Privacy policy

Wreck Wallet app and the ESC community. Last updated 14 October 2026.

This policy explains what White Rock Equity ("we") does with information when you use the Wreck Wallet app, the ESC community inside it, and our websites white-rock-equity.com and whiterockequity.world. The short version: the wallet keeps your keys on your device and we never see them, the community stores what you post, and we do not sell or rent any of it.

Who we are

White Rock Equity Inc., [registered address], Canada. Contact for anything in this policy: [[email protected]].

The wallet: what stays on your device

Recovery words and private keys. Generated on your device, stored only in your device's secure storage (Android Keystore, Apple Keychain, or the operating system equivalent on desktop). They never leave the device and we cannot read, back up or restore them. If you lose them, nobody can recover your wallet.
Settings and preferences, including notification choices, stay on the device.

The blockchain: public by design

Transactions you sign are broadcast to a public blockchain. Today the app runs on the Ethereum Sepolia test network. Your wallet address, balances and transaction history on that network are public and permanent, and anyone, including us, can read them. We cannot delete or alter blockchain records.

To send transactions the app talks to infrastructure providers. They receive your wallet address, the transaction data and your IP address in order to process the request:

Alchemy (alchemy.com): blockchain data and transaction relay.
Pimlico (pimlico.io): bundler and paymaster for gas-free transactions.

Each provider handles that data under its own privacy policy. We may change providers; the app update notes will say so.

The ESC community: what we store

When you sign in to the community the app proves you own your wallet by signing a message. We then create a community account linked to your wallet address. For that account we store:

Your wallet address and a session token.
The profile you fill in: display name, country, picture and anything else you choose to add.
What you post: posts, comments, group content, marketplace listings, and photos or video links you attach.
Direct messages and group chats, including photos sent in them. Messages are stored on our server so they can be delivered to the other person; they are not end-to-end encrypted.
Reactions, follows, group memberships and blocks.
Technical logs: IP address, device type, app version and timestamps, kept for security and debugging and deleted on a rolling basis.

Community data lives on servers we rent from Hetzner Online GmbH in Ashburn, Virginia, United States. If you are in the European Economic Area, the United Kingdom or Canada, your data is therefore transferred to the United States.

Push notifications

If you turn notifications on, the app registers a device token so we can tell you about new messages, payments and community activity. On the Google Play version that token goes through Firebase Cloud Messaging (Google). We send only the type of event through that channel, never message text or amounts; the app fetches the content itself. The direct-download version keeps its own connection to our server and does not use Google. Turn notifications off in Settings at any time.

Permissions the app asks for

Camera: to scan QR codes for addresses. Images are not stored or sent anywhere.
Notifications and, on the direct-download Android version, a background service: to deliver notifications. Both are optional.
Photos: only when you choose a picture to attach to a post or message.

What we do not do

No advertising, no ad networks, no tracking across other apps or sites.
No analytics SDK. Google Analytics is switched off in our Firebase project.
No sale or rental of personal data to anyone.
No identity verification. We do not collect government ID, and we do not hold your funds or keys.

Websites and the tester form

If you sign up as a tester on our website we collect your name, the email address you use on Google Play, which devices you test on and anything you write in the notes field. We use it to add you to the test list and to tell you about new builds. The form runs on our customer-management platform (LeadConnector, by HighLevel). Our websites set no advertising cookies.

How long we keep things

Community account and content: until you delete your account, or the account has been inactive for 24 months, whichever comes first. Content you posted into groups may remain visible in those groups in anonymised form after deletion.
Server logs: 30 days.
Tester list: until the test ends or you ask to be removed.
Blockchain records: forever, outside our control.

Your choices and rights

Delete your community account from inside the app under Settings, Account, Delete. This removes your profile, posts, messages and the link to your wallet address from our servers within 30 days. Your wallet and anything on the blockchain are unaffected.
Block people from their profile or a message thread. Blocked users cannot message you or see your posts.
Export or correct your data, or ask what we hold: email [[email protected]]. We answer within 30 days.
If you are in the EEA or UK you may also complain to your data protection authority. In Canada, to the Office of the Privacy Commissioner.

Children

The app is for adults. You must be 18 or older to create a community account. We do not knowingly collect data from anyone under 18; tell us if you believe we have and we will delete it.

Security

Transport is encrypted (TLS). Keys never leave your device. Our servers are firewalled, access is by SSH key only, and backups are encrypted. No system is perfectly secure; keep your recovery words offline and never share them with anyone, including us. We will never ask for them.

Changes

When this policy changes we update the date at the top and, for material changes, tell you inside the app. The current version always lives at white-rock-equity.com/privacy.