1. The short version
Your private key, your recovery phrase and your exchange API secrets never leave your device. That is not a promise about our conduct — it is a property of the system. The wire contract between the app and our servers has no field any of them could occupy, and the servers have no code that could read one.
2. What we never collect
- Private keys and recovery phrases.
- Exchange API keys and secrets.
- Device unlock codes, PINs and biometric data — those stay with your operating system.
- Addresses you do not hold a key for. The product has no "watched address" feature, so no such address is ever sent to us.
3. What we do collect
Account details. If you create an account: an email address, and a display name if you set one. Used to sign you in, to reach you about the service, and for nothing else.
Device metadata. A device identifier, model, operating-system version and app version for each device you register. Used to show you your own device list, to let you revoke a device you no longer have, and to diagnose faults.
Account metadata. The labels and ordering you give your accounts — the names, not the balances. Balances are read live from the chain and from your exchanges; our servers are never authoritative for one and do not store one.
Public addresses. The public address of a wallet you create in the app, so the app can show it to you across your own devices. A public address is already public on the TRON ledger.
Diagnostics. Crash reports and error logs, containing technical information about the failure. We do not attach your balances or your transfer history to them.
Messages you send us. If you use the contact form, whatever you write in it, plus the email address you give so we can answer.
4. This website
This site sets no cookies, runs no analytics, embeds no trackers, and loads no third-party fonts or scripts. The type you are reading is served from this domain, which is also why it looks the same offline.
The one exception is the contact form, which posts to Formspree, a form-handling service — see section 6.
5. Why we are allowed to hold it
Where the GDPR applies: we process account and device data to perform our contract with you (Art. 6(1)(b)), diagnostics under our legitimate interest in a working product (Art. 6(1)(f)), and support correspondence to answer you. We do not process special categories of data and we do not make automated decisions about you.
6. Who else sees it
Our hosting provider, which runs our servers and databases.
Formspree, which delivers the contact form to us. Your message and email address pass through it under its own privacy policy.
Apple and Google, which distribute the app and tell us nothing about you beyond aggregate install statistics.
Exchanges you connect, which see the API requests your device makes with the key you created. Those requests go from your device to the exchange; they do not route through us.
We do not sell personal data, and we do not share it for advertising. We will disclose data if a valid legal order compels us — and the list in section 2 is the list of things such an order cannot produce.
7. How long we keep it
Account and device data for as long as your account exists, and then up to 30 days in backups. Diagnostics for up to 90 days. Support correspondence for up to two years, so we can pick up a thread you started last year.
8. Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, and object to processing based on legitimate interest. Deleting your account removes your profile, your device list and your account metadata.
It does not delete anything on the TRON ledger, which we did not put there and cannot remove. Ask through the contact form; we answer within 30 days. If you are in the EEA or the UK you may also complain to your data-protection authority.
9. Children
The app is not for anyone under 18. We do not knowingly collect data from children, and we delete it if we discover we have.
10. Changes
The date at the top of this page changes when this policy does. Material changes are announced in the app before they take effect.