Privacy Policy

1. The Short Version

• You control your keys. The App generates or imports your private keys and recovery phrase on your device and stores them locally. We do not collect or hold your private keys, recovery phrase, wallet PIN, or backup password. Cloud backup is optional: if you choose to use it, the backup is encrypted on your device and uploaded directly to your own cloud account, without passing through our servers (Section 7). We cannot recover your keys or passwords for you.
• No registration required. Using the wallet does not require a Swifun account or identity verification. You may choose to provide personal information when contacting support. We do not sell personal information.
• Your wallet does not depend on us. Your recovery phrase restores it in other wallet software at any time, whether or not our services are running.
• We and our service providers process support messages you choose to send (Section 6), operational request records (Section 4), and pseudonymous analytics and crash reports (Section 5).
• Third-party services receive your IP address and, where relevant to a request, the public wallet addresses you query (Section 3).

2. What Stays on Your Device

The App keeps what it needs on your device rather than on our servers: your wallet key material, stored encrypted; your settings; and whatever it caches to stay fast. It also keeps diagnostic logs on your device; they stay local, except that error and warning entries go to our crash-reporting provider so failures can be diagnosed (Section 5).

3. Third-Party Services

To show market data and execute trades, the App connects directly from your device to third-party providers. Like any internet service, they receive your IP address, standard request metadata, and the content of the request — typically public wallet addresses or token identifiers. We do not send them your identity; we never have it.

Transactions are signed on your device; only the signed transaction is transmitted, and it is destined for the public blockchain anyway. Solana is a public, permanent ledger: your addresses, balances, and transaction history are visible to anyone by design, independently of this App, and nothing in this policy can apply to data recorded on it.

These providers process data under their own privacy policies.

4. Our Own Services

Paying network fees for you. If you do not hold enough SOL for a transaction's network fee, the App can ask a service we operate to co-sign it and cover that fee, which you repay in the same transaction under Section 5 of the Terms of Service; the same service may relay a request when your device cannot reach a provider directly. Either way it sees your IP address and the request involved — a public wallet address, or the transaction to be co-signed — but never your private key, which cannot leave your device. It keeps short-lived records of this, tied to a wallet address or an IP address, to prevent abuse and to account for the fees it covers; the service's rate-limit and fee-accounting records expire within days. We do not sell these records or use them for advertising or profiling. Hosting providers may also process request and security logs to operate and protect the service.

The service requires no user registration.

5. Notifications, Analytics and Crash Reporting

The App uses Firebase (Google) to deliver push notifications, to fetch operational settings so we can respond to outages without shipping a new version, and to collect pseudonymous usage analytics and crash reports. Each of these transmits your IP address and basic device and app information to Google.

The analytics categories are: which screens and features you use; your app version, device and operating system; how the App was installed; whether an action such as a trade succeeded or why it failed, with the token it concerned and its approximate value; and, for crashes, stack traces and device state.

This is tied to a random identifier generated when you install the App, not to your identity. The App does not use your device's advertising ID or any identifier that follows you across other apps. Analytics events do not carry your wallet addresses, balances, or holdings, and we do not profile you. Diagnostic messages sent with a crash or error report may, however, contain public blockchain identifiers — a wallet address, transaction signature, token address, or amount — because that is what makes a failure diagnosable. Such data is already public on the Solana ledger (Section 3), and we use it only to fix the failure.

6. In-App Feedback

The App has an optional "Help & feedback" screen where you can message the developer. Threads are stored on a support platform we control, are private to you and us, and are never published.

• Stored: what you write, screenshots you attach, our replies, and basic diagnostic context (app version, build, platform, OS, device model, language) with the random identifier from Section 5.
• Not attached: your wallet addresses, balances, holdings, keys or recovery phrase. Nothing about your wallet is added automatically. What you choose to send is up to you — a screenshot may show balances or addresses, so check before sending, and never paste your recovery phrase.
• Identity: submitting creates an anonymous, credential-less session so only your device can read your own threads. No email, no password.
• Retention: we keep a thread only while it is useful for support and product decisions, then delete it. You can ask us to delete yours at any time.

7. Optional Cloud Backup

If you back up your recovery phrase, it is encrypted on your device with a key derived from a password you choose, using current industry-standard algorithms that we may update over time, before it is uploaded. It goes to the app-private area of your own cloud storage account — which provider depends on your device and on what the App supports — not to our servers. The provider's sign-in is used solely to reach that area; the App does not read your other files, contacts, or messages, and you can delete backups from inside the App or through your provider's settings.

We never see your backup, your backup password, or your cloud account credentials. Your cloud provider processes this under its own privacy policy.

8. Camera and Photos

The camera is used only to scan QR codes, on-device. Photos are read or written only when you pick or save a specific image; there is no gallery scanning; selecting or saving images may require photo-library or storage permission, depending on your device and operating system.

9. Retention and Deletion

• Records from the service in Section 4: expire automatically within days; we do not extend or archive them.
• Feedback threads: kept only while useful, then deleted. Contact us to delete yours sooner; write from within the thread so we can identify it, since we have no other way to link it to you.
• Analytics and crash data: analytics data follows the Google Analytics retention settings, while crash data follows the crash-reporting service's retention rules.
• Local data and cloud backups: uninstalling can delete local app data, but does not delete cloud backups; delete cloud backups separately through the App or your cloud provider. Uninstalling also removes your ability to access your anonymous feedback threads, but does not delete the threads themselves.
• Blockchain data: public and permanent; neither we nor anyone else can delete it.
• If we stop operating: nothing you need in order to keep your assets is held by us.

10. Your Rights (GDPR, UK GDPR, CCPA and similar laws)

We hold very little about you, so most rights (access, rectification, erasure, portability) apply to data already under your direct control — on your device or in your own cloud account. For what we do hold: contact us about feedback threads and we will provide a copy or delete them. The records in Section 4 are short-lived and keyed to a blockchain address; providing the relevant wallet address lets us locate them. Analytics data is keyed to a random install identifier; you can make a request through in-app feedback, which automatically includes this identifier, so you do not need to find it yourself. For data we control, including data processed on our behalf by third-party providers such as Google, you can contact us with your request; requests about data a provider processes independently may be directed to that provider.

Legal basis (GDPR). Where GDPR applies, processing is based on performance of the service you request (Art. 6(1)(b)) and our legitimate interest in keeping the App secure, functional, and free from abuse (Art. 6(1)(f)).

No sale, no targeted advertising, no profiling. We do not sell your personal information or share it for advertising, do not use it for targeted or cross-context behavioral advertising, and do not use it for profiling or automated decisions producing legal or similarly significant effects. U.S. state privacy laws give you the right to opt out of each of these — here there is nothing to opt out of. No common standard yet governs "Do Not Track" signals, and the App does not respond to them.

You may contact us with any privacy question, and you have the right to lodge a complaint with your local data protection authority.

11. Children

The App is not directed at children and is intended only for users aged 18 or older. We do not knowingly collect information from children.

12. Security

The App protects wallet keys using the operating system's secure storage and uses hardware security mechanisms where supported by the device. Sensitive screens use system-supported screenshot and screen-recording protections, and network communications between the App and our services are encrypted using TLS.

13. International Data Transfers

The data described in this policy may be processed by us and our service providers outside your country or region, where data protection laws may differ from those where you live.

14. Changes and Contact

We will post any changes on this page and update the effective date above; material changes will be highlighted in the App's release notes.

Email: support@swifun.com