Sovrency Wallet Privacy Policy
Effective date: October 7, 2026
Last updated: October 7, 2026
Introduction
Sovrency Wallet is a self-custody wallet for stablecoins and other digital assets. It is provided by CrossBar, Inc. ("CrossBar", "we", "us"), 2055 Laurelwood Rd, Suite 230, Santa Clara, CA 95054, United States. CrossBar is the controller of the personal data described in this policy.
This policy explains what personal data we collect when you use the Sovrency Wallet mobile app for iOS and Android (the "App"), the Active Card hardware device when used with the App (the "Active Card"), and our website sovrency.com (together, the "Service"), why we collect it, who we share it with, how long we keep it, and the choices and rights you have.
Sovrency Wallet is self-custodial. Your wallet's signing key is split into separate key shares using multi-party computation (MPC). One share is held on your phone, one on our servers and, if you use an Active Card, one on the card. A transaction can only be signed when two shares work together. No single share, including the one on our servers, can sign a transaction or reveal your private key, and we never hold your complete private key.
1. Information we collect
1.1 Account data
You create an account with a passkey. When you do, we store:
- an account identifier and the name you give your account or wallet;
- the public part of your passkey credential. The private part of your passkey stays in your device's password manager (for example iCloud Keychain or Google Password Manager) and is never sent to us.
1.2 Device, session and network data
When the App connects to our servers, we receive and store:
- your IP address, together with your account, in session and device records and in server logs;
- device and session information such as device type, operating system, app version and session tokens.
We use this to keep your account secure, to detect and prevent fraud and abuse, and to operate and troubleshoot the Service. We do not use your IP address to determine your precise location.
1.3 Wallet and transaction data
To show balances and history and to send transactions, we process:
- your public wallet addresses;
- details of transactions you create or that involve your addresses, including the recipient address, amount, asset, network and status;
- fee quotes and the data needed to submit transfers on your behalf when network fees are paid for you ("gasless" transfers).
Wallet addresses and transactions are recorded on public blockchains and are visible to anyone. Because our servers can see which addresses belong to your account, this data is linked to your account.
1.4 Key-share and security data
To operate MPC signing and recovery, we store:
- our server's key share for your wallet, encrypted;
- related signing material that is prepared in advance, encrypted;
- encrypted data used to help you recover access to your wallet (recovery records), which we cannot use on its own to access your funds;
- if you use an Active Card, the card's public identity key, used to verify that the App is talking to your card.
Our server's key share takes part in signing only when you request it: for wallets that use your phone and our server, and for transfers where you choose to sign with Cloud. The Active Card's key share never leaves the card.
1.5 Diagnostics and app configuration
- Crash reports. If the App crashes, Google Firebase Crashlytics collects a crash report: the error and stack trace, device model, operating system, app version and a Firebase installation identifier. Crash reports are not linked to your account.
- App configuration. The App downloads configuration (for example feature settings and the terms text shown in the App) from Google Firebase Remote Config, which uses the same installation identifier.
- Product analytics (Android only). On Android, Google Firebase Analytics records events about how features are used, which may include the network and amount of a transfer. On iOS, analytics collection is turned off.
1.6 Active Card firmware updates
When you check for or install an Active Card firmware update, the App sends the card's current firmware version, hardware type and update status to our firmware update server. This information is not linked to your account.
1.7 Communications
If you email us or contact support, we receive your email address and the content of your message, including any attachments you choose to send.
1.8 Website
On sovrency.com we may use essential cookies, and analytics cookies where permitted, to understand aggregate use of the site. You can control cookies in your browser settings. If you join a waitlist or subscribe to updates, we collect your email address.
1.9 What stays on your device
The following are used only on your phone and are not sent to us:
- your phone's key share, stored in your device's secure storage;
- Face ID, Touch ID or fingerprint data, which are handled by your device's operating system. The App only receives a pass or fail result;
- camera images used to scan QR codes, and files you select (such as a backup file);
- your saved addresses (address book);
- communication with your Active Card over Bluetooth.
2. Backups
You can back up your phone's key share. The backup is encrypted on your device with a key that only you can unlock (with your passkey or a PIN you choose), and stored in your own cloud account: iCloud on iOS, or a private app folder in Google Drive on Android. We cannot read your backup. On Android, the App asks you to sign in to Google to access Drive; the access token stays on your device. Your backups are also subject to Apple's or Google's privacy policies.
3. How we use information
We use personal data to:
- provide the Service: create and manage your account and wallets, show balances and history, sign and submit transactions, pay network fees for gasless transfers, support backup and recovery, and update your Active Card;
- keep the Service and our users secure: authenticate sessions, detect and prevent fraud, abuse and attacks, and protect our systems;
- maintain and improve the Service: diagnose crashes and errors, and understand feature use in aggregate;
- communicate with you: answer support requests and send important notices about security or changes to the Service, and, where permitted, product updates you can opt out of at any time;
- comply with the law: meet legal obligations and respond to lawful requests.
We do not sell your personal data, we do not share it for cross-context behavioral advertising, and we do not track you across other companies' apps or websites.
4. Legal bases (EEA, UK and similar laws)
Where the GDPR or similar laws apply, we rely on:
- performance of a contract, to provide the wallet and Service you asked for (account data, wallet and transaction data, key-share data);
- legitimate interests, to keep the Service secure and working and to improve it (IP address, device and session records, logs, crash reports), balanced against your rights;
- legal obligation, where the law requires us to process or keep data;
- consent, where required, for marketing emails and analytics. You can withdraw consent at any time.
5. How we share information
We share personal data only as described here:
- Service providers that process data on our behalf
under contract and confidentiality obligations:
- Google Cloud: hosting of our servers;
- Google Firebase: crash reporting, app configuration and, on Android, analytics;
- Grafana Labs (Grafana Cloud): server logging and monitoring;
- blockchain infrastructure providers (node and data providers), which receive your wallet addresses and transactions in order to read balances and history and to broadcast transactions.
- Public blockchains: when you send a transaction, it is published to the blockchain network and becomes permanently and publicly visible.
- Apple and Google, under your own account with them, when you use passkeys or store backups in iCloud or Google Drive.
- Legal and safety: when required by law, regulation or valid legal process, or to protect the rights, property or safety of our users, CrossBar or others.
- Business transfers: in connection with a merger, acquisition, reorganization or transfer of the Service to another entity, in which case this policy will continue to apply to your data or you will be notified of any change.
6. Data retention
We keep personal data only as long as needed for the purposes above:
| Data | How long we keep it |
|---|---|
| Account data, device and session records, wallet and transaction data, key-share and recovery data | While your account is active. Erased when you delete your account, as described in section 7 |
| Server logs (including IP addresses) | Up to 30 days |
| Database backups | Up to 30 days, after which they are overwritten |
| Crash reports (Firebase Crashlytics) | Up to 90 days |
| Support emails | Up to 2 years after the conversation ends |
| A record that your account was deleted (an internal identifier, timestamps and the result of each deletion step), without your name, passkey or wallet addresses | 3 years, as proof that the deletion was carried out |
| Records of network fees we paid on your behalf (amounts and on-chain references), without your name or account | 7 years, for accounting and tax purposes |
| Blockchain data, including copies of public blockchain data we hold for analysis, which are not linked to your account | Permanent and public; we cannot delete it from the blockchain |
7. Deleting your account
You can delete your account in the App under Settings → My account → Delete account, or by emailing privacy@sovrency.com.
When you delete your account:
- the App deletes the wallets on your phone, including your phone's key share, and deletes the App's backups of your wallets from your iCloud or Google Drive;
- we erase your account immediately: your account record, passkey credentials, wallets, device and session records and address subscriptions. Your passkey stops working and you are signed out on all devices;
- we permanently erase the rest of your data on our servers promptly, and in any case within 30 days: our server's key shares and related signing material, recovery records, transaction records and cached history. We do not keep a waiting period for you to change your mind, because once your account is deleted the data can no longer be used to restore it;
- copies in our server logs and database backups are overwritten within a further 30 days. We keep only the records without your identity listed in section 6;
- your passkey remains in your device's password manager, because it is stored there and not with us. It can no longer sign in, since we have erased its public key. You can remove it in the Passwords app (or Settings → Passwords) on iPhone, or in Google Password Manager on Android;
- if you use an Active Card, the card's key share stays on the card. It cannot sign a transaction on its own. You can remove it with a factory reset of the card, which removes all wallets on that card.
Move your funds before you delete your account. After deletion, the remaining key shares cannot be combined to sign a transaction, so any funds left in the wallet can no longer be moved. Deletion cannot be undone. Data already recorded on public blockchains cannot be deleted.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy of it;
- correct inaccurate data;
- delete your data (see section 7);
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent where processing is based on consent;
- opt out of marketing emails at any time, using the unsubscribe link or by contacting us.
To exercise these rights, email privacy@sovrency.com. We may need to verify your identity, for example by asking you to sign in with your passkey. We respond within 30 days, or within the period required by your local law. We will not discriminate against you for exercising your rights.
EEA and UK: you may lodge a complaint with your local data protection authority.
California: in the past 12 months we have collected the categories of personal information described in section 1 (identifiers, internet or network activity, financial information about your wallet addresses and transactions, and approximate location derived from IP address) for the purposes in section 3. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it.
Republic of Korea: we disclose the transfer of personal data abroad in section 9. You may exercise your rights under the Personal Information Protection Act by contacting us as above.
9. International data transfers
CrossBar is based in the United States. Our servers are hosted by Google Cloud in the United States, and our service providers process data in the United States and other countries. To provide the Service, we transfer the data described in section 1 to the United States. Where the law of your country requires it, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses, for transfers from the EEA, the UK or other countries with transfer restrictions.
10. Security
We protect personal data with technical and organizational measures appropriate to the risk, including:
- encryption of data in transit (TLS) and encryption of key shares and recovery data at rest;
- a multi-party design in which no single key share, including ours, can sign a transaction;
- biometric or passcode confirmation in the App before sensitive actions, and fingerprint approval on the Active Card for transactions signed with the card;
- restricted access to our systems for authorized personnel only.
No system is completely secure. You are responsible for keeping your phone, your passkey and your Active Card safe. If we become aware of a breach that affects your personal data, we will notify you and the authorities as required by law.
11. Children
The Service is not intended for anyone under 18, or under the age of majority where they live if that is higher. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy when the Service, our data practices or the law change. We will update the "Last updated" date above and, for material changes, notify you in the App or by other appropriate means before the change takes effect.
13. Contact us
CrossBar, Inc.
2055 Laurelwood Rd, Suite 230, Santa Clara, CA 95054, United States
Privacy requests: privacy@sovrency.com
Support: support@sovrency.com
Website: https://sovrency.com