Privacy Policy — Pearl Safe

Pearl Safe operates this website and the Pearl Safe mobile app. We are the controller for the limited personal data described below, under the General Data Protection Regulation (GDPR).

The short version

This website sets no cookies and uses no analytics.
We do not load fonts, scripts or images from third-party networks.
The Pearl Safe app needs no account to use. If you set up recovery, it is tied to your Apple or Google sign-in.
If you request beta access, we store your email address as soon as you ask, so we can send the confirmation, with when you asked, which form you used, whether it was delivered and whether you confirmed. If you do not confirm, it is deleted after 14 days.
We have never sold personal data and we will not.

This website

The site is static and is served from Cloudflare. It sets no cookies and stores nothing in your browser.

Cloudflare processes your IP address transiently in order to deliver the page and to protect against attacks, as any web host must. We do not receive an analytics report or a profile from this. Our host's logs (Cloudflare Workers Logs) keep error messages and request details for at most seven days; we use them only to fix problems. Our legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

Requesting beta access

If you enter your email address in the "Get early access" form, we send you one email with a confirmation link. Only when the confirmation link is opened is your address on the list — this is called double opt-in.

What we store: your email address (trimmed and lower-cased), from the moment you ask, so the confirmation can be sent and retried if sending fails; the time you asked; which of the two forms on the page you used; whether the email was delivered, and if not, the error our email provider gave; and whether and when you confirmed. The database holds no IP address, browser or referrer. The links in the email carry random tokens; we keep only a one-way hash of them, so the database on its own cannot confirm or remove anyone.

Our emails show our logo, loaded from pearlsafe.xyz. It is one file, the same for everyone, with nothing in its address that identifies you, and we do not log who loads it, so it cannot tell us whether or when you opened an email.

Purpose: to invite you to the beta and tell you when it opens.
Legal basis: your consent (Art. 6(1)(a) GDPR), given when you confirm from your inbox. You can withdraw it at any time.
Retention: a request that is not confirmed is deleted after 14 days. A confirmed address is kept until the beta programme ends or until you ask us to remove it, whichever comes first. If the programme is cancelled we delete the whole list.
Processors: the list is stored in a database operated by Cloudflare, Inc. (United States) on its global network, and the emails are sent through Resend, Inc. (United States). Both act on our instructions only; transfers outside the EEA rely on the European Commission's standard contractual clauses. The list is not shared with anyone else, sold, or used for anything but the beta.
Spam protection: without a third-party script. Your IP address is used for a short-lived rate limit that keeps a counter in memory at the edge and is never written down.
Leaving: every email we send carries a link that deletes your address at once, no questions asked. Or write to us and we will do it by hand.

The Pearl Safe app

The app needs no account to use, and there is no advertising SDK in it, and no analytics or crash-reporting SDK of ours. On Android, the QR scanner is Google’s ML Kit: when you scan, it sends Google device information, the app’s identifiers, performance metrics and error codes, for diagnostics and usage analytics. The picture never leaves your phone. We never receive your private keys, your recovery phrase, or any part of your key in a form we could use. That is how the app is built, not only a policy.

Showing balances and sending payments

To show balances and send payments the app has to ask blockchain services about your addresses.

Our Pearl node, reached through our server: it sees your Pearl addresses and payments, not your IP address. Our server does not record which addresses were asked about; for rate limiting it keeps only a daily hash of your IP address.
Public Pearl services, asked on every refresh for a second opinion on your balance: the indexer at blockbook.pearlresearch.ai (Pearl Research Labs) and the node and explorer at pearlchain.live. They see your IP address and your Pearl addresses. When you restore or import a wallet, the search for its addresses goes to pearlchain.live alone: it sees every address the search checks, with your IP address.
From version 1.1: Bitcoin data providers, mempool.space and Blockstream (blockstream.info), reached through our server: they see your Bitcoin addresses and payments and our server’s IP address. If our server has not answered for seven days, the app asks them directly, and they then see your IP address too. Our server keeps no address queries.
From version 1.1: Zcash servers, which the app reaches directly: zec.rocks, and Stardust Staking OÜ (zec.stardust.rest) as a fallback. They see your IP address, any public Zcash addresses you use, which transactions are yours and when you send. They do not see your private balance or private payments’ amounts. If you turn on “Use Tor” in the app’s Zcash settings, sending and payment look-ups go through the Tor network instead; catching up with the chain does not. The first time you spend certain older Zcash funds, the app downloads public parameters from z.cash.
Prices come from our server, which fetches them from pearlchain.live and CoinGecko (from version 1.1, for Bitcoin and Zcash too). Those sources learn nothing about you.
Block explorers are opened only when you tap to view a payment, in your browser; the explorer sees your IP address and that payment.

Blockchain payments are public and permanent by design. From version 1.1, private Zcash payments are the exception: their amounts and addresses are encrypted on the chain. Pearl and Bitcoin payments, and public Zcash payments, are visible to anyone.

Passkeys and sign-in

Your passkey is kept and synced by Apple (iCloud Keychain) or Google (Google Password Manager). Signing in for recovery uses your Apple or Google account. Each processes that under its own privacy policy.

If you set up recovery

Turnkey (Turnkey Global, Inc., United States), our recovery provider, receives your Apple or Google sign-in (your account id and email address) and keeps your wallet’s recovery vault: the recovery part of your key and, if you turn on “Recover with just your sign-in”, a copy of the passkey part. Both are sealed inside Turnkey’s secure hardware and are released only to your sign-in, with our server’s approval, after the waiting period. When you set up recovery, change it or recover, the app also asks Turnkey directly about your vault, so Turnkey sees your IP address.
We keep, on our server (Cloudflare, Inc.): the email address from your sign-in, to send recovery warnings; the notification tokens of your phones; and your recovery requests. We also keep the encrypted passkey part of your key, which we cannot open, whether or not you set up recovery.
Expo (650 Industries, Inc., United States) delivers notifications, through Apple’s push service on iPhone and Google’s Firebase Cloud Messaging on Android, and Resend (Resend, Inc., United States) delivers warning emails; each receives only the message and where to send it. Messages never carry an amount. To register, the app sends Expo your phone’s push token and an install id. On Android, Google’s Firebase registers the app (a Firebase installation id) when you turn on notifications; Android versions before 1.1.0, and early 1.1.0 test builds, did so the first time the app opened.
The app also gets a random install token from our server, used to limit how often one phone can use our server (the Pearl node, Bitcoin data and swaps); we keep only its hash, and it is not linked to your wallet.

Swaps

From version 1.1: swaps between Bitcoin and Zcash go through the 1Click service of NEAR Intents, through our server: it receives the amounts, your receiving and refund addresses and the deposit transaction, and our server’s IP address, never yours. It holds the coins being swapped for the few minutes a swap takes, and keeps a record of each swap. Every swap carries a public Pearl Safe tag, so 1Click’s public records show that the swap’s addresses and amounts belong to a Pearl Safe user. Our server reads the country of your IP address to refuse places under sanctions, and keeps it nowhere. Our server keeps no record of your swaps; the details stay on your phone. The swap fee is 0.8 %.

You can delete all of it in the app (Settings → Advanced → Delete wallet and recovery data) or by writing to us — see pearlsafe.xyz/delete-data. Transfers outside the EEA rely on the European Commission’s standard contractual clauses.

Your rights

You may request access to, correction of, deletion of, or a copy of your data, object to processing, or withdraw consent at any time. Write to hello@pearlsafe.xyz. For the beta list, asking us to delete your address is enough and we do not ask why.

You also have the right to complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Changes

If this policy changes materially we will update the date at the top, and we will email the beta list if the change affects data we already hold.

Contact

Pearl Safe · hello@pearlsafe.xyz
Security reports: security@pearlsafe.xyz