Privacy Policy

1. Who We Are

The TrekPay wallet app for Android, iOS, Linux, Windows, and macOS (the "App") and the website at https://trekpay.space (the "Website"; together, the "Service") are developed and published by ALEXXIY SOFTWARE LTD, a private limited company registered in England and Wales under company number 17540601, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("we", "us", "our").

For the limited personal data described in this policy, we are the controller under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. You can reach us at support@trekpay.space.

2. Non-Custodial Software Notice

TrekPay, developed by ALEXXIY SOFTWARE LTD, is strictly non-custodial software. All cryptographic private keys and recovery phrases are generated, encrypted, and stored locally on the user's device. ALEXXIY SOFTWARE LTD never collects, accesses, holds, takes custody of, or controls user private keys, recovery phrases, or digital assets, cannot initiate or reverse blockchain transactions, and does not accept, process, or transmit fiat currency.

3. Information We Do Not Collect

We do not collect, and the App does not send us:

• your name, email address, phone number, or any other contact details (unless you choose to write to us, see Section 8);
• usage data or analytics, such as screens viewed, taps, session length, or feature usage;
• device identifiers, advertising IDs, or device fingerprints;
• your location, contacts, photos, or files;
• your private keys, recovery phrase, BIP39 passphrase, spending keys, viewing keys, PIN, or biometric data.

4. Information Stored Only on Your Device

The App stores the following on your device only: your wallets, private keys and recovery phrase (encrypted, using your device's secure storage such as the iOS Keychain or Android Keystore where available), addresses, balances, transaction history and labels, address book entries, settings, local backups you create, and local app logs. We cannot access this data.

This data stays on your device until you delete the wallet in the App or uninstall the App. Back up your recovery phrase first: without it, nobody can restore your wallet.

5. Device Permissions

The App asks for these permissions, and only uses them for the stated purpose:

• Camera: to scan QR codes, such as a Kerrigan address. Images are processed on your device and are not stored or sent anywhere.
• Photos: to read an image you pick, for example a picture of a QR code. The App does not browse your photo library on its own.
• Face ID / fingerprint: optional, to unlock the App instead of your PIN. Your device's operating system handles the biometric check and only tells the App whether it succeeded. The App never receives your biometric data.
• Internet and local network: to connect to blockchain servers, including a node you run yourself on your local network.

6. Network Connections Made by the App

A light wallet needs data from the Kerrigan blockchain. Every server the App talks to sees your IP address, as with any internet connection. You can hide your IP address by turning on the App's built-in Tor option.

TrekPay bridge servers (operated by us). By default, the App connects to our bridge servers (eu-bridge.trekpay.space and us-bridge.trekpay.space) to sync with the Kerrigan blockchain. To answer your App's requests, a bridge server processes:

• your IP address;
• your wallet's transparent addresses and, for most wallets, its extended public key (xpub), which are used to look up your transparent balance and history. These are public keys: they cannot be used to spend your coins, but they can link the addresses of one wallet together;
• signed transactions you choose to broadcast, which become public on the Kerrigan blockchain anyway;
• requests for public blockchain data such as blocks, shielded data, masternode lists, and governance proposals.

Shielded balances are found on your device: the App downloads shielded data in bulk and decrypts it locally, so the bridge does not learn your shielded addresses or shielded balance.

Our bridge servers process this information only to answer each request, or for as long as your App stays connected to receive live updates. We do not keep access logs that record IP addresses, addresses, or xpubs, we do not link requests to a person, and we do not use this information for any other purpose.

You can switch to your own kerrigan-bridge server or another node in Settings. Its operator then receives this information instead of us.

Third-party services. Some features connect directly to services run by others. They receive your IP address and the request itself, and their own privacy policies apply:

• Kerrigan price service (vote.kerrigan.network): the KRGN price, only in Easy Crypto mode. Incognito mode turns these requests off.
• CoinGecko (api.coingecko.com): currency rates used to show values in your chosen currency, only in Easy Crypto mode. Incognito mode turns these requests off. See the CoinGecko Privacy Policy.
• Kerrigan NameSpace (indexer.kerrigan-name.space, registrar.kerrigan-name.space) and public BNB Smart Chain RPC nodes (such as those run by BNB Chain, PublicNode, and Blast API): when you look up, register, or manage a KNS name, they receive the name or address involved.
• Zcash download server (download.z.cash): shielded transactions need the public Sapling parameter files. The App normally gets them from a bridge server, and only falls back to this server if the bridges can't provide them.

Links you open. Links in the App to a block explorer (explorer.kerrigan.network), masternode.space, the KNS documentation, or community channels open in your browser. Those sites' own privacy policies apply.

7. Public Blockchain Data

Transactions on the Kerrigan blockchain are public and permanent. Transparent transactions show sending and receiving addresses and amounts to anyone. Shielded transactions use zero-knowledge cryptography to hide these details. Neither we nor anyone else can change or delete data once it is on the blockchain.

8. Information You Choose to Send Us

• Support messages. If you email us, we receive your email address and whatever you write. We use this only to answer you and fix the problem you report.
• App logs. App logs stay on your device. We only receive a log if you export it and send it to us yourself. The App removes xpubs from its logs, but please read a log before sharing it.
• Voluntary donations. If you send a donation through the App's optional "Fuel Delta" screen, it is an ordinary Kerrigan transaction from your wallet to ours. We see the amount and any memo, as any recipient would, but we cannot link it to you unless you tell us.

Never send anyone your recovery phrase or private keys, including us. We will never ask for them.

9. The Website

• The Website has no analytics, advertising, or tracking, and sets no cookies.
• It saves your choice of view (Transparent or Shielded) and of language in your browser's local storage. This stays in your browser and is never sent to us.
• Our hosting provider processes your IP address and standard request data in order to deliver pages, and may keep server logs for a limited time for security and abuse prevention.
• The Website loads fonts from Google Fonts, so your browser connects to Google's servers, which receive your IP address. See the Google Privacy Policy.

10. App Stores

If you download the App from the App Store or Google Play, Apple or Google processes your data under its own privacy policy. They may give us aggregated statistics, such as install counts, and crash reports if you have chosen to share them with developers in your device settings. These do not identify you, and we use them only to improve the App.

11. How We Use Personal Data and Our Legal Bases

• Running our bridge servers to deliver the blockchain data your App requests (IP address, addresses, xpub, broadcast transactions): performance of our contract with you (UK GDPR Art. 6(1)(b)) and our legitimate interest in providing a working wallet service (Art. 6(1)(f)).
• Keeping our servers and the Service secure and preventing abuse: legitimate interests (Art. 6(1)(f)).
• Answering support messages and fixing reported problems: legitimate interests (Art. 6(1)(f)).
• Meeting legal obligations, such as responding to a valid legal request: legal obligation (Art. 6(1)(c)).

We do not use personal data for marketing, profiling, or automated decision-making.

12. Sharing and Disclosure

We do not sell, rent, or trade personal data, and we do not share it for advertising. We only disclose it:

• to service providers who help us run the Service, such as server hosting and email providers, under contracts that require them to protect it;
• if a valid and binding legal obligation requires it, or to protect the security of the Service or the rights and safety of others;
• to a successor if our business is reorganised, merged, or sold, in which case this policy will continue to apply to the data.

13. International Transfers

Our servers and service providers may be located outside the United Kingdom, including in the European Union and the United States. When personal data is transferred outside the UK, we rely on UK adequacy regulations or on appropriate safeguards, such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

14. Data Retention

• Bridge request data (IP address, addresses, xpub): not kept after the request is answered or your App disconnects.
• Support messages: kept as long as needed to handle your request, and deleted within 24 months of our last exchange unless the law requires us to keep them longer.
• Data on your device: kept until you delete the wallet or uninstall the App.

15. Deleting Your Data

There is no account to delete. To remove the App's data from your device, delete the wallet in the App or uninstall the App. Back up your recovery phrase first. To ask us to delete messages you have sent us, email support@trekpay.space.

16. Your Rights

Under the UK GDPR, and similar laws in the EU and elsewhere, you have the right to access, correct, or delete your personal data, to restrict or object to how we use it, and to data portability. Where we rely on consent, you can withdraw it at any time. To use these rights, email support@trekpay.space. We will reply within one month. Because we keep very little data, we may have none that relates to you, and we will tell you if so.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk (telephone 0303 123 1113), or to your local data protection authority. We would appreciate the chance to address your concern first.

If you live in a US state with a consumer privacy law: we do not sell or share personal information, and we do not use it for targeted advertising.

17. Children

The Service is not directed to children. Under our Terms of Service, you must be at least 18 years old, or the age of majority where you live, to use the App. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, please contact us and we will delete it.

18. Security

The App connects to our bridge servers over encrypted HTTPS and encrypts wallet data on your device. No system is perfectly secure, however, and you are responsible for keeping your device, PIN, and recovery phrase safe. We cannot access your wallet, reset your PIN, or recover your recovery phrase.

19. Changes to This Policy

We may update this policy. We will post the new version on this page with a new "Last updated" date and, for significant changes, give notice on the Website or in the App's release notes.

20. Contact Us

ALEXXIY SOFTWARE LTD
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: support@trekpay.space