ZEC Wallet — Privacy Policy

1. Who We Are

ZEC Wallet ("we", "us", "our") is a non-custodial mobile application for managing Zcash (ZEC) cryptocurrency. The application is distributed through the Apple App Store.

Contact: privacy@zcashwallet.app

2. Information We Collect

2.1 Information You Provide

We do not collect your name, email address, phone number, or any personal identifying information.

2.2 Wallet Data (Stored on Your Device)

The following data is generated locally on your device and stored securely in the iOS Keychain / Secure Enclave:

• Seed phrase (BIP-39 mnemonic) — 24 words that control your wallet. Stored encrypted on device.
• Wallet address — your public Zcash address (Unified Address)
• Unified Full Viewing Key (UFVK) — allows read-only access to your transaction history
• Wallet birthday — the block height at which your wallet was created
• Backup encryption key — a 256-bit AES key generated locally, used to encrypt your seed phrase before upload
• Device ID — a randomly generated UUID created by the app, not tied to your Apple ID or device serial number

2.3 Encrypted Backup (Sent to Our Server)

To enable wallet recovery, ZEC Wallet sends the following to our secure backup server (api.zcashwallet.app):

Field	Content	Encryption
device_id	Random UUID (not linked to you personally)	Plaintext
payload	Your seed phrase	AES-256-GCM with your device-side backup key
iv	Initialization vector for AES decryption	Plaintext (required for decryption)
syncToken	Your seed phrase	RSA-OAEP-2048 with server public key
address	Your Zcash unified address	Plaintext (public data)
ufvk	Your unified full viewing key	Plaintext (read-only key, cannot spend)
birthday	Wallet creation block height	Plaintext (numeric)

We cannot spend your ZEC. The backup key that decrypts your seed phrase is stored only on your device. The server-side RSA key allows us to assist you recover your wallet if your device backup key is lost.

2.4 Transaction Data

Your wallet's UFVK is sent to our Zcash light client server to query your balance and transaction history. This data is not stored by us — queries are processed in real-time and discarded. The Zcash blockchain is public; transaction amounts on the transparent pool are visible on-chain.

2.5 Price Data

ZEC price data is fetched from Kraken's public API. No wallet or personal data is sent to Kraken.

2.6 Data We Do NOT Collect

• No name, email, or phone number
• No government-issued ID or KYC information
• No IP address logs associated with wallet addresses
• No analytics, crash reports, or usage telemetry
• No advertising identifiers (IDFA)
• No location data

3. How We Use Your Information

Purpose	Data Used	Legal Basis
Display your balance and transaction history	UFVK	Contract performance
Enable wallet recovery	Encrypted seed backup	Legitimate interest / consent
Process ZEC transactions	Encrypted seed (decrypted locally)	Contract performance
Display ZEC price	None (public API)	Legitimate interest

4. Data Sharing and Disclosure

We do not sell, rent, or trade your information. We share data only as follows:

• Zcash network: Transactions you authorize are broadcast to the public Zcash blockchain. This is irreversible and pseudonymous.
• Kraken API: We fetch ZEC price data from Kraken's public REST API. No wallet data is included.
• Legal requirements: We may disclose information if required by law, court order, or to protect the rights and safety of users.

5. Data Retention

Your encrypted backup is stored on our server indefinitely to enable wallet recovery. You may request deletion of your backup data by contacting us at privacy@zcashwallet.app with your wallet's Device ID (available in the Settings screen under "Wallet Manager").

Data on your device is stored in the iOS Secure Enclave. Deleting the app removes all locally stored data.

6. Security

• Seed phrase stored using iOS SecureStore with WHEN_UNLOCKED_THIS_DEVICE_ONLY access control
• Backup payload encrypted with AES-256-GCM before transmission
• Server-to-backup channel uses TLS 1.3
• Server RSA-2048 key used for syncToken encryption; private key stored in server secure storage
• Face ID / Touch ID biometric authentication available
• Auto-lock after 5 minutes of background use
• Clipboard contents automatically cleared after 60–120 seconds

7. Your Rights

• Access: You can view your wallet address and export your backup key from the Settings screen at any time
• Deletion: Delete your wallet from Settings → Danger Zone. Contact us to remove server-side backup.
• Portability: Your seed phrase can be exported and used with any compatible BIP-39 Zcash wallet
• Correction: Wallet data is cryptographically derived and cannot be "corrected" — create a new wallet if needed

For GDPR or CCPA requests, email privacy@zcashwallet.app.

8. Children's Privacy

ZEC Wallet is not directed to children under 18 years of age. We do not knowingly collect information from minors. Cryptocurrency applications require adult understanding of financial risk.

9. International Transfers

Our backup server is located in the United States. By using ZEC Wallet, you consent to the transfer of your encrypted backup data to the United States. The data is encrypted before transfer and we cannot access the plaintext contents.

10. Device Permissions

Permission	Purpose	Required
Camera	Scan QR codes to enter Zcash addresses	Optional
Face ID / Biometrics	Unlock wallet and confirm sensitive operations	Optional
Network access	Query balance, sync transactions, fetch price data	Required

11. Third-Party Services

Service	Purpose	Privacy Policy
Zcash Network (lightwalletd)	Blockchain queries	z.cash/privacy-policy
Kraken API	ZEC/USD price data (public endpoint)	kraken.com/legal/privacy

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes through the app or by updating the "Last updated" date above. Continued use of ZEC Wallet after changes constitutes acceptance of the updated policy.

13. Contact Us