Keys, policy, review
Recovery, access control, transaction construction, and signing remain local.
Technology
A small trusted surface, with clear boundaries around the network.
Authenticated relay
The relay handles bounded network requests without receiving private keys.
Bitcoin state
Acceptance and confirmations come from network authority, not optimistic UI state.
On the device
Everything that could identify you stays local.
The wallet is a native app, not a web view over a hosted account. Sensitive material never leaves the secure boundary of the phone or Mac.
Keychain-backed
A 24-word BIP-39 seed is generated on device and stored in the Keychain with device-only protection. It is never transmitted.
Passcode + biometrics
A local passcode hash gates the wallet, with optional Face ID or Touch ID. The app auto-locks on background; there is no account to sign into.
Local transaction building
Destinations are validated, outputs resolved, and fees computed on device. Signing happens locally; only a signed transaction is handed to the network.
Readable offline
Balances and activity persist locally so the wallet is legible without a connection, always paired with a last-updated time and an explicit refresh.
The relay boundary
A narrow, authenticated path to chain data.
Rather than shipping a node endpoint into the client, ColdHarbor speaks to a minimal relay that forwards only what it must and holds nothing that can move funds.
- Forwards
- An allowlisted set of JSON-RPC methods: balance, history, broadcast, fee, sync state.
- Never receives
- Private keys, recovery words, or unsigned intent. The client sends signed transactions only.
- Authentication
- Bearer-token access per beta client, with per-window rate limiting.
- Endpoint secrecy
- The upstream regtest node URL is held by the relay, not embedded in the app.
Quiet when disconnected
Local state survives the horizon.
Cached balances and activity can remain readable offline, paired with a last-updated timestamp and an explicit reconnect action. The interface never invents confirmations it has not seen from the network.
Connection stateOffline
Showing local data from 10:42
Node visibility
Network state is shown, not implied.
Relay health, sync progress, and acceptance are surfaced directly. Bring-your-own-node configuration is planned so trust in infrastructure becomes a choice, not a default.