Qubi ("the extension", "we", "our") is a non-custodial Chrome extension wallet for QTC, the native coin of Quantus Network. This page explains, in plain language, what Qubi does and does not do with your data.
What Qubi stores on your device
- Your encrypted wallet. Your recovery phrase or private key is encrypted with AES-256-GCM before it ever touches disk. The encryption key is derived from your password using PBKDF2-SHA256 with 600,000 iterations and a random salt. Your password itself is never stored, anywhere, in any form.
- Local preferences. Selected network (mainnet/testnet), language, auto-lock timeout and similar settings, stored in your browser's local extension storage.
- Session-only decrypted state. While your wallet is unlocked, the decrypted secret exists only in the extension's background memory and in session storage that Chrome clears automatically when you close the browser. Auto-lock clears it after a period of inactivity you can configure.
None of the above ever leaves your device. There is no cloud backup, no sync to any Qubi-operated server, and no way for us to see it — because we never receive it.
What Qubi sends over the network
Qubi makes network requests only to the following services, and only to do the specific thing you asked it to do:
| Where | What for |
|---|---|
rpc1-mainnet.quantus.comrpc2-mainnet.quantus.com | Quantus mainnet RPC nodes — query your balance/activity and broadcast transactions you've signed |
a1-planck.quantus.cata2-planck.quantus.cat | Quantus "Planck" testnet RPC nodes — same, only if you switch to testnet |
sqm.quantus.com | Official Quantus indexer (mainnet) — loads your activity history and detects pending reversible transfers |
sub2.quantus.com | Same indexer, testnet instance |
1click.chaindefuser.com | NEAR Intents "1Click" API — swap quotes for the in-wallet swap feature (currently "coming soon", not yet active) |
These requests are sent directly from your browser to Quantus Network's and NEAR Intents' own infrastructure — which Qubi's developer does not operate and does not receive a copy of. If you configure a custom RPC endpoint, requests go there instead, and Qubi warns you that a custom node can see your address and could serve you false data.
Qubi includes no analytics SDK, no crash reporter, no advertising SDK, and no third-party tracking script of any kind.
What Qubi never does
- Never sends your recovery phrase, private key, or password anywhere.
- Never asks for or stores your email, name, or any other personal identifier.
- Never injects code into, or reads data from, other websites — Qubi has no content scripts.
- Never executes remotely-loaded code — everything Qubi runs is bundled inside the extension package.
- Never sells or shares data with third parties, because it collects none to begin with.
Your responsibility
Qubi is self-custody software: only you hold your recovery phrase and keys. If you lose your recovery phrase, or share it with someone else, neither Qubi nor anyone else can recover your funds. See our Terms of Use for the full risk disclaimer.
Changes to this policy
If this policy changes, we will update the effective date above and note the change in the extension's release notes.
Contact
Publisher: Qubi
Contact email: qtcatwallet@proton.me
Website: https://qubi-wallet.pages.dev
X (Twitter): @QTCATwallet
For security vulnerability reports, please use GitHub private vulnerability reporting on the Qubi repository rather than email.