Privacy & safety notice
What the app processes, what it does not collect, and the limits of browser-based wallet tools.
Recovery words are local-only
The validator, partial-phrase workspace, and new-phrase generator operate in browser memory. Application code does not send recovery words to an API, server, AI model, database, analytics tool, or error log. It does not save them in cookies, localStorage, sessionStorage, or IndexedDB. There is no account or secret-support form.
Use “Clear” to immediately remove words from the interface and current app state. Leaving a tool page or reloading also discards its state. JavaScript cannot guarantee immediate memory zeroization of strings, deletion of operating-system memory, clipboard contents, screenshots, autofill, or browser snapshots.
Public lookups contact an external provider
Only the public-address lookup contacts Blockstream’s public API, after your confirmation. It sends the public Bitcoin address, not recovery words. The provider may see your IP address and request metadata. An address can still be privacy-sensitive even when it is public. Requests are not cached by this application.
Opening official support or transaction-explorer links leaves the app. The hosting platform may process normal page-serving traffic and may inject platform scripts. This app adds no analytics or AI SDK calls. Hosting-level behavior is outside this application’s control.
Local does not mean risk-free
Malware, browser extensions, injected hosting scripts, keyboard tools, and physical observers may access displayed or typed secrets. For meaningful funds, use a trusted hardware wallet or verified official wallet app. Browser-based generation is not a certification that your device or this deployment is secure.
No custody, guarantees, or wallet scanning
Novara Recovery AI does not hold funds, restore accounts, identify wallet owners, transfer cryptocurrency, or send phrases to AI. The recovery assistant can check one missing word against the BIP-39 checksum locally; it never derives keys or tests possibilities against addresses, wallets, or balances. Results stay in page memory and are not saved. Use the tools only for wallets you own or are authorized to assist with. No independent security audit has been performed.
Check the local cryptographic tools
Run basic checks on this device using public test vectors and a disposable random phrase. No real user secrets, network requests, or logs are involved. This is not a security audit.
The separate automated suite also covers form clearing and network, storage, and log spies. It is included in the project but has not been executed in this builder session. Real-device testing and hosting-script inspection have not been performed.