UPCX Pay & Wallet: wallet privacy notice

Updated 14 October 2026. This notice covers UPCX Pay & Wallet, including phone sign-in, UPCX IDs, contacts, messages and coupons in version 0.6.9. The app is a self-custody wallet for Ethereum and BNB Smart Chain. It does not offer merchant accounts, payment processing, exchange or custody services.

Operator and contact

UPCX-PLATFORMS PTE. LTD., Singapore UEN 201214088D. Registered office: 8 Marina Boulevard, #11-01/02, Marina Bay Financial Centre, Singapore 018981. Contact info@upcxwallet.com for support, privacy questions, access, correction or deletion requests. Never send a recovery phrase or private key.

Your keys and device authentication

The app creates or imports a recovery phrase on your device and uses operating-system protected storage. Your recovery phrase and private keys are not sent to UPCX. Device biometrics are checked by the operating system; the app receives the authentication result, not your biometric template. You are responsible for your private recovery backup. UPCX cannot restore lost keys.

Network data and service providers

To display balances, estimate network fees, submit a transfer you approve and check transaction status, the app sends public wallet addresses, network identifiers, transaction details and hashes, and signed transactions to blockchain RPC providers. These providers also receive your IP address and ordinary connection metadata. Connections use HTTPS. Current mainnet providers include PublicNode, dRPC, NodeReal and the BNB Smart Chain Defibit endpoint. Test-network connections also include Tenderly. These services may process information outside your country and apply their own retention and privacy practices.

Blockchain addresses and transactions are public. Signed transactions do not contain your recovery phrase or private key. Sharing an address, opening an external website or contacting support uses the app or service you select and its privacy practices.

Phone verification and UPCX ID

Google Firebase Authentication with Identity Platform receives and stores your phone number for SMS verification and spam prevention, together with device, IP address and app-verification information. We verify the resulting sign-in token and store your verified number, username, public wallet address, signed wallet-link proof, discovery preferences and sign-in sessions on the UPCX directory hosted by MochaHost. SMS security counters use keyed hashes of phone numbers and IP addresses in Google Cloud Firestore. Verification and security providers may retain their own records.

Phone and username lookup make your linked public wallet discoverable according to your choices in Contacts & discovery. A UPCX ID QR contains your username; the app looks up its current wallet when someone scans it. If you link a replacement wallet after verifying your number, future lookups use the replacement. This never transfers funds from the previous wallet or recovers its keys.

Contact matching and camera

Contact sync is optional. With your permission, the app reads contact names and phone numbers on your device. It sends normalized phone numbers over HTTPS to the UPCX directory to find registered members. Names and the contact list cache stay on your device; submitted matching numbers are processed for lookup and are not saved as an uploaded address book. The directory uses keyed phone indexes for matching. Turn off syncing in Contacts & discovery or revoke Contacts permission in device settings. You can instead use a username or a wallet address.

Camera permission is used only when you scan a QR. Camera images are processed on the device and are not uploaded. Sharing your public QR uses the sharing app you select.

Messages, requests and coupons

The UPCX server stores conversations, message text, participants, timestamps, read positions, payment requests, linked transaction evidence, blocks and abuse reports so you can use these features across sessions and devices. Access requires an authenticated account linked to your wallet. Messages are encrypted in transit using HTTPS; they are not end-to-end encrypted. UPCX and its hosting provider can process server records to operate and protect the service.

Coupon records associate your account and current public wallet with welcome offers, eligible confirmed blockchain transfers, assigned offers and scratch/reveal status. Public transaction data is checked through blockchain providers. Coupon links open the issuing company's website under its own terms and privacy practices. A public promo code does not imply an exclusive partnership. Market quotes and token images use CoinGecko and the disclosed asset sources; those services receive ordinary connection metadata.

Account deletion and retention

In the app, open Profile → Delete account, acknowledge deletion, type DELETE and verify your mobile number. This removes the UPCX ID, linked-wallet history, sessions, associated conversations and messages, blocks, reports and coupon records from the live directory and signs out other devices. Conversations involving your account are removed from the live service for both participants. Firebase account cleanup is also requested; if interrupted, the app offers Finish deletion. SMS abuse-prevention counters remain for their applicable limiting windows.

Without the app, use the wallet account deletion request page or email info@upcxwallet.com. We must verify control of the account before deletion. Never send an OTP, private key, recovery phrase or payment to support. Live account records are retained while your account is active. Infrastructure backups and security logs follow the relevant provider's retention practices, and records required for a legal obligation or unresolved security investigation may be retained for that purpose. Public blockchain history and copies already saved by another person cannot be erased.

Local records and removal

The app keeps wallet-access metadata and a transaction-recovery journal on this device. A verified mobile number connects your UPCX profile, chats and coupons. Existing wallets from older releases remain accessible when upgrading; phone verification is required to connect the social features. In Settings, Remove local wallet deletes the recovery phrase and wallet-access record after device authentication. Back up your recovery phrase privately first: removal can permanently lose access if you have no backup. Public transaction recovery records remain locally so reimporting cannot hide an unresolved transfer. Uninstalling the app removes its local application data; operating-system keychain behavior can vary. Public blockchain records cannot be erased by UPCX.

Support and other disclosures

If you contact support, we receive the contact details and message you choose to send. We use them to respond, resolve issues and meet applicable obligations, and retain them only as needed for those purposes. You may request access, correction or deletion by email, subject to required retention. Do not include wallet secrets. The app has no advertising or additional behavioral analytics SDK. Infrastructure providers may retain technical or security logs under their policies. We may disclose information we hold when required by law or needed to investigate fraud or protect users.