Legal
Privacy Policy
Effective 3 October 2026
The short version
- There is no SpiffyVault account. We never ask for your name, email or phone number to use the app.
- We don't track you. No cookies, analytics, advertising or tracking pixels on this website, and no analytics, telemetry or crash reporting in the app.
- We don't sell, rent or share information about you with anyone.
- Your keys, recovery phrase, balances, contacts and payment history stay on your device. We can't see them.
- We disclose information only when a valid legal order compels us to, and we hold almost nothing to disclose.
1. Who we are
SpiffyVault is made by Werkswinkel Pte Ltd, a company incorporated in Singapore (UEN 202139648Z), with its registered office at 160 Robinson Road, #14-04 Singapore Business Federation Centre, Singapore 068914 (“Werkswinkel”, “we”, “us”). This policy covers the website at spiffyvault.net, downloads from download.spiffyvault.net, and the SpiffyVault app. It is written to meet Singapore's Personal Data Protection Act 2012 (“PDPA”).
2. This website
The website sets no cookies, runs no analytics and loads nothing from other companies: its fonts, images and scripts are all served from spiffyvault.net.
The website and downloads are delivered by Cloudflare, our hosting provider. Like any web host, Cloudflare necessarily processes your IP address and basic request details (such as the page requested and your browser type) to deliver pages and protect the site from attacks. Cloudflare acts on our behalf as a service provider; we don't use this information to identify or profile you.
Mobile release sign-up. If you choose to give us your email address to hear about the iPhone and Android apps, we store it, with the date you signed up, on Cloudflare's infrastructure and use it only to send that announcement. We delete it once the announcement is sent, or sooner if you ask. We don't add it to any other list or share it.
3. The app
What stays on your device
Your recovery phrase and keys, wallets and balances, contacts, payment history and notes are created and stored on your device, with keys kept in your operating system's secure storage. None of it is sent to us. If you lose your device and your recovery phrase, we cannot recover anything for you.
What the network sees
SpiffyVault is peer-to-peer and works with a public blockchain. Using it means some information is visible to others, not to us:
- The blockchain. Transactions you make are recorded on the BSV blockchain (the BSV testnet during the testnet beta), where anyone can see the amounts and addresses involved.
- Other peers. Devices your app connects to directly can see your IP address and your peer ID, as with any peer-to-peer software.
- Your public profile. If you publish a profile name or picture, other SpiffyVault users can see it. Publishing one is up to you.
- Mailbox relays. When you pay another SpiffyVault user who is offline, the payment is encrypted end to end with the Signal Protocol and held by a relay until they collect it. The relay can see that a message is waiting for a recipient, and when, but not what it contains. BRC-100 payments don't use this sealed mailbox.
Network services the app uses
To work, the app connects directly from your device to these services. They receive your IP address and the details needed to answer the request; we don't receive or see any of it, and their own privacy policies apply:
- WhatsOnChain (api.whatsonchain.com): looking up balances and transactions for your addresses, broadcasting transactions, and exchange rates.
- A BRC-100 message box (currently message-box-us-1.bsvb.tech): delivering payments to and from BRC-100 wallets.
- A block header service (headers.overnode.net): downloading block headers so the app can check the chain itself.
The app contains no analytics, advertising, telemetry or crash-reporting code.
4. Legal requests
We comply with valid legal orders, such as a court order or a lawful request from a competent authority, and disclose only what the order requires. Because we don't hold your keys, balances, contacts or payment history, we can't disclose them. In practice the only personal data we might hold is an email address you gave us for the mobile sign-up. Where the law allows, we will tell you about a request before disclosing anything.
5. Your choices and rights
Under the PDPA you may ask us what personal data we hold about you, ask us to correct it, or withdraw your consent to our using it. For SpiffyVault that means, at most, your sign-up email address: write to us and we will tell you whether we hold it, and delete it if you ask. We reply within 30 days.
6. Security and retention
We keep what little we hold for no longer than we need it, as described above, and protect it with reasonable security measures. No system is perfectly secure, and you are responsible for keeping your device and your recovery phrase safe.
7. Children
SpiffyVault is not intended for anyone under 18, and we don't knowingly collect personal data from children.
8. Changes to this policy
If we change this policy, we will post the new version here with a new effective date. If a change affects how we handle personal data we already hold, we will tell you before it takes effect where we can.
9. Contact
Questions or requests about privacy go to our Data Protection Officer at hello@spiffyvault.net, or by post to Werkswinkel Pte Ltd, 160 Robinson Road, #14-04 Singapore Business Federation Centre, Singapore 068914.