This Privacy Policy explains what data Statto Wallet (“the App”) collects and how it is handled. The short version: we do not collect anything. The longer version covers what your device shares with third parties when you use the App, because that matters too.
1Who this applies to
This policy covers the Statto Wallet mobile application. It does not cover any third-party service, blockchain, smart contract, dApp, exchange, or website you choose to interact with through the App. Those have their own privacy practices, and you should review them separately.
2What we collect
Nothing.
The App does not run analytics, telemetry, advertising SDKs, crash reporting, or any other tracking. We do not operate a backend that receives data about you. We do not have user accounts, mailing lists, or login systems linked to the App. There is no data about your usage held by us, because none is ever sent to us.
3What stays on your device
Your 25-word recovery phrase and the derived private keys are generated on your device and stored in your device’s secure storage (Keychain on iOS, Keystore on Android), encrypted with AES-256. They are not transmitted off your device by the App at any time. Any PIN you set and any biometric authentication you enable protect access on the device only.
4Third-party services the App contacts
To do anything useful, the App must communicate with blockchain nodes, price feeds, and protocol APIs. These requests typically reveal your wallet address and your IP address to the service you are querying. This is inherent to how any non-custodial blockchain wallet works.
The third-party services the App may contact, and what each one sees:
| Service | What it sees |
|---|---|
| Algorand blockchain nodescurrently algonode.cloud | Your wallet address and IP whenever the App reads balances, fetches your transaction history, or submits a transaction. |
| NFDnf.domains | Addresses you resolve, and the inverse lookups when displaying names. |
| Vestigevestigelabs.org | Your wallet address when fetching swap quotes and asset metadata. |
| Folks Routerfolksrouter.io | Your wallet address when fetching swap quotes and when a swap transaction is prepared. |
| Haystacktxnlab.dev | Your wallet address when fetching swap quotes and when a swap transaction is prepared. |
| Tinymantinyman.org | Your wallet address when fetching swap quotes and when a swap transaction is prepared. |
| WalletConnect bridges | Encrypted relay traffic between your wallet and any dApp you connect to. |
| IPFS gatewaysan Algonode-hosted gateway is the default | Content identifiers (CIDs) for any NFT images the App displays. |
| SupabaseStatto-managed backend | Your wallet address when looking up NFT marketplace listings, offers, auctions, and asset metadata. |
The Statto-managed Supabase backend stores public on-chain data (listings, offers, sales) keyed by wallet address. It does not store anything about your device, your usage, or any data you have not put on the blockchain.
All on-chain transactions, including any fees paid to the Statto fee wallet, are public Algorand records. Anyone can see them. This is true of every blockchain transaction, not specific to this App.
5Cookies and tracking
The App is a native mobile application and does not use cookies or in-app trackers. If you visit a dApp via the App’s WalletConnect browser, that dApp may set cookies in its own web context — that is the dApp’s responsibility, not ours.
6Children
The App is not directed at children under 13, and we do not knowingly process any data about anyone under 13. Because we do not collect data about anyone, this is straightforward to comply with.
7Your rights
Under data protection laws applicable in your jurisdiction (including the UK GDPR and the UK Data Protection Act 2018 if you are in the UK), you have rights including access, correction, erasure, restriction, portability, and objection in respect of personal data held about you.
We do not hold personal data about you, so there is nothing for us to action — but if you believe we hold data about you and want to exercise any of these rights, contact us using the details below.
8Security
Your keys are encrypted at rest on your device using AES-256 and protected by the device’s secure enclave or trusted execution environment where available. The App does not transmit them. Maintaining the physical and logical security of your device — keeping it updated, locked, and free of malware — is your responsibility.
9Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Continued use of the App after a change constitutes acceptance of the updated version.
10Contact
For any privacy-related question, reach out through the Statto community on Discord.