Privacy Policy

1. Who we are

Taccoin is a company registered in the State of Palestine (commercial registration no. 34081). We develop the TacCoin Wallet app and operate wallet.taccoin.com, and we are responsible for the data described in this policy.

TacCoin Wallet is a non-custodial wallet: you alone control your keys and funds. We cannot access, freeze, or recover them.

For privacy questions and deletion requests: info@taccoin.com

2. What never leaves your device

The following data is stored encrypted on your device only and is never sent to our servers or anyone else:

• Your recovery phrase (12 words) and your wallets’ private keys.
• Your PIN (stored on the device only as a salted hash, never as text).
• The address book and contacts you save in the app.
• Your local notification history and preferences such as language and visible tokens.

3. Data the app sends to our servers

We only send what the feature you use needs. You do not need a name, email, or Google account to use the wallet. By feature:

• App identifier: a random ID (deviceId) and a secret key generated inside the app on first launch, used to link and sign your requests. They do not contain your name or phone number.
• Incoming-funds notifications: your public wallet addresses (Ethereum/BNB Smart Chain, TRON, Bitcoin), app language, and your Firebase push token, so we can alert you when funds arrive.
• Operational transaction log: type (send/receive), network, token symbol, amount, transaction hash, explorer link, status, and error code if any, for notifications and support. We do not collect your full balance.
• Local buy/sell orders (OTC): country, payment method, amount, phone number, payout address or transaction ID (TxID), and any note you write, so our operations team can fulfill your order.
• Community: nickname, optional avatar, wallet addresses if you add them to your profile, and the posts, comments, and images you upload. This content is visible to other app users.
• Payment requests: receiving address, network, amount, and memo or label. Anyone with the request link can view it.
• Send by link: sender address, a temporary address created for the link, amount, message, and an encrypted fragment of the temporary link key that cannot move funds on its own. Your main wallet keys are never sent.
• Gifts and prediction contests: one-way SHA-256 hashes of the Android ID and the Widevine device ID, a Google Play Integrity verdict, your wallet address and prize payout address, your predictions, your wallet signature, and your acceptance of the terms. These are used only to prevent duplicate claims and fraud; the original identifiers are never sent.
• Sending USDT without TRX (energy): sender and recipient addresses, amount, and the signed fee-payment transaction.
• Swap: the two tokens, the amount, and your wallet address, to fetch a price quote.

4. Third-party services the app uses

Some features run through outside providers, each with its own privacy policy:

• Public blockchain networks: the app connects to public nodes and explorers to read balances and broadcast transactions you start. On-chain transactions are public and permanent by nature, and node providers can see your IP address.
• Google: Firebase Cloud Messaging to deliver notifications, Google Play Integrity to verify app integrity for gifts and contests, ML Kit to read QR codes on the device, and the Google Play Install Referrer, read on the device to resume a gift link after installation.
• Tronify: TRON energy provider; receives sender and recipient addresses, amount, and the fee-payment transaction.
• 0x and LI.FI: swap quote providers; receive the tokens, amount, and your wallet address.
• MyMemory: a translation service that may receive the text of community posts to show translations.
• Telegram: delivers internal notifications with local buy/sell order details to our operations team.
• Price sources (Binance and OKX): our server fetches public prices from them without sending any data about you.

5. Camera and permissions

The camera is optional and used only to scan QR addresses on the device. We do not save photos or upload camera frames.

• Internet: to fetch balances and prices and broadcast transactions.
• Notifications: to alert you about incoming funds and transaction status.
• Run at startup and wake lock: to check for incoming transactions in the background.
• Camera (optional): to scan QR codes.

6. Data on wallet.taccoin.com

The website is informational and never asks for your recovery phrase or private keys. Through it we collect:

• Our own visit statistics: page, referring page, country inferred from the network, and browser type. We do not use third-party analytics or advertising trackers.
• The support form: first and last name, email, issue type, message, an optional image, and IP address and browser type to prevent abuse.
• Strictly necessary cookies only, such as language preference and the admin panel session.

7. How we use data

We use data only to:

• Run the app features you request and send notifications.
• Fulfill local buy/sell orders and respond to support requests.
• Prevent fraud and duplicate claims and protect the service.
• Comply with legal requirements.

8. What we do not do

• We do not sell your personal data.
• We do not show ads or use the advertising ID.
• We do not collect your location, phone contacts, or messages.
• We only share data with the providers listed above, to the extent each feature needs, or when legally required.

9. Data retention

Data on your device stays until you delete the wallet, clear the app’s data, or uninstall the app.

We keep records on our servers for as long as the feature needs them and for support, fraud prevention, and legal obligations, then delete them or de-link them from you.

10. Deleting your data and your rights

On your device: delete the wallet in Settings, clear the app’s data, or uninstall it. This removes your recovery phrase, keys, and all local data, so back up your phrase first.

On our servers: email info@taccoin.com with the subject “Data deletion request” and include your wallet address, order number, or community nickname so we can find the records. We will delete your data except what we are legally required to keep.

You can also request access to or correction of your data at the same address.

Transactions recorded on a blockchain are public and cannot be deleted by anyone, including us.

11. Security

We use encrypted connections (HTTPS), device-signed requests, and encrypted on-device storage, and we store device identifiers as hashes. No system is perfectly secure, so never share your recovery phrase with anyone.

12. Children

The app and website are not directed to anyone under 18, and we do not knowingly collect their data. If you learn that a minor has sent us data, contact us to delete it.

13. Processing outside your country

Data may be processed on servers and by providers in countries other than yours. We take reasonable measures to protect it wherever it is processed.

14. Updates

We may update this policy and will change the “Last updated” date above. We will highlight material changes in the app or on the website.

15. Contact

Taccoin — State of Palestine. Email: info@taccoin.com