Draft — pending legal review.

Not effective — this draft is for review. The operator, legal applicability and required contact channels remain to be confirmed.

Privacy Policy

Draft revised:

This is a draft revision date, not a legal effective date.

This draft describes the current design and data paths of the Halyard mobile applications, browser extension and website. It is not an effective privacy policy. The operating legal entity, data controller, registered address, legal bases and verified privacy contact remain to be confirmed. Deployment settings and third-party arrangements still require verification.

1.1 Local signing and optional backup

Wallet secrets are encrypted on the device and signing is performed locally. Biometric prompts use available operating-system facilities. These design choices do not mean that all wallet-related data stays on the device or that every platform offers identical protection.

If you choose Google Drive backup, an encrypted backup leaves the device and is stored under your Google account. Recovery requires the backup password and each original wallet password. Uninstalling Halyard does not necessarily delete the Drive backup. The service cannot recover a lost recovery phrase or reset a wallet password for you.

1.2 Product events and error diagnostics

Product telemetry is a separate, non-essential diagnostic path. The current mobile implementation can send an installation identifier, a session identifier, event times and permitted event properties to the Halyard backend. A remote setting controls this path and currently defaults to enabled. A configured backend can forward allowed events to PostHog. These identifiers are not a basis for describing the data as anonymous.

Sentry error reporting is enabled when a reporting endpoint is configured. Event filters limit the fields sent, such as permitted error types, filtered stack information, software version and environment. These filters do not apply to all business requests and are not an absolute anonymity guarantee.

Production diagnostic settings, user choice mechanisms and the applicable legal basis remain to be confirmed. This draft does not claim that every diagnostic request requires a completed user opt-in or that a verified opt-out is currently available.

1.3 Functional requests and network metadata

Balance and RPC requests send public account or contract addresses, network and asset identifiers to a selected provider or Halyard service. Those services process balances and relevant asset or transaction data. Risk checks send the address being checked. Price requests use asset identifiers. Address-indexed balance caching exists in the service design.

Swap and bridge providers may receive the account, asset, amount, source and destination networks and recipient needed to quote or build a transaction. Connected dApps and connection services can receive approved account information and relevant requests or transactions. Broadcasting publishes transaction information to the network; blockchain records are publicly observable.

Network recipients can process technical metadata such as IP address and request timing. The production logging fields, access controls, storage locations, retention periods and deletion procedures have not yet been verified. A cache duration in source code does not establish a complete production retention policy.

1.4 Information you choose to provide

A risk report can include the reported address, network, reason, evidence link and a device identifier. Support messages or newsletter information would be processed only if the corresponding channels are actually provided. This draft page offers no verified privacy inbox, support form or newsletter subscription channel.

1.5 Protection boundaries

Do not give a recovery phrase, private key or wallet password to anyone claiming to provide support. Local secret protection and diagnostic filtering are different from functional address, balance and transaction processing. This draft does not claim that the service never processes wallet addresses or holdings.

  • Provide requested balance, price, transaction, route and risk functions.
  • Handle user-initiated reports and, when verified channels exist, related correspondence.
  • Diagnose software failures and reliability issues through separately configured diagnostics.
  • Operate service protections and address applicable legal obligations once the operator and policy are established.

The controller must confirm the applicable legal bases, the distinction between necessary processing and optional diagnostics, any consent or objection mechanism, and the final policy on other uses before publication of an effective policy.

Depending on the selected function, data can be processed by Halyard services and infrastructure, RPC or indexing providers, swap and bridge aggregators, connected dApps and connection services, Google Drive for chosen backups, and configured Sentry or PostHog diagnostic services. Third-party services can have their own terms and privacy practices.

Provider roles, contracts, processing instructions and data-processing agreements remain to be verified. The draft does not state that all providers have signed agreements with an identified Halyard entity.

Rules for lawful disclosure and any business transfer require legal review. Applicable law may require disclosure of information actually held. No promise of advance notification or an exclusive BVI court-order requirement is established by this draft.

Depending on applicable law, rights may include access, correction, deletion, restriction or objection, portability, withdrawal of consent where relevant, and a complaint to a supervisory authority. The scope and exceptions depend on the processing and jurisdiction.

Where GDPR applies, Article 12 provides statutory response requirements, generally within one month with specified extension rules. This is not a claimed Halyard support service level. See the official GDPR text.

The controller, request-verification process and privacy contact remain to be confirmed. This draft cannot receive a rights request. No verified response or deletion workflow is represented as operational.

  • Device data and wallet access depend on the app, device and backups you retain. Protect recovery material before deleting local data.
  • Chosen Drive backups are separate from the installed app and remain subject to your Google account and backup management actions.
  • Functional service caches, reports, infrastructure logs and diagnostic systems need separately verified retention and deletion rules.
  • Public blockchain records cannot be erased by deleting the app or asking Halyard to delete local or service data.

Production retention periods and deletion procedures are still to be confirmed. This draft does not promise a 90-day purge, a 24-month correspondence period or immediate deletion from every provider.

The implementation uses local wallet encryption, encrypted optional backups and diagnostic field filtering. Their protection depends on correct configuration, software and device security. No method provides an absolute guarantee.

Internal validation is ongoing. No independently verified external audit report or public bug-bounty program is currently published on this site. Read the security information for the current boundaries.

The proposed eligibility policy is for adults. Applicable age rules, handling of children's information and any deletion process require legal and operational confirmation. This draft does not claim that age verification or a verified immediate-deletion workflow is in place.

Infrastructure and third-party services may process data in different countries. The controller, deployment locations, recipient roles and required transfer safeguards remain to be confirmed. This draft does not assert BVI operations, executed standard contractual clauses or completed cross-border compliance.

The date on this page records changes to this draft. It is not an effective date. The final policy and any notice process must be completed before the page is presented as an effective privacy policy.

Data controller, registered mailing address and privacy contact: to be confirmed. Whether a data protection officer is required and any appointment are also unconfirmed. No verified privacy submission channel is available on this draft page.