Privacy Policy

This policy explains what WHYUS?, owned and operated by whyus.fun, stores when you use the platform, how your wallet keys are protected, and what you can ask us to do with your data.

1. What we store

• Your account: the email address you sign up with. Your password is never stored by us — it is handled and hashed by our authentication provider.
• Your wallets: the wallet addresses, the encrypted private keys and the encrypted recovery phrase. We also record which chain each wallet belongs to.
• Your session: a session token kept in your browser so you stay signed in, plus the theme you chose.
• Operational logs: routine server logs containing request paths, timestamps and error details used to keep the service running.

2. What we do not store

• We do not ask for or store identity documents, and there is no KYC step.
• We do not require email verification, so we send no marketing or confirmation email.
• We do not run advertising or third-party analytics trackers.
• We do not log plaintext recovery phrases or private keys, and we do not store them unencrypted anywhere.

3. How your keys are protected

A recovery phrase and its private keys are generated on the server, encrypted with AES-GCM using an encryption key that is held outside the database, and only then stored. Decrypting them requires an authenticated request from your own account — the wallets page itself never decrypts a key just to render it. Row-level security in the database means one account cannot read or write another account's wallet rows.

4. Why we use it

• To create your account, sign you in and keep you signed in.
• To generate and show your wallets, addresses, QR codes and recovery phrase.
• To keep the service secure and working, including diagnosing faults.

5. Where your data lives

Accounts and wallet records are held in our hosted database and authentication service (Supabase, running in the cloud). Blockchains are public: your addresses, and any transaction you sign, are visible to anyone on the relevant network. Nothing on a public chain is private, regardless of what this policy says about our own systems.

6. Cookies and local storage

We use no advertising or tracking cookies. Your browser stores your session token (so you do not have to sign in on every visit) and your light or dark theme preference. Signing out clears the session.

7. Sharing

We do not sell your data. We share it only with the infrastructure providers that run the service, or where the law requires it. We cannot hand over a usable key: what we hold for your wallets is ciphertext, and we do not disclose a decrypted key to anyone but you.

8. Retention and deletion

We keep account and wallet records for as long as your account exists. If you want your account and its wallet records deleted, email support@whyus.fun from your account address. Export your recovery phrase first — once the records are deleted the wallets only exist wherever you have backed them up. Some logs may be retained longer where we are required to keep them.

9. Your choices and rights

• Ask for a copy of the account data we hold about you.
• Ask us to correct it, or to delete your account and its wallet records.
• Sign out at any time, and stop using the service.
• Depending on where you live you may have further rights (for example under the GDPR); email us and we will honour them.

10. Children

The service is for adults. We do not knowingly create accounts for anyone under 18.

11. Changes to this policy

If this policy changes, the “last updated” date above changes with it, and material changes will be announced in the app.

12. Contact

Privacy questions and requests: support@whyus.fun. See also the terms of service, the guidelines and the documentation.