Effective Date: 2021-02-02

Browser extension supplement effective 25 October 2026, for release 4.2.0.

Privacy Policy

The Fearless Wallet app is built as an app by SORAMITSU, a company incorporated under the Japanese law, with a head office registered at Jingumae Tower Building, Jingumae 1-5-8, Shibuya-ku, Tokyo 1500001, Japan. For users in the European Economic Area (EEA), SORAMITSU is represented by its Switzerland entity, Soramitsu Helvetia AG, a company incorporated under the Switzerland law, with an office registered at Dammstrasse 16, 6300 Zug, Swizerland.

This service is provided by SORAMITSU at no cost and is intended for use as is. For the purposes of this Privacy Policy, 'we', 'us' and 'our' refers to SORAMITSU, and 'you' refers to you, the user of the Services.

This page is used to inform visitors regarding our policies with the collection, use, and disclosure of Personal Information if anyone decided to use our Service.

If you choose to use our Service, then you agree to the collection and use of information in relation to this policy. We will not use or share your information with anyone except as described in this Privacy Policy.

The terms used in this Privacy Policy have the same meanings as in our Terms and Conditions, which is accessible at Fearless Wallet unless otherwise defined in this Privacy Policy.

Information Collection and Use🔗

While using our Fearless Wallet Service, we do not require you to provide us any personally identifiable information.

You can, however, opt into various additional Services, such as the Fearless Wallet mailing list and the SORAmbassadors program, which may require Personal Information. When offering such Services, we will ask for your consent to collect and process the Personal Information required. These data will be used solely for the purpose of managing the additional services offered. While operating such services, SORAMITSU may also collect and process Personal Information that is strictly necessary for the pursuit of legitimate interests, for instance fraud prevention and direct marketing (see GDPR Recital 47). The data collected is processed by SORAMITSU Helvetia AG on servers located in Switzerland. None of the data collected will be sold or otherwise transferred to third parties.

Please note that SORAMITSU will never ask you to reveal sensitive Personal Information, for instance data on your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life, sexual orientation, or criminal convictions. SORAMITSU will not collect genetic, health, or biometric data. Some SORAMITSU Services provide the option of utilising your own electronic devices' biometric identification functions; however, biometric data collected by your device will be processed locally and will not be collected nor processed by SORAMITSU.

Retention🔗

Unless stated otherwise in this Privacy Policy, the Personal Information that you provide us will only be stored for as long as it is necessary for us to fulfill our obligations in respect of the provision of the Services. As a Swiss entity, Soramitsu Helvetia AG provides privacy protection adequate to the standard set by the General Data Protection Regulation (EU) 2016/679 (GDPR). Your rights under the GDPR include the following:

• The right to request access to and rectification or erasure of your Personal Information
• The right to object to or request the restriction of the processing or transfer of your Personal Information
• The right to obtain, transfer, and reuse your Personal Information
• The right to withdraw your consent to the collection or further processing of your Personal Information
• The right to lodge a complaint with a supervisory authority

Exercising these rights will not subject you to any penalties, though it may affect your ability to use SORAMITSU Services. Note that exercising these rights may not affect the lawfulness of data processing based on consent before its withdrawal.

SORAMITSU adheres to the principles of data minimisation and data protection by design and default. This means that unnecessary Personal Information is not collected, and data protection is regarded as a core functionality of our Services. More information about data protection at SORAMITSU is available upon request.

Log Data🔗

We want to inform you that whenever you use our Service, in a case of an error in the app we collect data and information (through third party products) on your phone called Log Data. This Log Data may include information such as your device Internet Protocol ("IP") address, device name, operating system version, the configuration of the app when utilizing our Service, the time and date of your use of the Service, and other statistics. Log Data will be processed securely in compliance with all relevant regulations, and will not be sold or otherwise transferred to third parties without your explicit consent.

Cookies🔗

Cookies are files with a small amount of data that are commonly used as anonymous unique identifiers. These are sent to your browser from the websites that you visit and are stored on your device's internal memory.

This Service does not use these "cookies" explicitly. However, the app may use third party code and libraries that use "cookies" to collect information and improve their services. You have the option to either accept or refuse these cookies and know when a cookie is being sent to your device. If you choose to refuse our cookies, you may not be able to use some portions of this Service.

Security🔗

We value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and we cannot guarantee its absolute security.

Compliance with Law🔗

Fearless Wallet may be compelled to surrender your personal information to legal authorities without your express consent if presented with a court subpoena or similar legal or administrative order, or as required or permitted by the laws, rules, and regulations of any nation, state, or other applicable jurisdiction.

Links to Other Sites🔗

This Service may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by us. Therefore, we strongly advise you to review the Privacy Policy of these websites. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Children's Privacy🔗

These Services do not address anyone under the age of 18. We do not knowingly collect personally identifiable information from people under 18. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we will be able to do necessary actions.

Changes to This Privacy Policy🔗

We may update our Privacy Policy from time to time. But when we do, we'll let you know one way or another. Sometimes, we'll let you know by revising the date at the top of the Privacy Policy that's available on our website and mobile application. Other times, we may provide you with an in-app notification.

Contact Us🔗

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at security@soramitsu.co.jp.

The Data Controller, Data Processor, and Data Protection Officer Are:

Soramitsu Helvetia AG (“SORAMITSU”)

Soramitsu Helvetia AG c/o Diego Compostella

Oberneuhofstrasse 5, 6341 Baar, Switzerland

Email: dataprotection@soramitsu.co.jp

The Competent Supervisory Authority Is:

Office of the Federal Data Protection and Information Commissioner (FDPIC)

Feldeggweg 1

CH - 3003 Berne, Switzerland

Telephone: +41 (0)58 462 43 95 (Mon.-Fri., 10-12 am)

Telefax: +41 (0)58 465 99 96

Browser extension privacy supplement🔗

Effective 25 October 2026, for browser extension release 4.2.0.

This notice supplements the Privacy Policy above and describes the browser
extension specifically. The controller and contact details in that policy
continue to apply.

Wallet data on your device🔗

The extension processes wallet addresses, encrypted account records, wallet
labels, settings, connection permissions, balances and transaction history to
provide wallet functionality. Passwords and decrypted signing material are used
locally to unlock accounts and authorize the actions you request. Secret-bearing
account records are stored encrypted in the browser profile. Public account
metadata and preferences are also stored locally. Local processing is data
handling even when the data is not sent to a developer-operated server.

Network services and public transactions🔗

The extension contacts blockchain RPC nodes, indexers and supporting services
to obtain network configuration, balances, prices, transaction history and
transaction status, and to submit transactions you approve. Requests can include
public wallet addresses and transaction data; service operators also receive
network connection information such as your IP address. Different selected
networks and custom endpoints use different operators and privacy practices.
Transactions recorded on public blockchains are public and cannot be erased by
removing the extension.

Websites and connected applications🔗

The extension installs its wallet provider on websites so that decentralized
applications can request a connection. It processes the requesting website's
origin and stores account permissions so that you can review and manage those
connections. The provider does not give a website access to an account merely
because its page loads. Account disclosure and signing are subject to the
wallet's authorization controls. WalletConnect and other explicitly initiated
connection flows also communicate with the relevant connection service.

Optional Google Drive backups🔗

If you choose Google Drive backup or restore, Google handles authentication and
the extension uses the drive.appdata scope to access its application-data
folder in your Google account. Backup files contain password-encrypted wallet
JSON. Wallet labels and public addresses are used as backup file metadata.
OAuth credentials are used to perform the backup or restore you request. This
optional flow transfers that data to Google under Google's privacy policy; it
does not require sharing a plaintext seed phrase with SORAMITSU.

Other providers🔗

If you open an external purchase, support or other third-party service, that
provider's privacy policy applies to the data it receives. The wallet may pass
the public address and asset details needed for a purchase flow you initiate.

Use, retention and your controls🔗

The extension uses wallet data and website permissions for its wallet features.
It does not sell those data, use them for personalized advertising, or use them
to determine creditworthiness or lending eligibility. Its handling of data
obtained through Chrome APIs follows the Chrome Web Store User Data Policy,
including its Limited Use requirements.

You can manage connected websites, change wallet settings and remove local
accounts through the extension. Removing an account, resetting the wallet or
uninstalling the extension can remove the local information needed to access
your assets; retain a usable backup first. These actions do not delete public
blockchain transactions or copies in Google Drive. Manage optional cloud
backups through your Google account. External service operators apply their
own retention policies.

For privacy questions, contact dataprotection@soramitsu.co.jp. For security
issues, contact security@soramitsu.co.jp.