Privacy Policy

Last updated: June 11, 2026

Overview

Vela Wallet is a self-custodial cryptocurrency wallet. We are committed to protecting your privacy. This policy explains what data we collect, why, and how it is handled.

What We Do NOT Collect

  • Private keys — Your passkey private key is managed entirely by your operating system (iCloud Keychain or Google Password Manager). Vela Wallet never has access to it.
  • Seed phrases — Vela Wallet does not use seed phrases. There are none to collect.
  • Transaction contents — We do not monitor, log, or analyze your on-chain transactions.
  • Personal identity — We do not require your name, email, phone number, or any government ID to use the wallet.
  • Email or contact details — The website has no signup, no newsletter, and no email capture. We have no way to email you, because we never ask for your address.

What We Store

What Goes On-Chain (Public and Permanent)

When you create a wallet, it is written to a public smart contract on the Gnosis blockchain — the Passkey Registry — with a WebAuthn signature proving you hold the passkey. Everything below is readable by anyone, forever, and cannot be edited or deleted. You can browse exactly what is stored on the registry page. None of it can move your funds or sign on your behalf.

For each wallet, the registry stores:

  • Your passkey's public key — the P-256 public key (never the private key).
  • The wallet name you chose and the Safe wallet address, its Safe version, and its creation time. The name is public — choose one that does not reveal your real identity if you prefer to stay pseudonymous.
  • Your authenticator's model — a 20-byte attestation carrying the authenticator's AAGUID (which identifies the passkey provider, e.g. Apple Passwords, Google Password Manager, a browser, a password manager, or a security key) and the WebAuthn flag bits that indicate whether user verification happened and whether the passkey is syncable / backed up.
  • The WebAuthn credential id — a per-site handle for the passkey (not a secret; it cannot authenticate on its own).
  • Browser-reported hints — the authenticatorAttachment ("platform" / "cross-platform") and the transport list ("internal", "hybrid", "usb", etc.).
  • The relying-party id (getvela.app) and a one-time group key used only to close the record.

The registry is how your wallet's founding passkeys are recorded on-chain, as one immutable group. Cross-device sign-in and recovery rely on it, and for a multi-passkey wallet it is required: the wallet's address is derived from its full set of founding passkeys, and a new device reconstructs that set — and therefore the correct address — from this public record. (A new device can re-derive a single passkey from two of its signatures on its own, but not the rest of a multi-key wallet's membership.)

What Never Leaves Your Device

Your passkey private key, your biometrics, and your operating-system account (Apple ID / Google account) are never uploaded, never transmitted, and never written on-chain. Wallet configuration, token balances, transaction history, and RPC endpoint preferences are stored locally on your device and are not sent to our servers.

The Website (getvela.app)

This policy also covers the getvela.app website, not just the wallet app. The website has no accounts, no newsletter, and no email capture.

We use privacy-friendly, cookieless analytics to count page views and basic events (such as which sections are viewed or which links are clicked). It runs on our own self-hosted instance — your data is never sent to Google or any ad network. No cookies, no cross-site tracking, and no device fingerprinting. We do not build advertising profiles, and we do not sell or share this data.

The registry page reads the smart contract directly from your browser via public Gnosis RPC nodes — nothing there comes from our servers. To label each authenticator it looks up the AAGUID (an already-public, non-personal identifier of the authenticator model) against our AAGUID Explorer service; it never sends your credential id, public key, or wallet address to that service.

Third-Party Services

Vela Wallet interacts with the following external services:

  • Blockchain RPC nodes — To query balances and submit transactions. Your wallet address is visible to these providers.
  • Vela Relay — To relay ERC-4337 UserOperations to the blockchain. The bundler sees your signed transaction data but cannot modify it.
  • Chain Data Index — To fetch token metadata and chain information. No wallet-specific data is sent.
  • iCloud Keychain / Google Password Manager — Your passkey is synced by your operating system. Refer to Apple's or Google's privacy policies for details.

Data Retention

Your wallet's registry record is stored indefinitely and immutably on the Gnosis blockchain — it is append-only and cannot be edited or deleted by us or by anyone. On-device data is deleted when you log out or uninstall the app. We do not maintain server-side backups of your local wallet data.

Open Source

Vela Wallet is fully open source. You can audit the code, verify our claims, and self-host all backend services. See our GitHub repository.

Contact

If you have questions about this privacy policy, open an issue on GitHub.

Vela Wallet is operated by MONDAY LABS LTD, 61 Bridge Street, Kington, United Kingdom, HR5 3DJ — the data controller for this website.