Boom Wallet — Privacy Policy

Last Updated: December 7, 2025

Boom Platforms Inc. ("Boom," "we," "us," or "our") provides Boom Wallet, a non-custodial digital wallet enabling users to manage Bitcoin Layer 2 assets, Stacks blockchain assets, StacksPay payment links, NFTs, and related services. We are committed to protecting your privacy and being transparent about how we collect, use, and safeguard your information.

This Privacy Policy explains how Boom processes Personal Data when you use Boom Wallet, our website, or related services (collectively, the "Services").

By using our Services, you agree to this Privacy Policy.

1. Data Controller

For users in the European Union, the Data Controller under GDPR is:

Boom Platforms Inc.
[Insert address]
[Insert contact email]

For U.S. residents (including California and Virginia), Boom is the business responsible for your personal information under CCPA/CPRA.

2. What Boom Wallet Does Not Collect

Because Boom Wallet is a non-custodial wallet, we do not:

Store or access your seed phrase
Store private keys
Store raw biometric data
Hold custody of your assets
Access your on-chain balances

Your keys, seed phrase, account metadata, and encrypted wallet vault exist only on your device (localStorage, IndexedDB, or OS-level encrypted storage, depending on your settings). Boom has no access to this data.

3. What Data We Collect

We collect only the minimum data necessary to provide and improve Boom Wallet.

3.1. Account & Authentication Data

Processed via Appwrite Auth or magic-link login:

Email address
Authentication tokens
Appwrite user ID

This data is used to authenticate you and sync optional user metadata across devices.

3.2. Device & App Information

Automatically collected:

Device type, OS version
Browser type
IP address (for security, throttling, and fraud prevention)
Crash logs and diagnostic data
Locale and language

3.3. Wallet Metadata (Optional)

Boom Wallet may store limited non-sensitive metadata in Appwrite for multi-device experience:

BNS usernames
Avatar / profile settings
Display preferences
Account labels

This does not include private keys or seed phrases.

3.4. Payment Information (StacksPay / BoomPay)

When you generate or interact with payment links:

Payment intent IDs
Status updates (completed, expired, failed)
Merchant/store identifiers
Fiat conversion values (via price oracle APIs)

We do not store your full transaction history on our servers; on-chain transactions remain visible publicly.

3.5. Blockchain Data (Public)

Blockchain data—such as wallet addresses, balances, tokens, and transactions—is publicly accessible by anyone. Boom processes this data client-side or through optional API queries (Hiro, price oracles, etc.).

Boom cannot modify or delete blockchain data.

3.6. Communications

If you contact support or join Boom Chat:

Email communications
Support messages
Optional BitChat messages (stored encrypted as part of decentralized or federated protocols)

4. How We Use Data

We use Personal Data only for legitimate purposes:

Provide account authentication
Sync non-sensitive preferences across devices
Improve performance and reliability
Detect and prevent fraud or abuse
Send critical security notifications
Provide customer support
Comply with legal obligations
Analyze aggregated, anonymized usage (non-identifiable)

We do not sell Personal Data.

5. Legal Bases for Processing (GDPR)

We rely on the following legal bases:

Processing Activity	Legal Basis
Authentication & account setup	Performance of contract
Diagnostic & security logs	Legitimate interests
Payment link management	Performance of contract
Optional marketing communications	Consent
Data required for legal compliance	Legal obligation

We may share limited data with:

6.1. Service Providers

Appwrite (auth, database, storage, functions)
Cloudflare (security, caching, rate limits)
Analytics providers (only if explicitly enabled by user)
Email providers (magic link, support)

All providers are bound by strict confidentiality agreements.

6.2. Legal or Regulatory Requests

We may disclose information if required by law, court order, or to protect our rights. We cannot "turn over" private keys or seed phrases—we do not have them.

6.3. Business Transfers

If Boom is acquired, reorganized, or merged, your Personal Data may transfer as part of the transaction.

7. Data Retention

We retain:

Authentication data: While your account remains active
Support records: Up to 36 months
Logs: 30–90 days depending on log type
Payment intents: Up to 12 months

Blockchain data is immutable and publicly available indefinitely.

You may request deletion of your Appwrite account at any time.

8. Your Rights

EU users have the right to:

Access their Personal Data
Request correction or deletion
Restrict or object to processing
Data portability
Withdraw consent
Lodge a complaint with a supervisory authority

8.2. CCPA / CPRA Rights

California users may:

Request disclosure of categories and specific pieces of personal information collected
Request deletion of personal information
Opt out of sale or sharing of data (we don't sell data)
Not be discriminated against for exercising these rights

To submit a request, contact:
📩 [Insert privacy email]

We will verify your identity before fulfilling requests.

9. Children's Privacy

Boom does not knowingly collect data from children under 13 (U.S.) or under 16 (EU). If we discover such data, we will delete it immediately.

10. Crypto-Specific Risk Disclosures

Because Boom Wallet interacts with blockchain networks, you acknowledge:

10.1. Public Visibility

Blockchain transactions, addresses, balances, and metadata are publicly visible and cannot be erased.

10.2. Irreversible Transactions

Crypto transactions cannot be reversed, refunded, or modified. Boom cannot restore lost funds.

10.3. Key Management

You alone are responsible for:

Safeguarding your seed phrase
Maintaining device security
Managing any passphrase or biometric unlock

If you lose your keys, Boom cannot recover them.

10.4. Third-Party Dependencies

Boom may rely on:

Hiro API
Price oracles
Blockchain indexers
BitChat protocol nodes
Appwrite functions

These services may experience downtime, outages, or incorrect data, which may affect wallet functionality.

10.5. Volatility

Digital assets can fluctuate drastically. Boom does not provide investment advice.

10.6. Smart Contract Risk

Interactions with smart contracts (including StacksPay, NFTs, sBTC mechanisms) may contain:

Bugs
Exploits
Unexpected behavior

Boom is not responsible for losses.

11. International Transfers

We may transfer data to the United States or other jurisdictions. We use appropriate safeguards including Standard Contractual Clauses (SCCs) where applicable.

12. Data Security

We implement technical and organizational measures, including:

Device-only encryption of seed phrases
Secure key storage (biometrics, password vaults)
HTTPS encryption
Limited Appwrite access roles
Zero-access architecture for private keys

Despite our efforts, no system is 100% secure.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are significant, we will notify you via the app or email.

14. Contact Us

For privacy inquiries, data requests, or security issues:

📩 [Insert privacy email]
🏢 Boom Platforms Inc.
[Insert address]