Privacy policy · draft · 18 September 2026
This is written from the actual list of systems Dark runs and talks to, not from a template. It is a draft pending review by counsel; the facts in it are current.
01 · The principle
Your keys are generated on your device and never leave it. Your USDG balance and the amounts you send to other Dark users are encrypted on chain with keys only you hold. The contents of a disclosure link are encrypted with a key that lives in the link itself and is never sent to us. Nothing below changes that.
What follows is the honest remainder: the metadata any service sees by existing, and the third parties your device contacts for features that are not private by nature.
02 · What our servers see
| When you… | Our servers record | Why |
|---|---|---|
| Sign in | your address, the time, and the IP address of the request | to issue a session and to rate-limit abuse |
| Look up an account | that the request was made | addresses and IPs are not written to logs on these routes |
| Use our blockchain relay | the requests your wallet makes, incl. signed transactions | you can point the wallet at any other endpoint instead |
| Create a disclosure link | that your signed-in account uploaded a blob of a given size, when, and when it was fetched, expired or revoked | to serve and revoke it |
| Turn on payment notifications | the link between your device's push token and your account, and when that account receives a payment | only if you opt in; payloads never contain amounts or addresses |
| Trade a tokenised stock | your stated country of residence and the country your IP resolves to | we are required to refuse some residents |
| Use the assistant | nothing is stored; text is relayed to Anthropic with addresses stripped | the assistant runs there |
Some stored identifiers — the owner of a disclosure, an eligibility record — are keyed by a keyed hash of your address rather than the address itself. This protects against a stolen database, not against us: we hold the key.
03 · What they cannot see
| Data | Who can read it |
|---|---|
| Your vault balance | you |
| The amount of a private payment | sender and recipient |
| A payment note | sender and recipient |
| The contents of a disclosure | whoever holds the link |
| Your recovery phrase or keys | you |
There is no Dark key, no support key and no auditor key that decrypts anything.
We cannot comply with a request to read a balance because we cannot read one.
04 · Third parties
Each of these is contacted for a specific feature. Where a feature is not private, we say so in the app before you use it.
| Party | Contacted when | They receive |
|---|---|---|
| DigitalOcean | any request to our API | hosts our servers and database |
| Vercel | you open darkwallet.cash or the web app | hosts the site; standard access logs |
| Alchemy | your wallet uses our relay | the relayed blockchain requests |
| The public Robinhood Chain RPC | you choose it, the app falls back to it, or you open a disclosure link | your IP and the requests, like any public node |
| Anthropic | you use the assistant | your messages with addresses stripped, relayed through our servers; never audio, never your IP |
| Apple or Google | you speak to the assistant | your voice, if your phone's built-in speech recognition runs in the cloud; the text it produces is what reaches the assistant |
| LI.FI | you request a swap quote | the tokens, amounts and addresses in the quote |
| GMGN, Blockscout, CoinGecko, DexScreener | you view market or explorer data | the token or address you asked about |
| Expo, Apple, Google | you enable notifications | a push token; payloads carry no amounts or addresses |
| Google Fonts | you open the marketing pages | your IP. Never on the disclosure viewer, which loads no third-party resources. |
05 · The blockchain
Robinhood Chain is a public ledger. Your address, your deposits and withdrawals, your ETH balance, and every transaction you send — including private ones, minus their amounts — are visible to anyone, permanently, and are not under our control or subject to deletion.
A disclosure link reveals your address to whoever opens it.
Everything already public about that address is then visible to them too.
06 · Retention
| Data | Kept for |
|---|---|
| Server logs | 14 days |
| Sessions | 24 hours, or until you sign out |
| Sign-in nonces and rate-limit counters | minutes |
| Disclosure ciphertext | until it expires or you revoke it; a revoked or expired record answers 'gone' for 30 days, then is deleted |
| Push tokens | until you turn notifications off or the platform reports the device gone |
| Residence attestation | 90 days |
| Assistant messages | not stored |
07 · Your choices
Settings → Network lets you replace our relay with any endpoint. Our servers then see nothing your wallet does on chain.
Swaps, market data, the assistant and notifications each contact a third party and are each off until you use them.
You can withdraw everything without any Dark server, using the open-source exit tool described in the docs. Sign out and nothing about you remains on our servers beyond the retention periods above.
08 · Contact
team@darkwallet.cash. This policy will be revised on review by counsel and again at mainnet launch; the date at the top is the date the facts were last checked.