Privacy policy

2.What we collect

To run your account and keep it secure we store:

• Account details: your name, email address and phone number, and your preferences such as theme, hidden networks and custom tokens.
• Your encrypted wallet: the locked copy of your wallet and the settings needed to unlock it, plus any older wallets you replaced or archived.
• Public addresses: the addresses your wallet uses on each network, so we can show balances and history. These are public on their blockchains.
• Security records: login times, IP addresses, browser and device descriptions, active sessions, two-step verification status and an audit trail of security changes.
• Activity you create in Keylo: transactions and swaps sent from the app (hashes, networks, amounts and status) and daily portfolio value snapshots.
• Support conversations: messages you send us and our replies.

3.How we use it

We use this information only to:

• create and secure your account, verify your email and send security alerts such as new-device and password-change notices;
• show your balances, prices, history and swap status;
• answer support requests;
• detect and prevent abuse, fraud and attacks, and meet legal obligations.

4.What we don't do

We don't sell your personal information, show ads, or use third-party analytics or tracking scripts inside the wallet. We don't use your data to train models or build marketing profiles.

5.Services that process data for us

To read and send blockchain data, Keylo's servers contact blockchain node providers and indexers. Requests go through our servers, so those providers see our server, not your IP address, although they can see the public addresses being queried.

• Swap routing: LI.FI and THORChain receive the networks, tokens, amounts and addresses needed to quote and track a swap.
• Prices: DefiLlama receives the list of coins we need prices for, not your addresses.
• Password breach check: Have I Been Pwned receives only the first five characters of your password's SHA-1 hash.
• Email: our email provider receives your email address and the message we send you.
• Hosting: our hosting and database providers store the data described above on our behalf.

6.Cookies and local storage

We use one essential cookie to keep you logged in. It's HttpOnly, so scripts can't read it. Your browser also stores small preferences, such as light or dark theme, on your device. We don't use advertising or tracking cookies, so there's no cookie banner.

7.How long we keep it

We keep your account data while your account is open. Login records and email delivery logs are kept for up to 12 months, the security audit trail for up to 2 years, and support conversations for up to 3 years after they close. When you ask us to delete your account we delete or anonymize your personal data within 30 days, except where the law requires us to keep it longer.

Deleting your account doesn't affect your funds, which stay on their blockchains. Keep your recovery phrase so you can restore your wallet in Keylo or any compatible wallet.

8.Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how we use it. You can update your name and phone number in Settings. For anything else, contact us and we'll respond within 30 days. You can also complain to your local data protection authority.

9.Security

Your wallet is encrypted on your device with AES-256-GCM using a key derived with Argon2id. Our systems use HTTPS everywhere, encrypt stored secrets, rate-limit sensitive actions and log administrative access. Read more on our security page.

10.Children

Keylo isn't meant for anyone under 18, and we don't knowingly collect data from children.

11.Changes and contact

If we change this policy in a meaningful way, we'll tell you by email or in the app first. Questions or requests: contact support or email [email protected].