excryptWho we are and what this covers
This Privacy Policy explains what information the Excrypt mobile app (package com.excrypt.wallet) and its backend services collect, why we collect it, who we share it with, and the choices you have.
Excrypt is operated by Excrypt LLC ("Excrypt", "we", "us"). We are the controller of the personal data described here.
By using Excrypt you agree to this policy. If you do not agree, please do not use the app.
Information we collect
You can hold, send and receive crypto without giving us your name or email. We collect the information below only when you use features that need our servers, such as your profile, Earn rewards, social features, subscriptions and withdrawals.
| Category | What it includes | Source |
|---|---|---|
| Wallet identity | Your public wallet addresses (EVM and Solana) and a signed message proving you control them | You, when you sign in |
| Profile | Username, display name, avatar image, bio, privacy settings | You |
| Email (optional) | Email address and the date you verified it | You, if you add one |
| Social content | Posts, comments, reactions, communities you create or join, accounts you block, images you upload | You |
| Earn and rewards | Tasks completed, rewards earned and claimed, referrals, leaderboard position, mystery box results | Generated as you use Earn |
| Payments and transactions | Transaction hashes, amounts and addresses for presale purchases, subscriptions, swaps and withdrawals processed through Excrypt | You and public blockchains |
| Device and technical data | A random per-install ID (not a hardware ID), push notification token, IP address, app version, request logs | Your device, automatically |
| Notification preferences | Which alerts you want to receive | You |
Public blockchain data. Wallet addresses, balances and transactions are public on their blockchains. We read this public data to show your balances and history. We cannot change or delete anything recorded on a blockchain.
Camera and photos. The camera is used only to scan QR codes; nothing is recorded or uploaded. Photos are accessed only when you choose one for your avatar or a post, and the image is resized on your device before upload.
What we do not collect. We do not collect your private keys, recovery phrase, PIN, biometric data, contacts, precise location, or your real name unless you choose to put it in your profile.
How we use your information
We use your information only to run the app and keep it safe. We do not use it for advertising or profiling.
| Purpose | Legal basis (where GDPR applies) |
|---|---|
| Create and sign you in to your Excrypt account, show your profile | Performance of our contract with you |
| Run Earn: track tasks, calculate and pay rewards, referrals and leaderboards | Performance of contract |
| Run social features: publish posts, comments and communities, enforce blocks | Performance of contract |
| Verify on-chain payments for presales, subscriptions, swaps and withdrawals | Performance of contract |
| Send push notifications and verification emails you asked for | Performance of contract; consent for optional alerts |
| Detect fraud and abuse, such as multiple accounts farming rewards from one device | Legitimate interests in protecting users and rewards |
| Moderate content and respond to reports | Legitimate interests; legal obligation |
| Keep security and audit logs, fix bugs | Legitimate interests |
| Comply with law and respond to valid legal requests | Legal obligation |
Our risk checks may automatically restrict or flag an account for review when they detect unusual activity. You can contact us to ask for a human review of any such decision.
We do not share your data with third parties
We do not sell, rent, trade or share your personal data with any third party. Your username, display name, avatar, bio, email, posts, rewards, payment records and device data stay in Excrypt's own systems. We do not use advertising networks, analytics SDKs or tracking tools, and no third-party code in the app collects your data.
- Inside Excrypt only. Your public profile, posts, comments, community memberships and leaderboard position are shown to other Excrypt users inside the app, according to your privacy settings. They are not passed to anyone outside Excrypt. You can make your profile private, hide your name on leaderboards and hide your activity.
- Our own infrastructure. Excrypt's backend runs on cloud servers we rent (Google Cloud / Firebase), and push notifications are delivered through Expo and Apple or Google's push services. These providers only host or carry data for us. They may not use it for their own purposes.
- When the law requires it. We disclose information only if a valid court order or legal obligation requires it, or if we must protect someone from serious harm.
Blockchain network requests. Like every crypto wallet, the app reads balances and sends transactions by connecting directly to public blockchain nodes, and it loads token prices and logos from public market-data services. These requests contain only the public wallet address or token being looked up, and the standard network information (such as your IP address) that every internet request carries. No account, profile or contact information is ever included.
Transactions you send are published to public blockchains and can be seen by anyone. This is how blockchains work and is outside our control.
Private keys, recovery phrase and PIN
Your private keys and recovery phrase are generated on your device and stored in your device's secure storage (iOS Keychain or Android Keystore). Your PIN and biometric unlock are checked on your device. None of these are ever sent to us or to anyone else.
Because we never have them, we cannot recover your wallet if you lose your recovery phrase, and we cannot move, freeze or reverse your funds. Keep your recovery phrase offline and never share it. Excrypt staff will never ask for it.
Retention and deletion
- Account, profile and social content: kept while your account is active and deleted or anonymised within 30 days after you request account deletion.
- Reward, payment and withdrawal records: kept as long as needed to settle rewards, prevent fraud and meet accounting and legal obligations, then deleted.
- Security and request logs: kept for a limited period for security and debugging, then deleted.
- Data on your device: wallet keys and app settings stay on your device until you remove the wallet or uninstall the app.
To delete your account and associated data, email support@excrypt.io from your verified email, or contact us from the app, and include your username or wallet address. We may ask you to sign a message with your wallet to confirm ownership. Data already recorded on a public blockchain cannot be deleted.
Security
We protect your information with encryption in transit (HTTPS), signed-message authentication instead of passwords, short-lived session tokens stored in secure device storage, access controls on our backend, and audit logging of administrative actions. No system is perfectly secure, so we cannot guarantee absolute security. Protect your device with a screen lock and keep the app up to date.
Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and get a copy of it
- Correct inaccurate data (most profile data can be edited in Settings)
- Delete your account and personal data
- Object to or restrict certain processing, including processing based on legitimate interests
- Withdraw consent, for example by turning off notifications
- Data portability
- Lodge a complaint with your local data protection authority
California residents: we do not sell or share personal information, and we will not discriminate against you for exercising your rights.
In-app controls: Settings lets you edit your profile, set your profile to private, hide your leaderboard name and activity, manage blocked accounts, and choose which notifications you receive. You can also turn off camera, photo and notification permissions in your device settings.
To exercise any right, contact us at support@excrypt.io. We will respond within 30 days.
Children
Excrypt is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
International transfers
Our servers and service providers may be located outside your country, including in the United States. When we transfer personal data from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Changes to this policy
We may update this policy from time to time. We will change the "Last updated" date above and, for significant changes, notify you in the app before they take effect.