Privacy policy

Last updated 21 October 2026

This policy covers the Cifra and Quantum Crypto wallet apps, the servers they use, and this website. Both apps are self-custody wallets: your keys stay on your device, and we built them to collect as little about you as they can.

Who we are

The apps are provided by Quantum Encoding Europe Limited, a company registered in Ireland (No. 807205), registered office The Black Church, St. Mary’s Place, Dublin D07 P4AX, Ireland, which is the controller of your personal data, together with its affiliate Quantum Encoding Ltd, a company registered in England (No. 16575953), registered office 33 Oxford Street, Coalville, LE67 3GS, United Kingdom. “We” means both.

Questions and requests: privacy@quantumencoding.io. Data protection officer: dpo@quantumencoding.io.

What we never receive

• Your recovery phrase and private keys. They are created and kept on your device (on Apple devices, in the Keychain and Secure Enclave). Every transaction is signed on your device.
• Your device passcode, Face ID or Touch ID data.
• Your card or bank details and your identity documents. When you buy or sell crypto, our partner collects these directly (see “Who we share data with”).

The apps contain no analytics, advertising or tracking software.

What our servers process, and why

• A device registration: a random device identifier, a public key the app creates, the app version and the platform. It lets our servers check that a request comes from your copy of the app. Basis: performing our contract with you.
• Your IP address and the country it points to, when the app talks to our servers. We use them to keep the service secure (blocking replayed and abusive requests), to decide whether buying and selling are offered where you are connecting from, and to bind a buy or sell session to your connection, which our partner requires. Request logs are kept by our hosting provider for about 30 days. Basis: our legitimate interest in a secure service, and our legal obligations.
• Wallet addresses and transactions, when the app reads balances or history or sends a transaction through our servers. Your public addresses and signed transactions pass through to the blockchain infrastructure providers below. Blockchains are public: anything you send is visible to everyone, permanently. Basis: performing our contract with you.
• Buy and sell orders: the wallet address the crypto goes to or is refunded to, the currency and amount, our order reference and the partner’s transaction reference, the order status, the transaction hash, the partner’s deposit address for a sale, the payment method, and the reason an order failed. The app uses them to show you the order’s progress, and we check them so an order can’t be redirected to someone else’s address. Basis: performing our contract with you, and our legal record-keeping obligations.
• A notification token, only if you allow notifications, so we can tell you when an order settles. Basis: your consent, which you can withdraw in your device’s settings.
• Support reports, only when you send one, with what you choose to include. Basis: our legitimate interest in answering you.

Who we share data with

• MoonPay and Alchemy Pay, when you choose to buy or sell through them: the wallet address, currency, amount, our order reference, and for MoonPay a keyed hash of your IP address. They verify your identity and take your payment themselves, as independent controllers under their own privacy policies (MoonPay,Alchemy Pay).
• Blockchain infrastructure providers that read balances and history and broadcast transactions, through our servers or, for some networks, directly from the app, such as Ankr, Etherscan, Blockfrost and Breez: your public addresses and signed transactions.
• Service providers that run our infrastructure on our instructions: Google Cloud (our servers and database), Cloudflare (DNS and this website) and Apple (notifications).

We do not sell your data or use it for advertising.

International transfers

Our servers run in the United States. Where personal data leaves the European Economic Area or the United Kingdom, it is protected by the safeguards the law requires, such as the EU–US Data Privacy Framework and standard contractual clauses.

How long we keep it

Device registrations are kept until you ask us to delete them. Order records are kept for as long as we need them to show you their status and to meet our legal record-keeping obligations. Request logs are kept for about 30 days. Ask us to delete your data at any time; we will, except where the law requires us to keep it.

This website

cifrawallet.com sets no cookies. If you join the launch list we keep your email address and language, and email you once, when Cifra is available; ask us to remove you at any time. To limit abuse we keep a salted hash of your IP address, never the address itself, for about a day.

Your rights

You can ask for a copy of your data, and ask us to correct, delete or restrict it, to transfer it, or to stop a processing you object to. Write toprivacy@quantumencoding.io. You can also complain to the Data Protection Commission in Ireland, to the authority where you live, or, in the United Kingdom, to the Information Commissioner’s Office.

Children

The apps are for people aged 18 or over.

Changes

If we change this policy we will update the date above, and tell you in the apps before a significant change applies.