Privacy policy
Phaylos collects nothing.
That sentence is the policy. The rest of this page exists so you can check it rather than take it.
Effective 17 September 2026 · DoneUp, Inc.
What we collect
Nothing. Phaylos has no user accounts, no sign-up, no email address, no phone number, no name. It contains no analytics SDK, no advertising SDK, no crash reporter, and no third-party code that phones home. We do not build a profile of you because we hold nothing to build one from.
The app ships an Apple privacy manifest
(PrivacyInfo.xcprivacy) that declares tracking as
false and an empty collected-data list. Apple validates that
manifest against the app's actual behaviour and against the nutrition label
shown on the App Store listing.
What stays on your device
| Your recovery phrase | Twenty-four words. Held in the iOS Keychain, in an item protected by
kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly and an access
control set to biometryCurrentSet. In plain terms: it never
leaves the device, it is not included in an iCloud or iTunes backup, and
enrolling a new face or fingerprint invalidates it. |
|---|---|
| Your keys | Derived from the phrase on the device, when you unlock. They are not stored separately and are never transmitted. |
| Your settings | Auto-lock timeout, appearance, the address labels you type. Stored in the
app's own container in UserDefaults. Declared in the privacy
manifest under reason CA92.1 — the app reading back its own
settings. |
None of it is sent to us, because there is no "us" to send it to: DoneUp runs no server that Phaylos talks to.
What leaves your device
Two things, and only when you ask for them.
- Balance and history reads. To show your balance, the app asks a public Omne gateway about your address. That request necessarily contains your address and, like any internet request, reaches the gateway operator from your IP address.
- Transfers you sign. A transfer is signed on your device and handed to a gateway to be settled. Once settled it is part of a public network and is permanently readable by anyone.
A gateway is not operated by DoneUp. Omne is a public network: addresses, balances and transfers on it are public by design, for everyone, forever. An address is not your name, but it is durable — anything that ever links it to you links all of its history to you. That is a property of the network, not a choice this app makes, and no privacy policy can undo it.
This website
phaylos.xyz sets no cookies, runs no JavaScript, embeds no fonts or scripts from anyone else, and carries no analytics. It is served by Cloudflare, which as a matter of running a network processes request logs including IP addresses; see Cloudflare's privacy policy. We do not read those logs for analytics and have built nothing on top of them.
Children
Phaylos is not directed at children under 13 and collects no information from anyone, including children.
Your rights
Rights to access, correct, delete or port personal data — under the GDPR, the CCPA, or anywhere else — apply to personal data a company holds. We hold none, so there is nothing to produce, correct or erase, and a request would be answered with that sentence. Deleting the app removes its Keychain items and its container from your device. If that is your only copy of the phrase, the account goes with it.
Changes
If this policy changes, the effective date above changes and the previous version stays in the site's public git history. A change that begins collecting anything would be announced in the app before it took effect, not only here.
Contact
privacy@phaylos.xyz — DoneUp, Inc., a Delaware corporation.