Back

VeloxWallet

Privacy Policy

Your recovery phrase, private keys and PIN never leave the device. We do not ask for your name, email or phone number: there is no VeloxWallet account. We do not use ads, tracking or behavioral analytics, and we do not sell data.

Last updated: October 16, 2026

This is a translation. In case of any divergence, the Portuguese version prevails.

1. Controller and contact

The controller of the personal data processed in the app is Velox Group.

To exercise your rights or ask questions about privacy, write to support@veloxgroup.app. We respond within the time limits set by Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD").

2. What never leaves your device

The data below is stored only in your device's secure storage, protected by the operating system, and is not transmitted to us or to third parties under any circumstances:

  • the recovery phrase;
  • the private keys derived from it;
  • your PIN;
  • biometric data, which remains under the exclusive control of the operating system — the app only receives a success or failure response.

The app blocks screenshots and display in screen recordings on sensitive screens: where the recovery phrase is shown, where it is typed during import, and on the send confirmation.

This protection depends on the device's operating system. It does not exist in the browser version, and the app warns about this on the screen itself before showing the phrase.

3. There is no account

VeloxWallet does not require registration. We do not collect your name, email, phone number, CPF (Brazilian taxpayer ID), identity document or any personal identification data to use the wallet.

So that the app can save your preferences and a mirror of your balance, an anonymous identifier is created by Firebase Authentication, with no link whatsoever to your identity. This identifier belongs to the device, not to the person.

4. What is sent, and why

The following data is stored in our database (Google Firestore), associated with the anonymous identifier:

  • Public receiving addresses, derived from your wallet. They are used to check balance and history without needing your private key. They are public by nature: anyone who knows them can look them up on the blockchain.
  • App preferences: display currency, network (main or test network), enabled networks and assets, whether balances are hidden, auto-lock time and whether biometrics are turned on.
  • A snapshot of the last balance checked, so that the wallet opens showing values while the network responds.
  • A cache of the transaction history — transaction identifier, network, currency, direction, amount, fee, counterparty address, block, date and status — which is also published on the blockchain.
  • Saved addresses: the name, network, address and note of each contact you save in Addresses, so that they remain available and to check the destination of sends.
  • Device record: an identifier generated by the app, operating system, app version, whether biometrics are available and integrity signals (rooted or jailbroken device, developer mode on, emulator). These are used to warn about insecure environments.
  • Security audit events, such as unlocking, biometric failure, and completed sends and swaps, with date, device and version. They do not include sensitive data.
  • If you allow notifications, the device's notification token, used only to notify you of activity in your wallet.

Before each write, the app checks that no sensitive field is being sent. Recovery phrase, keys, PIN and cryptographic material are blocked by this check.

5. Legal bases

Under Article 7 of the LGPD, we process this data on the following grounds:

  • performance of a contract (item V), to deliver the functions you requested when installing the wallet — showing balance and history and enabling sends and swaps;
  • legitimate interest (item IX), for app security, fraud prevention and fault diagnosis, always with the minimum data necessary;
  • consent (item I), for sending notifications, which you can refuse or revoke in your device settings.

6. Who the data is shared with

We do not sell, rent or transfer personal data. Sharing is limited to what is necessary for the app to work:

  • Google (Firebase): anonymous authentication, database, server functions and notifications, acting as processor.
  • Blockchain infrastructure providers, queried through our server to obtain balance and history and to broadcast transactions. They receive public addresses, never keys.
  • The TON network (Toncenter), queried directly by the app, without going through our server. It receives public addresses, never keys.
  • Public services of each network, queried directly by the app only when our server does not respond, to show balance and history: TronGrid (TRON), Koios (Cardano), BlockCypher and Atomic Wallet (Dogecoin), the public nodes of Avalanche and Arbitrum, and Routescan (Avalanche). They receive the public address queried, never keys or the device identifier.
  • The price quote services, to convert values into the chosen currency: Binance; OKX, only for coins whose trading Binance has suspended; and the European Central Bank, whose reference exchange rate converts values into GBP. They receive only the currencies to be quoted, never addresses or wallet data.
  • The protocols that quote and build swaps — KyberSwap, Jupiter, Omniston, Minswap, SunSwap, THORChain and Maya Protocol — queried through our server when you request a swap. They receive the wallet's public address, the currencies and the amount to swap — never keys or the device identifier.
  • THORChain and Maya Protocol, also queried directly by the app in a cross-chain swap, to verify the deposit address and the swap contract before signing; and, in a swap leaving Cardano, the Koios explorer, to confirm that this address has a vault history. In these queries the app sends no wallet data.

Before you send, the destination address is checked against our list of addresses reported as scams. The lookup is not recorded.

When you tap the link on a receipt, the app opens an external blockchain explorer in your browser. From then on, that site's policies apply.

We may also share data to comply with a court order or legal obligation. Note that, since the wallet is non-custodial, we have no way to hand over keys or funds: they are not in our possession.

7. What we do not do

  • There are no ads in the app.
  • We do not use behavioral analytics, profiling or advertising tools.
  • There is no tracking across apps or websites.
  • We do not access the device's location, contacts or calendar, photos or microphone.
  • The camera is used only to scan address QR codes, with processing on the device itself. No image is stored or sent.

8. Data on the blockchain

Transactions recorded on a blockchain are public, permanent and not under our control. They cannot be deleted, corrected or hidden — not by us, not by you, not by court order.

This means that the rights to deletion and correction provided for in the LGPD apply to the records in our database, not to what has already been published on the networks. This is a characteristic of the technology, not a choice of ours.

9. How long we keep data

  • Profile, preferences and addresses: while the wallet is in use, or until you request deletion.
  • History cache and balance snapshot: replaced with each query; they are a copy of public data.
  • Saved addresses: until you delete each contact, or until you request deletion.
  • Audit events and device record: kept for a limited period, for security and fraud prevention.
  • Data on your device: erased when you remove the wallet through the app, uninstall the app, or enter the wrong PIN ten times.

10. Your rights

The LGPD grants you, among others, the rights to confirm the existence of processing, access the data, correct incomplete or outdated data, request anonymization, blocking or deletion of unnecessary data, request portability, obtain information about sharing, and revoke consent.

To exercise any of them, write to support@veloxgroup.app stating the device identifier, available under About. Since we do not have your name, this identifier is what allows us to locate the records.

You can also erase everything without contacting us: removing the wallet through the app erases the data on the device, and uninstalling ends the sending of any information.

11. Security

The recovery phrase is encrypted on the device with a key derived from your PIN and stored in the system's secure storage. Access requires a six-digit PIN, with progressive lockout after incorrect attempts and erasure after ten failures. Communication with our servers uses an encrypted channel.

No system is infallible. The security of your wallet also depends on you: keep your device up to date, do not use rooted or jailbroken devices, and keep the recovery phrase off the device.

12. International transfer

The cloud services, blockchain providers, price quote services and swap protocols we use operate on servers outside Brazil. In these cases, the international transfer takes place under Article 33 of the LGPD, for the performance of the contract and subject to contractual safeguards from the providers.

13. Children and adolescents

The app is not intended for anyone under 18, and we do not knowingly collect data from this age group.

14. Changes to this policy

This policy may be updated when the app changes or the law requires. The date of the last update appears at the top, and material changes will be communicated in the app.