Legal
Privacy Policy
Shroud is a self-custodial Bitcoin wallet. You don't create an account, and your keys and recovery phrase never leave your phone. To work, the app talks to a few servers, listed below, and it sends crash reports unless you turn them off.
Who we are
Shroud is made by Cypher Commons LLC ("we", "us"). This policy covers the Shroud app for iOS and Android. For questions or requests about your data, email us at dev@shroudwallet.com.
What stays on your device
Everything that controls your money stays on your phone, and we never receive it:
- Your recovery phrase and keys. They are kept in your phone's secure storage (the iOS Keychain or Android Keystore). Shroud scans for silent payments on the phone itself, so the keys never need to leave it.
- Your wallet data: balances, transactions, labels, contacts you save in Shroud, and your settings. They are kept in an encrypted database on the phone. Shroud doesn't read your phone's address book.
- Biometric data. Face ID, Touch ID and fingerprint unlock are handled by your phone's operating system. Shroud only learns whether the check succeeded.
Android backups of the app are turned off. Your recovery phrase is the way to restore your wallet on another phone, so keep it somewhere safe: we can't recover it for you.
What leaves your device
A Bitcoin wallet has to ask the network about your coins, so some information does leave your phone. None of it includes your name or your keys. Every service below can see your IP address unless the connection goes through Tor.
| Service | What it receives | When | Through Tor when Tor is on |
|---|---|---|---|
Shroud's silent-payment indexer (indexer.shroudwallet.com, plus test-network hosts and .onion addresses) |
Your IP address; the ranges of blocks the app asks for (when you restore a wallet, the starting point shows roughly when it was created); transaction IDs you look up | Scanning for payments, restoring a wallet, tracking a payment | Yes, through its .onion address |
| An Electrum server: by default one run by Foundation Devices, lu.ke, BlueWallet, ACINQ or Bitaroo on the main network, by us on signet, or one you choose in settings | Your IP address; the addresses your coins are on and their transactions; fee estimates; the transactions you send | Showing balances and history, estimating fees, sending | Yes |
| An exchange-rate provider, depending on the currency you pick: CoinGecko, Coinbase, Kraken, Yadio, Exir, Coinpaprika or the National Bank of Romania | Your IP address; the currency | Showing amounts in your currency | No |
| Bugsnag, if crash reporting is on | See Crash reports | When the app crashes or reports an error, and once per launch | No |
Shroud's update server (updates.shroudwallet.com, hosted in Canada) |
Your IP address; your platform; the app's version identifiers and update channel; the IDs of the update you run and of the one built in; a random ID the update library creates for this installation. The server keeps no logs. | Every launch, and when an update downloads | No |
| The block explorer you choose (mempool.space by default) | Whatever your browser sends | Only when you tap a link to view a transaction; it opens in your browser | Not applicable |
Tor. If you turn on Tor in settings (it needs a Tor app such as Orbot), connections to the indexer and the Electrum server go through Tor, which hides your IP address from them. Tor-only mode blocks those connections whenever Tor isn't running. Exchange rates, crash reports and update checks always use the regular internet.
Crash reports
When the app crashes or hits an error it can't handle, it sends a report to Bugsnag, a crash-reporting service run by SmartBear Software, so we can find and fix the problem. Crash reports are on by default. To turn them off, go to Settings → General → Privacy → Crash reports. From the next time the app starts, nothing is sent to Bugsnag.
While crash reports are on:
- A report contains the error and where in the app's code it happened; your phone's model and operating system version; the app version; an identifier for your device that Bugsnag creates; and a short record of what the app was doing just before, such as starting up or moving to the background. Shroud removes transaction IDs, Bitcoin addresses and keys from its own error messages before they are reported.
- Each launch is also counted, so we can see what share of sessions crash.
Bugsnag keeps reports for 7 days, then deletes them. We use them only to fix bugs.
Permissions
Shroud asks for each of these when you first use a feature that needs it; internet access comes with installing the app. Nothing it reads through these permissions leaves your phone.
| Permission | What Shroud uses it for |
|---|---|
| Camera | Scanning QR codes, such as a payment address. Camera images aren't stored. |
| Photos | Scanning a QR code from an image you pick, and saving a QR code image when you ask. |
| Face ID, Touch ID or fingerprint | Unlocking the app and confirming sensitive actions. Your phone does the check; Shroud only learns the result. |
| Files (Android) | Opening or saving files you choose. |
| Clipboard | Offering to paste a Bitcoin address you copied. You can turn this off in Settings → General → Privacy. |
| Screen capture detection (Android) | Hiding sensitive screens from screenshots and screen recordings. |
| Internet | Reaching the services listed above. |
What we don't do
- We don't ask for an account, your name, email address or phone number.
- We don't run analytics or track how you use the app, apart from the crash reports and launch counts above.
- We don't show ads or use advertising identifiers.
- We don't sell or share your information, or use it to track you across other apps and websites.
- We can't see your balance, move your money, or freeze or reverse a transaction.
App stores and beta testing
You get Shroud through Apple's App Store or TestFlight, or through Google Play. Apple and Google collect information when you download and use apps, under their own privacy policies (Apple, Google).
While Shroud is in beta:
- TestFlight (iOS) shares your crash logs and usage information with us automatically, and any feedback you send, which may be linked to your name and the email address you were invited with. If you joined through a public link, we don't see your name or email address (TestFlight & Privacy).
- Google Play testing (Android) shows us the email addresses on the testers list, and any private feedback you leave on the listing.
We use this only to run the beta and fix problems.
How long we keep information
- Crash reports: 7 days at Bugsnag, then deleted.
- Update checks: not kept. Our update server writes no access logs.
- Indexer requests: not kept. Our indexer server writes no access logs.
- Beta testing: tester email addresses and feedback stay in App Store Connect and Play Console for as long as we run the beta.
Electrum servers, exchange-rate providers and block explorers we don't run have their own policies, and we don't control what they keep. To limit what they see, turn on Tor or use your own Electrum server.
Where information goes
SmartBear, which runs Bugsnag, is based in the United States, and crash reports may be stored there. Our update server is in Canada. The Electrum servers, indexer servers and exchange-rate providers you connect to may be anywhere in the world.
Your rights
Depending on where you live, for example in the EU, the UK or California, you can ask to see, correct or delete information about you, or object to how it's used. We hold very little that is linked to you, but email us and we'll help. Crash reports rely on our legitimate interest in keeping the app working; you can object at any time by turning them off.
Children
Shroud isn't meant for children under 16, and we don't knowingly collect information from them.
Changes to this policy
We'll post any change on this page with a new effective date, and mention significant changes in the app's release notes. This policy takes effect on October 11, 2026.
Contact
Cypher Commons LLC, 30 N Gould St, STE R, Sheridan, WY 82801. Email: dev@shroudwallet.com.