Privacy policy

CreditChain iWallet — web wallet, iOS app and Android app. Last updated 19 October 2026.

In one paragraph. iWallet is a self-custody wallet. Your recovery phrase and keys are created on your device, stored encrypted on your device, and never sent to us or anyone else. We do not run accounts, analytics, advertising or tracking, and we do not collect, sell or share personal data. To show balances and send transactions, the app talks directly to public blockchain services, which — like any website — see your IP address and the requests you make.

What we collect

Nothing. iWallet has no account system, no sign-up, no email, no analytics or crash-reporting service, and no server of ours that your wallet talks to. We cannot see your addresses, balances or transactions, and we could not hand them to anyone because we do not have them.

What stays on your device

Your wallet: the recovery phrase, encrypted. On the web: with your password (argon2id + AES-256-GCM) in this browser's storage. On iOS: in the Keychain, this device only, opened with Face ID, Touch ID or the device passcode. On Android: in encrypted storage, wrapped by an Android Keystore key that needs your fingerprint, face or screen lock.
Your settings, contacts, account names, tracked tokens, added networks and a record of transactions sent from that device.

Removing the app, or removing the wallet in Settings, deletes these from that device. Back up your recovery phrase first: nobody, including us, can restore a wallet without it.

Services the app contacts

The app connects directly to the services below. Each one receives your IP address and what the request needs (for example the address whose balance is shown). Their own privacy policies apply. iWallet adds no identifier of yours to these requests.

Service	Why	Where
Blockchain RPC endpoints	To read balances and send the transactions you sign. Public endpoints run by network operators and infrastructure providers (for example publicnode.com, drpc.org, the networks' own endpoints, and CreditChain's RPC). Any network you add yourself is contacted at the address you entered.	Web, iOS, Android
CreditChain network list (docs.creditchain.org)	To learn CreditChain's current networks. Can be turned off in Settings (web).	Web
CreditChain explorer API	Transaction history on CreditChain networks. Can be turned off in Settings (web).	Web, iOS, Android
CoinGecko	Fiat prices. On the web, off until you say yes. On iOS and Android, used to show values in the portfolio.	Web, iOS, Android
ENS, through the Ethereum RPC	To turn names like alice.eth into addresses when you type one. Can be turned off (web).	Web
Bitcoin, Solana and TRON services (Blockstream, mempool.space, Solana RPC, TronGrid)	Balances and transactions on those chains.	iOS, Android
WalletConnect (Reown) relay	Only if you connect to a decentralised app with WalletConnect: carries encrypted messages between the app and the dapp.	iOS, Android

On the web wallet, Settings → Security & privacy names each optional service with what it learns, and a single "basic functionality" switch turns all of them off.

Permissions on mobile

Camera — only to scan QR codes you point it at. Images are not stored or sent.
Face ID / Touch ID / fingerprint — handled by the operating system; the app learns only whether you passed.
Network — for the services above.

Children

iWallet is not directed at children under 13 (or the age required where you live) and knowingly collects nothing from anyone.

Changes

If what the app contacts or stores changes, this page changes first, with a new date at the top.

Contact

Questions about privacy: info@creditchain.org. Security issues: see security.txt. Support: iwallet.creditchain.org/#/support.