Privacy Policy

Last updated: October 31, 2026

This policy explains what data the VePa Wallet app ("VePa") handles and how. The data controller is PIXELDROP SHOP S.A.S., Tax ID (NIT) 901.990.237-3, Valledupar, Cesar, Colombia ("we"). Contact: soporte@vepawallet.com. We comply with Colombian Law 1581 of 2012 (personal data protection).

In short: VePa is a self-custody wallet. Your 12-word recovery phrase and private keys are generated and stored encrypted only on your phone. We never receive or see them and we cannot move your funds.

1. Data that stays on your phone

Recovery phrase and private keys (in the system secure storage: iOS Keychain / Android Keystore).
PIN, recovery password (only a cryptographic hash), preferences, address-book contacts and local history.

2. Data we process if you use the email account (optional)

Email address: to send your sign-in code and link your backup.
Encrypted backup: if enabled, your wallets are encrypted on your phone with your recovery password (scrypt + AES-256-GCM) before upload. We store only that encrypted content, which we cannot read. Your password is never sent.
Announcements: the app downloads public VePa announcements without sending personal data.

3. Third-party services used by the app

To work, the app connects to these providers. They may receive your IP address and, where relevant, your public blockchain address:

Supabase (database and authentication) and Resend (email delivery): only if you use the email account.
Alchemy and public nodes of each network: to read balances and history and to broadcast your signed transactions.
LI.FI: swap quotes and execution (receives the address, tokens and amount you choose).
CoinMarketCap, Binance (public market data), CoinGecko and ExchangeRate-API: prices, charts and exchange rates.
Cointelegraph: news. Opening a story opens their website.

Blockchain addresses and transactions are public by nature and visible to anyone on each network's explorers.

4. What we do not do

We do not sell your data or use it for personalized advertising.
We do not use advertising trackers or share data with ad networks.
We do not ask for identity documents.

5. Retention and deletion

We keep your email and encrypted backup while you have an account. You can delete the backup in the app and delete your account in the app or by writing to soporte@vepawallet.com; we delete it within 15 business days. Deleting the app removes local data; without your 12 words you cannot recover your funds.

6. Your rights

You may access, update, correct and delete your data and revoke your consent by writing to soporte@vepawallet.com.

7. Security

We use encryption in transit (HTTPS), on-device backup encryption and row-level access controls in our database. No system is 100% secure: protect your phone and your 12 words.

8. Children

VePa is not intended for anyone under 18.

9. Changes

If we change this policy, we will post the new version here with its date.