Privacy policy · draft · 7 October 2026
This is written from the actual list of systems Dark runs and talks to, not from a template. It is a draft pending review by counsel; the facts in it are current.
01 · The principle
Your keys are generated on your device and never leave it. Your USDG balance and the amounts you send to other Dark users are encrypted on chain with keys only you hold. The contents of a disclosure link are encrypted with a key that lives in the link itself and is never sent to us. Nothing below changes that.
What follows is the honest remainder: the metadata any service sees by existing, and the third parties your device contacts for features that are not private by nature.
02 · What our servers see
| When you… | Our servers record | Why |
|---|---|---|
| Sign in | your address, the time, and the IP address of the request | to issue a session and to rate-limit abuse |
| Look up an account | that the request was made | addresses and IPs are not written to logs on these routes |
| Use our blockchain relay | the requests your wallet makes, incl. signed transactions | you can point the wallet at your own endpoint instead; with the public RPC, one recipient-key lookup per private send still uses our relay |
| Create a disclosure link | that your signed-in account uploaded a blob of a given size, when, and when it was fetched, expired or revoked | to serve and revoke it |
| Turn on payment notifications | the link between your device's push token and your account, and when that account receives a payment | only if you opt in; payloads never contain amounts or addresses |
| Trade a tokenised stock | your stated country of residence and the country your IP resolves to | we are required to refuse some residents |
| Use the web wallet | nothing about your keys: you connect your own wallet, your Dark account key is created in your browser from a signature and never stored or sent, and proofs are built there. Our relay sees your Dark account's requests, as it does for the app | to read the chain and send your transactions |
| Use the assistant | daily usage counts (requests and tokens), keyed by a keyed hash of your address; your messages are not stored and are relayed to Anthropic with addresses stripped | to enforce the daily quota; the assistant runs at Anthropic |
Some stored identifiers — the owner of a disclosure, an eligibility record, an assistant quota — are keyed by a keyed hash of your address rather than the address itself. This protects against a stolen database, not against us: we hold the key.
03 · What they cannot see
| Data | Who can read it |
|---|---|
| Your vault balance | you |
| The amount of a private payment | sender and recipient |
| A payment note | sender and recipient |
| The contents of a disclosure | whoever holds the link |
| Your recovery phrase or keys | you |
There is no Dark key, no support key and no auditor key that decrypts anything.
We cannot comply with a request to read a balance because we cannot read one. The one exception is public by design: an account that has only ever received deposits has a balance anyone can work out from the chain, until its first private payment in or out.
04 · Third parties
Each of these is contacted for a specific feature. Where a feature is not private, we say so in the app before you use it.
| Party | Contacted when | They receive |
|---|---|---|
| DigitalOcean | any request to our API | hosts our servers and database |
| Cloudflare | any request to our API (it sits in front of our servers) | your IP and the request, for routing and abuse protection; it may set a short-lived bot-management cookie |
| Vercel | you open darkwallet.cash or the web app | hosts the site; standard access logs |
| Alchemy | your wallet uses our relay | the relayed blockchain requests |
| The public Robinhood Chain RPC | you choose it, the app falls back to it, you open a disclosure link, or you send a private payment through our relay or your own endpoint (one lookup of the recipient's key, to cross-check it) | your IP and the requests, like any public node |
| Anthropic | you use the assistant | your messages with addresses stripped, relayed through our servers; never audio, never your IP |
| Apple or Google | you speak to the assistant | your voice, if your phone's built-in speech recognition runs in the cloud; the text it produces is what reaches the assistant |
| LI.FI | you request a swap quote | the tokens, amounts and addresses in the quote |
| GMGN, Blockscout, CoinGecko, DexScreener | you view market or explorer data | the token or address you asked about |
| Expo, Apple, Google | you enable notifications | a push token and, with payment notifications on, the time each one is sent, which can be matched to your account's public on-chain transfers. Payloads carry no amounts or addresses; the timing is the accepted cost of opting in |
| Google Fonts | you open the marketing pages | your IP. Never on the disclosure viewer, which loads no third-party resources. |
05 · The blockchain
Robinhood Chain is a public ledger. Your address, your deposits and withdrawals, your ETH balance, and every transaction you send — including private ones, minus their amounts — are visible to anyone, permanently, and are not under our control or subject to deletion.
A disclosure link reveals your address to whoever opens it.
Everything already public about that address is then visible to them too.
06 · Retention
| Data | Kept for |
|---|---|
| Server logs | 14 days |
| Sessions | 24 hours, or until you sign out |
| Sign-in nonces and rate-limit counters | minutes |
| Disclosure ciphertext | until it expires or you revoke it; a revoked or expired record answers 'gone' for 30 days, then everything but its random id is deleted |
| Push tokens | until you turn notifications off or the platform reports the device gone |
| Payment-notification queue | until delivered, then deleted within about an hour; at most one day |
| Residence attestation | 90 days |
| Assistant messages | not stored |
| Assistant usage counts | 35 days |
07 · Your choices
Settings → Network lets you replace our relay with any endpoint. With an endpoint of your own, our servers see nothing your wallet does on chain. With the public Robinhood Chain RPC they still see one lookup per private send: the recipient's key, read through our relay as a second source so the app can cross-check it before encrypting anything to it.
Swaps, market data, the assistant and notifications each contact a third party and are each off until you use them.
You can withdraw everything without any Dark server, using the exit tool described in the docs. Sign out and nothing about you remains on our servers beyond the retention periods above.
08 · Contact
team@darkwallet.cash. This policy will be revised on review by counsel and again at mainnet launch; the date at the top is the date the facts were last checked.