Effective November 6, 2026. Applies to the paymail.ai app (first iOS and Android release) and the paymail.ai website.
Satoshi lab inc. (“we”) handles as little personal data as possible, in line with the Korean Personal Information Protection Act and other applicable laws. The paymail.ai app is a non-custodial wallet without accounts. We never hold your private keys, funds or transaction contents.
1. Data we collect
We collect no personal data when you use the app. There is no sign-up, email or phone number.
Only when you email [email protected] with a question or a report do we use your email address and message (including any memos or transaction IDs you attach to a report) to respond and act on it. We keep it for one year after resolution and then delete it, unless the law requires longer.
2. Data stored only on your device
- Private keys and recovery phrase: kept in the device’s secure storage (iOS Keychain, Android Keystore), excluded from cloud backup and never sent to us.
- Contacts you save, memo settings, block list, collectible albums and notification history: kept on your device only.
We cannot see this data. Remove wallet from this device deletes it.
3. Data recorded on blockchains
Payments, memos and collectibles are recorded on public blockchains (BSV, BTC, BCH). Anyone can view them and no one, including us, can delete them. Memo contents are encrypted on your device with the recipient’s public key, so only the sender and the recipient can read them. Addresses, amounts and times are public.
4. External services the app contacts directly
The app connects to these services directly, not through our servers. They can see your IP address and the wallet addresses you look up, under their own privacy policies.
| Purpose | Service |
|---|---|
| BSV balances, history, broadcast | WhatsOnChain, ARC (TAAL, GorillaPool and others) |
| BTC balances, history, broadcast | mempool.space (Esplora) |
| BCH balances, history, broadcast | Fulcrum (Electrum Cash) servers |
| Collectibles | GorillaPool 1Sat indexer |
| Exchange rates | CoinGecko |
| Sending to other Paymail services | The domain of the recipient’s address (for example handcash.io) |
| x402 payments | The service whose payment you approve |
5. Device permissions
- Camera: QR scanning and collectible photos. Location and device metadata (EXIF) are removed before recording.
- Face ID or fingerprint: app lock and payment approval. Handled by the operating system and never received by the app or by us.
- Notifications: on-device notices only.
- Contacts and photos: chosen through the system picker without extra permission. Only the one contact or photo you pick is used, on your device.
6. Website
This website uses no cookies, no visitor analytics and no third-party fonts or scripts. Our host (Cloudflare) may process access logs for security and delivery. On the claim-by-link page, link data after the # stays in your browser and is never sent to a server.
7. Sharing
We do not sell or share personal data. We use an email provider (Zoho Mail) to handle inquiries.
8. Your rights
You may ask to access, correct, delete or stop processing the personal data we hold about you (your emails) at [email protected]. We act on requests without delay.
9. Age
The app is intended for users 18 and older.
10. Privacy officer
Abraham Shim (CEO), [email protected]
Users in Korea may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, dial 118).
11. Changes
We will post changes here 7 days before they take effect, or 30 days before for changes that reduce your rights.