Privacy Policy for TWallet

1Core Principles

1.1. Our Privacy Philosophy. The core functionality of TWallet is designed to be "userless" and operate without collecting personal data that directly identifies you, such as your name, email, or phone number. You are not required to create an account or register to use the core features of our non-custodial wallet. Our goal is to minimize data collection while providing you with a secure and convenient tool to interact with the blockchain and manage your assets.

1.2. Our Commitment to Transparency. To provide a secure and functional platform, and to enable specific services such as swaps, we must process a limited set of both technical and transactional data. We are committed to being fully transparent about our data practices. The following sections provide a detailed description of what data we process, why we do it, and for how long it is stored.

1.3. Blockchain Disclaimer (PLEASE READ CAREFULLY). TWallet is a software interface designed to help you interact with blockchain networks, primarily The Open Network (TON). Our fundamental purpose is to enable user access to these decentralized ecosystems. Our use of public and permissionless blockchain technology is not an optional choice but is inherent and essential to the very service we provide.

It is critical for you to understand the fundamental nature of these networks. Each public blockchain, such as TON, is a decentralized publicly available ledger, meaning it is not operated or controlled by us or any other single entity. The rules of each network, including what data is required for a transaction to be valid and how that data is processed and stored, are determined by that network's specific protocol, not by us. When you conduct a transaction, its details (including, but not limited to, your wallet address, the recipient's address, and the transaction amount) are broadcasted to this public network, verified by its participants, and permanently recorded in this public ledger ("On-Chain Data"). This has several important consequences for your data:

• Public and Permanent by Design. All data recorded on the blockchain is visible to anyone in the world with an internet connection;
• Immutability. Once data is recorded on the blockchain, it cannot be altered or deleted. It is permanent;
• Global Data Distribution. Due to the decentralized nature of public blockchains, your On-Chain Data is copied, stored, and distributed across a global network of computers (nodes). This means your data will be replicated in numerous countries around the world, including those that may not offer the same level of data protection as your country of residence;
• Limitation of Data Protection Rights. Due to the immutable and decentralized nature of blockchain technology, certain data protection rights, such as the "right to erasure" or the "right to rectification", are technically impossible to exercise for data that has been recorded on-chain.

1.4. Roles Under Data Protection Law

Your Role as the Controller for General Transactions. Data protection laws define a "controller" as the person or entity who decides the "why" and "how" personal data is processed (the "purposes and means"). For your general, self-initiated on-chain transactions (like sending funds), you act as the sole data controller. You alone determine the purpose and the key elements of the transaction:

• a) The Purpose: You decide why you are making a transaction (e.g., to send funds);
• b) The Means & Data: You exclusively determine the key elements of the transaction, deciding upon the recipient's address, the amount, when to send it, and what, if any, additional information to include.

TWallet does not initiate, approve, or have knowledge of the purpose of these transactions. We provide a non-custodial software tool that acts on your explicit instructions. For these reasons, you, and not TWallet or Sveves Labs, are the controller of this data. You are solely responsible for this data, and we urge you to carefully consider the permanent and public nature of the blockchain before proceeding.

Our Role as a Data Controller. Sveves Labs acts as a data controller in two specific contexts. First, we are the controller for the limited technical and communication data that we process on our servers to secure and operate our services. Furthermore, when you choose to use our specific services (such as our swap aggregator), we also act as a controller for the data strictly necessary to provide that service. In these situations, you are instructing us to process your On-Chain data to fulfill a service you have requested.

The Role of the Blockchain Network. Network participants who merely validate and add transactions to the blockchain without determining their purpose or means (such as network validators) are generally not considered data controllers for those transactions. They act as part of the decentralized infrastructure on which your data is recorded at your instruction. This reinforces that the ultimate responsibility and control over On-Chain Data lie with you, the user.

1.5. Age Limitation. Our services are not directed to or intended for use by individuals under the age of 18. We do not knowingly collect personal data from anyone under this age. By using TWallet, you represent and warrant that you are at least 18 years old.

1.6. If you are a parent or guardian and you become aware that your child has provided us with personal data without your consent (for example, by contacting our support service), please contact us immediately at support@tmail.ae. If we become aware that we have inadvertently collected personal data from a child under the age of 18, we will take immediate and reasonable steps to delete that information from our systems.

2Data We Process, Purpose, and Legal Basis

2.1. This section details the limited data we process to ensure the security and functionality of our services, the specific purposes for which we use it, and the legal grounds for its processing under data protection laws.

2.2. Off-Chain Data We Process. While we do not require you to provide directly identifying information, we process the following categories of data that are not recorded on the blockchain ("Off-Chain Data"):

• Security Log Data. To protect our services and infrastructure, our servers automatically process technical information, which includes your IP address. This data is essential for identifying and mitigating security threats such as DDoS attacks and fraudulent activity;
• Unique Anonymous Identifier. We may generate a unique, random identifier for your application installation. This identifier is not linked to your real-world identity and is used for anonymized product analytics to improve user experience. Specifically, we use it to analyze high-level user engagement metrics like session duration and retention;
• Aggregated Technical Data. We collect fully anonymized, non-personal data for statistical purposes, such as your country (derived from your IP address), device platform, and app version;
• Communications with Support Service. If you choose to contact our support service (for example, via email at support@tmail.ae or via Telegram), we will process the data associated with your message (such as your email address, Telegram username, and the content of your message) solely for the purpose of responding to your inquiry and providing assistance. We ask that you do not share any unnecessary personal or sensitive information in your support requests.

2.3. On-Chain Data We Process. When you use certain integrated services in the TWallet application, we process publicly available On-Chain Data for specific purposes. This includes:

• Swap Aggregator. Where available, our swap aggregator is a tool that searches multiple decentralized exchanges to find an available rate for your trade. When you initiate a swap, we process your transaction data. This data is necessary for our system to construct a transaction route for your approval and facilitate the exchange.
• Wallet Display Data. The Platform reads publicly available blockchain data, such as token balances, transaction history, NFTs, and Telegram Gifts associated with addresses you control, in order to display that information to you in the interface. This display does not mean we store a complete copy of your on-chain history.

2.4. Biometric Authentication. For your convenience and enhanced security, our application may allow you to use your device's native biometric authentication to confirm actions. We want to be perfectly clear: we do not collect, store, receive, or have any access to your biometric data (fingerprint or face). The entire authentication process is handled securely within your device's operating system (e.g., Apple's Touch ID / Face ID or Android's Biometric Prompt). Your biometric data never leaves your device. Our application only receives a confirmation from the operating system that the authentication was successful.

2.5. Purpose of Processing. We process the data described above for the following specific purposes:

• To Secure Our Platform: Ensuring the security, stability, and integrity of our services is our top priority. This includes protecting our platform from malicious activity and ensuring we adhere to our legal obligations. As part of these efforts, we may enforce geographical restrictions to comply with applicable international sanctions, laws, and regulations;
• To Ensure Core Functionality: Processing technical data is necessary for the Platform to operate correctly;
• To Improve Our Services: We use aggregated and anonymized data to understand usage patterns, analyze feature popularity, and optimize the user experience. This data is always used in a way that does not identify individual users;
• To Provide Requested Services: We process your data to deliver the specific services you request, such as constructing a swap route through our aggregator;
• To Provide User Support: Responding to your inquiries and providing assistance.

2.6. Legal Basis for Processing. We rely on the following legal bases under data protection laws for our processing activities.

2.6.1. Performance of a Contract. We process your On-Chain Data described above because it is necessary to provide the services you request, which form a contract between you and us. This includes processing your transaction data to facilitate an exchange via our swap aggregator.

2.6.2. Our legal basis for processing other data described above is Legitimate Interests. This means we process data because it is necessary for us to operate our service effectively and securely. We do not rely on your consent for this essential processing, as providing a secure, functional, and supported platform cannot be optional. Our legitimate interests are:

• Operating, maintaining, and securing our application. This includes protecting our platform, our users, and our infrastructure from security threats, ensuring stability, and enforcing our Terms of Use;
• Improving our application. Analyzing anonymized usage patterns allows us to understand which features are popular, and make informed decisions about future development of TWallet;
• Providing user support. When you contact our support service, we process the data you provide (such as your email address, Telegram username, and the content of your message) to assist you. Our legitimate interest is to provide timely and effective support to our users. As you initiate the contact, you have a reasonable expectation that we will process your data to provide a response, and this processing is not overridden by your fundamental rights.

2.7. Under data protection laws, relying on legitimate interests requires us to carefully balance our interests against your fundamental rights and freedoms. We have conducted this balancing test and concluded that our processing is justified for the following reasons:

• Minimal Privacy Impact. We process a very limited scope of technical data for a short period. We do not collect directly identifying information, and analytical data is always anonymized or aggregated. We do not use this data for profiling or for making automated decisions that affect you;
• Reasonable User Expectation. Users reasonably expect a secure and stable application and the ability to receive support. Data protection laws recognize that processing personal data to the extent strictly necessary for ensuring network and information security constitutes a legitimate interest. Similarly, users who initiate contact with our support service reasonably expect their inquiry to be processed to provide a response;
• Commitment to Data Protection by Design. Our commitment to protecting your data is a key part of our justification. We build our services on the principles of data minimization and continuously assess risks.

2.8. Your Right to Object. Because we rely on legitimate interests, you have the right to object to our processing of your technical data on grounds relating to your particular situation. You can find a detailed explanation of this right and how to exercise it in Section 8.

3Third-Party Services

3.1. We may provide links and access to third-party websites, applications, protocols, or services (collectively, "Third-Party Services") that are not owned, controlled, or operated by TWallet or Sveves Labs. These links are provided for your convenience and informational purposes only.

3.2. No Endorsement or Control. The inclusion of any link to a Third-Party Service does not constitute an endorsement, approval, vetting, or recommendation by TWallet. We have no control over, and assume no responsibility for, the content, functionality, or privacy policies of any Third-Party Service. We do not monitor or review these external services.

3.3. Your Responsibility and Assumption of Risk. Your interaction with any Third-Party Service is solely at your own risk. This applies especially to financial activities such as swapping tokens or staking with third-party projects or validators, where we act only as an interface. We strongly advise you to conduct your own due diligence and to carefully read the terms of service and privacy policy of any Third-Party Service before providing them with any information or engaging in any transactions.

3.4. TWallet and Sveves Labs shall not be responsible or liable, directly or indirectly, for any damage, loss, or other harm, including financial loss, caused or alleged to be caused by or in connection with your use of or reliance on any Third-Party Service accessed through our platform.

4Cookies and Similar Technologies

4.1. TWallet does not use cookies or similar tracking technologies to monitor your preferences, track your behavior across different sites, or deliver personalized advertising.

4.2. Distinction from Internal Analytics. For clarity, the essential, anonymized internal analytics we collect (as detailed in Section 2) are for the sole purposes of ensuring security, maintaining core functionality, and improving our services by understanding usage patterns. These practices are distinct from the cross-site tracking described above and do not rely on advertising cookies.

5Data Sharing and Disclosure

5.1. Our core principle is to limit the sharing of your data. We do not sell or rent your personal data to any third parties for marketing or any other purposes. We only share data in the limited circumstances detailed below.

5.2. To develop, operate, and improve our services, we may share the technical data we process with our development partners. Such a company acts as a data processor on our behalf, operating strictly under our instructions. Access to data is provided for specific purposes such as technical support, development, and security analysis. We implement data protection arrangements to ensure your data remains secure and is processed only in accordance with this Policy.

5.3. To provide our services, we operate on a global scale. Our technical infrastructure, support teams, and affiliated legal entities may be located in various countries. Therefore, it is operationally necessary for us to process and transfer your limited personal information across borders. When we transfer your data outside of your country of residence, we ensure it is protected by implementing suitable technical, organizational, and contractual safeguards, as required by applicable data protection rules.

5.4. We may disclose the technical data we hold if we believe in good faith that such disclosure is strictly necessary to:

• Comply with applicable law or to respond to a valid and legally binding order from a competent court or law enforcement agency, which we are compelled to follow. The Company is committed to challenging overly broad or questionable requests whenever legally feasible;
• Protect the security or integrity of our application;
• Prevent or investigate possible wrongdoing in connection with the service.

We will only disclose data when legally compelled to do so and will aim to provide the minimum amount of information required.

5.5. We also may engage trusted third-party companies and individuals to provide essential services on our behalf. This includes infrastructure and hosting providers who have access to the technical data we process only to perform these tasks on our behalf. They are bound by contractual obligations to keep this data confidential and secure and are prohibited from using it for any other purpose.

6Data Retention

6.1. In accordance with the data protection principle of storage limitation, we do not store personal data for longer than is necessary for the purposes for which it was processed. Our retention periods for different categories of Off-Chain Data are detailed below.

6.2. Retention Periods by Data Category.

• Security Log Data (IP Addresses). We retain security logs containing your full IP address for 90 days from the date of collection. After this period, the logs are automatically deleted or fully anonymized. This period is necessary to investigate and mitigate security incidents;
• Communications with Support Service. Data from your communications with our support team is retained for as long as necessary to resolve your inquiry and for a reasonable period afterward (typically 6 months) to handle any follow-up questions. You may also request the deletion of this data at any time;
• Anonymized Analytical Data. Aggregated and fully anonymized data that cannot be linked to any individual may be retained for longer periods for statistical and product improvement purposes;
• Unique Anonymous Identifier. We retain this identifier for 24 months from the user's last interaction with the application. This retention period is necessary to analyze long-term user retention. After this period, the identifier is deleted or fully anonymized;
• Swap Aggregator Data. The off-chain records that link your wallet address to our integrated swap service, if any, are retained for as long as necessary to administer the service, plus an additional 6 months thereafter to resolve any potential disputes. After this period, these records are deleted from our database.

6.3. On-Chain Data. As stated in Section 1, all data recorded on the public blockchain (such as your wallet address and transaction history) is permanent and immutable. We do not control this data, and therefore, it is not subject to our retention policies.

7Data Security

7.1. We are committed to protecting the data we process and the integrity of our services. We implement appropriate technical and organizational measures designed to protect the limited Off-Chain Data we control from unauthorized access, alteration, disclosure, or destruction.

7.2. Our security measures are tailored to the low volume and limited sensitivity of the data we process. These measures include:

• Encryption. We use encryption to protect data in transit and at rest;
• Access Controls. We enforce strict access controls to ensure that our backend systems and the technical data they contain are accessible only to authorized personnel;
• Infrastructure Security. We use trusted, secure cloud infrastructure providers to host our services;
• Regular Assessments. We periodically review our security practices to adapt to new threats and vulnerabilities.

7.3. While we strive to implement robust security measures for our systems, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee the absolute security of the data we process.

8Data Protection Rights

8.1. We are committed to ensuring you can exercise your rights over your data under applicable data protection laws. The applicability of these rights depends on the type of data in question: Off-Chain Data, which we process, and On-Chain Data, which we do not control.

8.2. Rights Concerning Your Off-Chain Data. You can exercise the following rights with respect to the limited technical and communication data that we control:

• Right of Access. You have the right to request information about the personal data we hold about you. This may include security log data (such as your IP address from within our 90-day retention period) and any communications you have had with our support team;
• Right to Erasure ("Right to be Forgotten"). You can request the deletion of personal data we control. For example, we will delete the history of your communications with our support team upon your request. Technical log data is automatically deleted on a rolling basis as described in the Data Retention section;
• Right to Rectification. You have the right to have inaccurate personal data we hold about you corrected. This is primarily relevant for information you may have provided during a support conversation;
• Right to Object. Where we process your data based on legitimate interests, you have the right to object to this processing on grounds relating to your particular situation. This is different from withdrawing consent. If you object, we will stop processing the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights, and freedoms.

8.3. Limitations Regarding On-Chain Data. As explained in Section 1, TWallet is an interface to public blockchains, which are immutable and decentralized public ledgers. Consequently, for any data recorded on-chain the right to erasure and the right to rectification are technically impossible to exercise once a transaction has been recorded. We have no ability to alter or delete data on the blockchain. These limitations are not a policy of TWallet; they are a direct and inherent consequence of the fundamental design of the public blockchain protocols you choose to interact with.

8.4. To make a request regarding your data protection rights for the Off-Chain Data we control, please contact us at support@tmail.ae. All requests are handled free of charge, unless they are manifestly unfounded or excessive. Please note that because our service is designed to be anonymous, our ability to verify you and fulfill your request depends on the data in question:

• For Support Communications. To access or delete your support history, you must contact us from the same account (for example, the same email address or Telegram profile) you originally used. This is the only way we can verify that the request is genuinely from you;
• For All Other Data (Including Technical and Service Data). We do not link data such as security logs or our internal records of your activity to a verifiable identity. Therefore, we generally cannot identify which data belongs to you. We may only be able to fulfill a request if you can provide highly specific information that allows us to locate your data, such as the exact IP address used during a specific and precise time frame.

8.5. You also have the right to lodge a complaint with a data protection supervisory authority in your country of residence if you believe your rights have been violated.

9Concluding Provisions

9.1. Changes to This Policy. We reserve the right to update this Policy from time to time. If we make changes that we consider material, we will provide reasonable notice through the Platform (for example, by a notice on the main screen). A change will be considered "material" if it significantly alters how we collect, use, or share your data, or substantially changes your data protection rights. Examples of material changes include, but are not limited to: collecting new categories of personal data, using your data for a new purpose not previously disclosed, sharing your data with new types of third parties, or significantly extending our data retention periods. For minor changes, such as correcting typographical errors, we may not provide a specific notice. Your continued use of the Platform after any changes become effective will constitute your acceptance of the new Policy. We encourage you to regularly review the current version at https://twallet.ae/privacy-policy to stay informed about our data practices.

9.2. Personal Data Breach. We implement appropriate security measures to protect the limited personal data we process. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will take steps to notify you and the relevant supervisory authority as required by applicable data protection laws.

9.3. For any questions, concerns, or requests related to this Privacy Policy or your data protection rights, please contact us at support@tmail.ae or via Telegram: https://t.me/tmailofficial.

9.4. This Privacy Policy and any disputes related to it shall be governed in accordance with the same principles as our Terms of Use, without regard to conflict of law provisions, and without depriving you of mandatory consumer protections in your country of residence.