Privacy Policy

Last updated: 10 October 2026

The short version: Qwertycoin Wallet is non-custodial. We do not create user accounts, sell personal data, run advertising, or use analytics or tracking SDKs. Your seed phrase and private keys are processed and stored locally and are never sent to Qwertycoin infrastructure. Limited network data is necessarily processed when you connect to nodes, the official pool, the explorer, or the Web Wallet infrastructure.

Scope and contact

This policy applies to the official Qwertycoin iOS app and the Qwertycoin Web Wallet at wallet.qwertycoin.org, together referred to as “Qwertycoin Wallet”. It explains what information the wallet processes, how it is used, where it is stored, and how you can request deletion of information under our control.

Qwertycoin Wallet is provided by the Qwertycoin Project. Privacy questions and deletion requests can be sent to [email protected].

Information we do not collect

Seed phrases and private keys: your seed phrase, private spend key and private view key are not transmitted to Qwertycoin infrastructure.
Accounts and contact details: the wallet has no account registration and does not request your name, email address or phone number.
Advertising and analytics identifiers: the wallet contains no advertising, behavioral analytics, cross-app tracking or third-party tracking SDK.
Contacts: the wallet does not request access to your device contacts.
Precise location for remote use: if you enable Trusted Locations in the iOS app, the location is evaluated and stored on your device and is not sent to Qwertycoin infrastructure.

Information stored on your device

iOS app

The iOS app stores wallet files and cache data, encrypted wallet credentials in the iOS Keychain, preferences, locally maintained Messenger contacts and history, optional trusted-location zones, and diagnostic logs on your device. This information is used only to provide wallet, security, Messenger, hardware-wallet, widget and troubleshooting features.

Camera: used only when you choose to scan a QR code. QR content is processed on the device.
Face ID: authentication is handled by iOS. The app does not receive or store biometric data.
Photos: the app writes a receive QR image to your photo library only when you ask it to.
Location: optional Trusted Locations are processed locally to control or warn about wallet synchronization.
Bluetooth: used to communicate with a supported hardware wallet when you enable that feature.
Notifications: local notifications may be used for wallet security or locally configured alerts. Qwertycoin Wallet does not currently operate a remote push-notification service.

Web Wallet

The Web Wallet derives and uses wallet keys inside your browser tab. Wallet session data is stored in browser sessionStorage and is removed when the tab is closed. If you set a session password, key material in sessionStorage is encrypted with AES-GCM using a key derived locally with PBKDF2-SHA256. The password is not sent to a server.

Information sent over the network

Blockchain synchronization and transactions

The wallet connects to a Qwertycoin node selected by you or to the default Qwertycoin mobile/Web Wallet gateway. Nodes receive blockchain requests and, when you choose to send QWC, the completed signed transaction. Node and gateway operators can necessarily process your IP address, connection time, request metadata and the signed transaction. Your seed phrase and private keys are not included.

You can choose a custom node. A custom or third-party node is operated under its own privacy practices. The Web Wallet can also be self-hosted with your own restricted node.

Official pool and explorer

If you open the official-pool view in the iOS app, the selected public Qwertycoin address is sent to pool.qwertycoin.org to retrieve public mining and payout statistics. The pool also processes shares, payout history and public address information provided by miners. The network-status views request public pool, blockchain and EPoSE information from Qwertycoin services. These requests include standard network metadata such as IP address, timestamp and user agent.

Messenger and blockchain records

Qwertycoin Messenger messages are encrypted locally and carried by signed Qwertycoin transactions. The encrypted payload and transaction metadata are relayed to the decentralized Qwertycoin network and become part of its distributed records. Qwertycoin infrastructure does not receive plaintext messages or Messenger private keys. Because blockchain records are replicated by independent participants, confirmed transaction data and encrypted message payloads cannot be edited or deleted by the Qwertycoin Project.

Sign, Verify and pool challenges

Message signing, signature verification and validation of pool payout challenges take place locally. The wallet does not transmit the message, challenge, signature or private spend key merely because you use these tools. A signature leaves your device only if you choose to copy, share or submit it.

Diagnostic information you choose to share

The iOS app keeps a bounded diagnostic log locally. If you explicitly share it, the export can contain the device model, iOS and app version, node URLs, sync progress, wallet-engine errors and sanitized hardware-wallet session outcomes. It is designed not to contain seed phrases, private keys, PINs, node passwords, wallet addresses, balances, raw hardware-wallet payloads or nearby Bluetooth device names. The destination you select in the iOS share sheet receives the exported file under that service's privacy practices.

Web hosting and abuse protection

wallet.qwertycoin.org is hosted on Cloudflare Pages and delivered through Cloudflare's network. Cloudflare necessarily processes requests for static files and restricted RPC endpoints, including IP addresses and standard HTTP metadata. Cloudflare Turnstile may be used as an abuse-control step for transaction submission. The Web Wallet has no additional advertising or analytics tracker, uses self-hosted fonts and application assets, and generates QR codes locally.

How information is used

Information described above is used only to provide the requested wallet or network function, secure and rate-limit the service, diagnose faults, prevent abuse, respond to support requests and comply with applicable law. It is not sold, used for advertising or used to build behavioral profiles.

Retention and deletion

On-device data: remains on your device until you remove the relevant wallet data or uninstall the app. The iOS app provides controls to remove wallets. Browser session data is removed when the Web Wallet tab is closed.
Diagnostic data: remains on your device unless you choose to share it. Information voluntarily sent to Qwertycoin support is retained only as long as necessary to resolve the request, investigate a security issue or meet a legal obligation, and can be deleted on request where permitted.
Infrastructure data: official services and their infrastructure providers may temporarily retain standard network and security records for service delivery, rate limiting, abuse prevention and incident response. These records are not used for advertising or user profiling and are deleted or de-identified when no longer operationally or legally necessary.
Pool records: off-chain support or operational records under our control can be deleted on request where this does not conflict with security, accounting or legal obligations.
Blockchain data: confirmed transactions, including encrypted Messenger payloads and public pool payouts, are replicated by the decentralized network and cannot be deleted by us.

To request access to or deletion of information under our control, email [email protected]. You can stop optional local processing by disabling the relevant feature or permission in iOS Settings. You can stop using official endpoints by selecting a custom node or self-hosting the Web Wallet.

Third parties and data protection

Network requests may be processed by Apple platform services, Cloudflare, Qwertycoin nodes, the official pool and explorer, a hardware-wallet provider, or a service you select through the iOS share sheet. Independent node operators and services you choose are responsible for their own practices. Third parties engaged by the Qwertycoin Project to process information are required to protect it consistently with this policy and applicable law.

Children's privacy

Qwertycoin Wallet is not directed to children and is not listed in the App Store Kids Category. We do not knowingly collect personal information from children. A parent or guardian who believes a child has provided personal information under our control can contact us to request deletion.

Security

We use technical and organizational safeguards appropriate to the information we process. No system is completely secure. Protect your seed phrase and private keys, verify the official domain and app publisher, and do not place personal or sensitive information in blockchain transactions or Messenger messages.

Changes to this policy

We may update this policy when wallet features, infrastructure or legal requirements change. The revision date at the top will be updated, and Web Wallet changes remain visible in the public git history of privacy.html.

Source and security reports

The Web Wallet implementation can be reviewed in the public source repository. Security reports should follow SECURITY.md rather than being posted publicly.