Privacy Policy

Sealda — the iPhone app, the sealda.app website and the servers behind them — is developed and run by It services company s.r.o., a společnost s ručením omezeným (Czech limited liability company) registered in the Czech Republic (IČO 03366171, Commercial Register maintained by the Municipal Court in Prague (Městský soud v Praze), Section C, Insert 230800), registered office Dandova 2619/13, Horní Počernice, 193 00 Praha 9, Czech Republic ("we", "us"). While Sealda is tested through TestFlight, its builds are distributed through an individual's Apple developer account (section 2). We are the controller of the personal data described here. Privacy contact: privacy@sealda.app.

• Your keys are sealed in the iOS Keychain with a key derived from your PIN (Argon2id, AES-256-GCM), tied to that iPhone. If you turn on Face ID or Touch ID, the app also keeps a second sealed copy of them in the Keychain, also tied to that iPhone. That copy is sealed with a random key (AES-256-GCM), not with your PIN, and the Keychain releases it only after a Face ID or Touch ID match; it stops opening if the faces or fingerprints enrolled on the iPhone change. With it, Face ID or Touch ID alone unlocks Sealda and approves sends. Your PIN, Face ID or Touch ID data, backup password and hidden-wallet passphrases never reach us. Keys are generated and transactions are signed only in the iPhone app. Deleting a wallet in the app removes both sealed copies. Deleting the app does not: iOS keeps them in the iPhone's Keychain, and the next time you install Sealda on that iPhone it offers to remove them. Erasing the iPhone removes them too.
• Optional iCloud backup: if you turn it on, the app encrypts your recovery phrase or key with a password you choose before saving it to your own iCloud Keychain, together with the wallet's name (which iCloud protects, but your backup password does not). We never receive it and can't reset that password.
• Wallet names, your address book, cached balances and history, and a small file the app uses to put names on notifications, stay in the app's storage on your iPhone (and in your own iPhone backups, if you make them). Camera frames used to scan QR codes are not saved or sent.

There are no advertising, analytics or crash-reporting SDKs in the app. Sealda is tested through TestFlight, and its builds are distributed through an individual's Apple developer account, the person TestFlight names as the developer, until they move to the company's own Apple developer account before the App Store release. Apple shares testers' crash reports, usage data and any feedback they send with that account automatically, with their name and email address if they were invited by email. Apple collects these, not Sealda, and they are used only to fix problems.

Blockchain data is public: anyone can look up an address's balance and transfers. What is not public is the link between your installation of Sealda and the addresses it uses. That link is personal data. Our servers process:

• Your wallets' public addresses (and a hidden wallet's when you open it), to show balances and history. For these addresses we index transfers and transaction outcomes from the public blockchains.
• Transactions you send, already signed on your iPhone, to pass them to the network. For Tron we also prepare the unsigned transaction, which your iPhone checks before signing.
• Install records: a random install ID the app creates, its Apple App Attest key and a key the app signs its requests with, to recognise genuine installs and limit abuse. The install ID travels with history requests (including the history import when you add a wallet or open a hidden wallet), with sending and Tron requests, and with every request that registers, changes or removes notifications, next to the push token and any addresses the request names. When the app sets up App Attest, and again if setup fails, it sends a short status or error message with the install ID. It sends one too each time it tries to re-register an install that our servers no longer recognise or that has moved to a new iPhone, and when it pauses those attempts for up to a day; such a message can name the kind of request our servers turned down.
• Notifications: if you turn on notifications, we use your device's push token and the public addresses of your wallets to send you transaction alerts, written in the language the app is set to; when you change it, the app tells our servers. You can turn them off at any time in the app: that removes every notification registration of your iPhone, including those of hidden wallets that are closed. When you open a hidden wallet with notifications on, its addresses are registered with the same push token as your other wallets and marked as hidden, so that its alerts name only the network. Our servers can therefore tell that the hidden wallet is on the same device as your other wallets. That registration is renewed when you open the hidden wallet; it ends when you turn notifications off, and otherwise expires 90 days after the last renewal.
• Technical logs: our servers keep logs, which can include your IP address and request details such as a requested address, for a limited time (section 7), for security and troubleshooting.
• Emails you send us, to answer them.
• Payments to the company: if you send funds to one of It services company s.r.o.'s own wallets that we watch for incoming payments, the payment record (your sending address, amount, token, transaction hash) is kept within the company's own systems.

• To provide the wallet you use — balances, history, sending and the install records that let our servers accept your requests: our contract with you (Art. 6(1)(b) GDPR).
• Notifications: your consent (Art. 6(1)(a)); turn notifications off in the app to withdraw it.
• Security, abuse prevention, logs, backups and recognising payments made to the company: our legitimate interests (Art. 6(1)(f)). You can object (section 9).
• Legal obligations (Art. 6(1)(c)), where a law requires us to keep or disclose data.

We don't sell personal data, use it for advertising, or make automated decisions about you.

• Hosting and infrastructure providers that run our servers, database and backups.
• Network and security providers for our website and API. They handle every request, so they process your IP address and the request content. They also receive email sent to @sealda.app addresses and forward it to our own mail system.
• Blockchain node and data providers. They see the addresses and transactions needed to answer balance, history and sending requests — never your keys — and receive those requests from our servers, not from your device, so they don't see your IP address. Prices and other public blockchain data are fetched without any data about you.
• Apple, for push notifications and App Attest. Your optional iCloud backup is held by Apple under your own iCloud account.
• Our own mail system, for email you send to @sealda.app addresses.
• Block explorers, only if you open a transaction link (they then receive your request directly), and authorities where the law requires us to disclose data.

We choose providers that protect personal data, and we share with them only what they need to provide their service.

Your data may be processed in the European Union and outside it, including in the United States. Where required, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses. Email privacy@sealda.app for details.

We keep personal data only as long as we need it to provide the service, comply with the law and resolve disputes. In particular:

• Data that links an installation to addresses — the install records and notification registrations — is deleted after 12 months without any activity from that installation. Notification registrations the app stops refreshing expire sooner, after 90 days.
• Public blockchain data we indexed for watched addresses (transfers, transaction outcomes, transactions sent) is public by nature and may be kept after that; once the install data is gone it is no longer linked to a device. We delete it on request where it is linked to you (section 9).
• The list of addresses we watch is kept until you ask us to stop tracking an address (section 9); deleting a wallet or turning notifications off usually doesn't remove an address from it.
• Technical logs: the proxy in front of our servers deletes its logs, which hold your IP address and the full URL you asked for (it can contain a wallet address), within 15 days. Our servers' own logs are overwritten as new ones arrive, once about 250 MB has built up for each service, so how long a line lasts depends on traffic.
• Backups are encrypted and stored securely; deleted data is removed from them according to our backup rotation.

Our pages set no cookies of their own and contain no advertising or analytics trackers. Our network security provider may set a strictly necessary cookie, cf_clearance, valid for about a year, to tell people from automated attacks.

Your browser may send our network provider reports about failed connections to the site (Network Error Logging), used only to monitor the network.

Under the GDPR you can ask us to access, correct, delete or export your personal data, to restrict its use, or object to it, and you can withdraw consent at any time. We don't know who you are, so we find data by wallet address: email privacy@sealda.app with the network and the addresses. Before we give you data about an address we may ask you to show that you control it. We reply within one month.

On a deletion request we remove the notification registrations for those addresses, stop tracking them and delete the records we hold only because we tracked them. Nobody can erase data from a public blockchain, and install records contain no address, so we cannot match them to you. Turning notifications off in Sealda removes every notification registration of your iPhone, hidden wallets' included, as soon as the request reaches us; if the app cannot send it then, it sends it the next time it starts. Deleting a wallet removes that wallet's registration; a hidden wallet opened from it can keep its registration until you turn notifications off, or until it expires 90 days after it was last renewed. If you turn notifications off for Sealda in iOS Settings instead, alerts stop at once and the app removes the registrations the next time you open it. None of this usually stops us tracking the address — email us for that.

Before you ask us to delete an address, delete the wallet from Sealda on every iPhone where you use it, and stop opening it if it is a hidden wallet. Otherwise the app sends us its addresses again and we start tracking them again: at every launch while notifications are on, and each time you open a hidden wallet, with notifications on or off. Restoring or importing the wallet later does the same.

You can complain to a data protection authority, in particular in the EU country where you live or work, or to our lead authority, the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů). We don't sell or share personal information for cross-context behavioural advertising.

Sealda is for people aged 18 or over and is not directed at children. If you think a child has used Sealda, email privacy@sealda.app and we will delete the data we can connect to them.

When our processing changes, we update this page and its date; we announce material changes in the app or on this page before they take effect. Questions: privacy@sealda.app, or write to It services company s.r.o., Dandova 2619/13, Horní Počernice, 193 00 Praha 9, Czech Republic. See also the Terms of Service and the Support page.