Laurel. Deleting local data or uninstalling doesn't erase blockchain records, exported files, other devices' copies or providers' logs; manage those with their holders. Third parties' own policies govern what they log.
Security
Laurel hasn't been independently audited; this is test software that uses test coins with no monetary value. Never import a recovery phrase that holds real money.
Changes and contact
We'll post changes here and update the effective date. Contact: support@laurel.cash. Security reports: security@laurel.cash. Privacy requests: privacy@laurel.cash.
RPTX LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.