Veylor Privacy Policy

Last updated: October 18, 2026

Veylor is a self-custody Zcash wallet for iPhone and Android, published by Zapp LLC ("Zapp", "we", "us"). It is built on the open-source Vizor wallet. Veylor has no account system and never holds your funds: your recovery phrase, keys and wallet data stay on your device. This policy explains what the app keeps on your device, which network services it talks to, and the little information we receive.

1. Who we are

Zapp LLC is responsible for the Veylor app and this policy. Contact: hello@veylor.cash.

2. The short version

• There is no Veylor account. We never receive your recovery phrase, keys, passcode, balances, addresses or transaction history.
• The app contains no analytics, advertising or crash-reporting software.
• To work, the app connects to the network services listed in section 5. Like any server, they can see your IP address (unless Tor is on), when you connect, and what each request contains.

3. Information we do not collect

We do not collect your name, email address, phone number, postal address, advertising identifier or location. We do not collect your recovery phrase, private keys, passcode, wallet database, contacts, balances or transaction history, unless you choose to send them to us. We do not track you across apps or websites.

4. Information stored on your device

• Recovery phrases and key material, in your device's secure storage (the iOS Keychain or Android Keystore).
• The wallet database: accounts, addresses, balances, transaction history, memos and contacts.
• Settings, including your passcode state, network and server choices, Tor and Private queries settings, and any Ethereum RPC address you set.
• For swaps with USDC held on Ethereum: records of each swap, the short-lived accounts a swap uses, and the Railgun wallet kept by the app's built-in Railgun engine.
• Hardware wallet account data for Keystone and Ledger, and the QR or Bluetooth signing data exchanged with them.

We cannot recover your wallet, recovery phrase, passcode or funds if you lose them. Back up your recovery phrase.

5. Network services the app uses

These services are run by third parties under their own policies. Each one receives your IP address unless Tor is on, the time of each request, and the content needed to answer it.

• Zcash lightwalletd servers (a preset community server, or one you choose): to sync your wallet, read the blockchain and broadcast the transactions you send. Shielded transaction details stay encrypted, but transparent addresses and transactions are public on the Zcash blockchain.
• Private queries (optional): private information retrieval servers at valargroup.dev, used to check transaction status and transparent activity without revealing which records you look up.
• Prices: CoinGecko, for the ZEC price on Home. If you turn on "Use market prices" for the portfolio chart, a public price server (zapp-pricing-engine.majorworker.workers.dev) for daily ZEC/USD history. Chart requests carry only the coin, the currency and a date range, nothing about your wallet.
• Swaps: NEAR Intents (1click.chaindefuser.com) for the quotes and swaps you request, which includes the assets, amounts and addresses of each swap. The app also reads a public on/off switch for swaps from functions.vizor.cash.
• Swaps with USDC on Ethereum: the zecSwap service (zecswap-mainnet.pepeman931.workers.dev) that quotes, settles and relays the swaps you start; an Ethereum RPC provider (ethereum-rpc.publicnode.com by default, or the provider you set in Settings), which sees the app's Ethereum requests; Railgun's private proof-of-innocence node (ppoi.fdi.network) and event indexer (rail-squid.squids.live); and IPFS gateways (ipfs-lb.com) with a mirror (railgun-artifacts.pepeman931.workers.dev) for Railgun's proving files. Ethereum transactions are public on Ethereum, while Railgun keeps balances and transfers inside it shielded.
• Coinholder voting (optional): the voting servers at valargroup.dev and valargroup.org, when you take part in a poll.
• Websites you open from the app, such as block explorers or payment links, under those sites' own policies.

6. Tor

If you turn Tor on, the app sends its traffic, including the Railgun engine's, through the Tor network, so the services above see a Tor address instead of yours. On iPhone, background checks that wait for a migration step's confirmations connect directly, even with Tor on; the app's network settings say so.

7. Device permissions

• Camera: to scan QR codes such as addresses, gift cards and Keystone signing codes. Camera frames are processed on your device and are not sent to us.
• Face ID and biometrics: handled by your device's operating system. The app only learns whether the check succeeded.
• Bluetooth: to connect to a Ledger device.
• Notifications, background work and Live Activities: to show sync and transaction progress. These run on your device and create no account.

8. Information you send us

If you contact us or send feedback, including TestFlight feedback, we receive what you choose to share, plus what Apple or Google pass along with it, such as your email address, device model, operating system version, screenshots and comments. Please never send us your recovery phrase, private keys or passcode.

9. How we use information

We use the information you send us only to answer you, to fix problems and improve the app, to protect the app and its users, and to meet legal obligations.

10. Sharing

We do not sell personal information and do not share it for advertising. We share information you send us only at your request, with service providers that help us answer support requests, when the law requires it, or as part of a merger, acquisition or sale of assets. App stores, blockchains and the services in section 5 process data under their own policies.

11. Security

Veylor is designed so that secrets never leave your device, and it uses your platform's secure storage, passcode and biometric protection. You are responsible for keeping your device, passcode and recovery phrase safe.

12. Retention

Data on your device stays until you delete it, reset the wallet or uninstall the app, though some secure storage can persist according to your platform's behavior. Blockchain data is kept by the Zcash and Ethereum networks and cannot be deleted by anyone. We keep messages you send us for as long as reasonably needed to handle them.

13. Children

Veylor is not directed to children, and we do not knowingly collect personal information from children.

14. Your choices and rights

You can stop using the app, reset the wallet to remove its data, and change camera, Bluetooth, notification and background permissions in your device settings. Depending on where you live, you may have rights to access, correct, delete or port information we hold about you, or to object to its use. Send requests to the contact address above; we may need to verify your identity.

15. International users

Information you send us may be processed in the United States or other countries whose data protection laws differ from those where you live.

16. Changes

We may update this policy. When we do, we will change the "Last updated" date above, and the new version applies once posted.

17. Contact

Zapp LLC, hello@veylor.cash.