Privacy policy

Effective date: 20 October 2026
Who we are: Pesso is operated by SPRINTLAB TECHNOLOGIES LTD, 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ (“Pesso”, “we”).
Contact: support@pesso.xyz

The short version

• Pesso never holds your money. Your wallet is yours. We cannot move, freeze or recover your funds, and we never see your private key.
• We keep very little. On the web we run no analytics, advertising or tracking of any kind.
• The iPhone app measures which ads bring people to Pesso, and which steps of adding money people complete, through AppsFlyer. It asks your permission before it uses your device’s advertising identifier; if you say no, Apple reports installs to advertisers only in aggregate. When your first money arrives, we tell AppsFlyer the amount under a scrambled code — never your name, email or wallet address.
• We store a few things on our own servers: any note you add to a transfer, the payment request links, API keys and webhook endpoints you create, and a saved history of your wallet’s balances so your charts open quickly. You can delete all of them.
• When you trade, we keep a record of the trade and of any fee Pesso earned from it. The trade provider sees your wallet address and the amounts, never your name or email. If you delete your records, the trade record goes; the fee record stays for our accounts, but no longer points to you.
• We don’t ask where you live and collect no location or eligibility information to trade.
• A payment request link shows your email to anyone who holds it — with the amount, your note, when it expires and whether it can be paid more than once — even before they sign in.
• Paying a request can tell the requester’s server your wallet address and the request’s note, if the requester has set up a webhook — never your name or email.
• Blockchain transactions are public and permanent. Anyone can see them on the Base network, and nobody — including us — can delete them.

1. What Pesso is

Pesso is a self-custodial digital wallet, on the web at pesso.xyz and as an iPhone app. You sign in with Google or email (and, in the iPhone app, with Apple); your wallet is created and secured by our sign-in provider, Privy, so that only you can authorise payments. Your balance is held in digital dollars on the Base blockchain.

2. What we collect, and why

When you sign in

We use Privy to sign you in with Google or email and to create your wallet. Privy gives us your email address and a Privy user identifier. We use these to identify your account and to show you your own wallet. The sign-in screens are Pesso’s own, but Privy does the work behind them: it sends you to Google and receives Google’s answer, or it emails you the one-time code and checks it. Pesso never sees your Google password. In the iPhone app you can also sign in with Apple: Privy receives from Apple an identifier and the email Apple chooses to share (which may be an Apple relay address), and Pesso never sees your Apple ID password. Your private key is held by Privy’s secure system and is never visible to Pesso. You can export it at any time from the Receive screen on pesso.xyz (the iPhone app cannot export it yet).

Your wallet and its activity

Your wallet has a public address on the Base blockchain. To show your balance and your activity, our servers look up public blockchain data for that address through our data provider, Alchemy. We read the tokens your wallet holds and their transfers, and ask Alchemy for current prices so we can estimate what your holdings are worth. Alchemy sees your wallet address and the token addresses; it does not see your name or email.

To draw what your wallet and each holding were worth over time, our servers read your wallet’s past balances through Coinbase’s blockchain data service, and past prices through Alchemy. Both see your wallet address and token addresses, never your name or email. We save the result — which tokens your wallet has held, their balances over time and when — linked to your Privy user identifier. It is built only from public blockchain data. The price chart on the buy screen uses public prices only and stores nothing about you.

The first time money arrives in your wallet, from any source, we note it: your Privy user identifier, your wallet address, the transaction identifier, the amount and when it arrived. We use it to understand how many people start using Pesso.

When you add money

Adding money is provided by Coinbase, not by Pesso. To start a purchase we pass Coinbase your email address, your phone number and when it was verified, your wallet address, when you accepted Coinbase’s terms, and a Pesso reference that identifies your account to Coinbase without revealing who you are. Coinbase then handles the payment and any identity checks under its own terms and privacy policy.

Once you’ve set up adding money, we also send Coinbase your phone number when you open Limits and fees, so Coinbase can tell us how much you can still add and whether you can raise your limit. We show you the answer and don’t keep it. If you choose to raise your limit, Coinbase asks for your date of birth and the last 4 digits of your Social Security number in its own form. Pesso never sees or stores them.

In the iPhone app you pay with Apple Pay on a Coinbase page shown inside the app, or on Coinbase’s own hosted page. Coinbase receives the same details as above. Your card details go to Apple and Coinbase only; Pesso never sees them.

We keep a short-lived note on your device of a purchase in progress, so we can tell you when the money is on its way. We may also record, for our own support, whether a purchase was accepted or failed, with its Coinbase order reference and amount (see Service alerts below).

Sending transactions

When you approve a transaction, it is submitted to the Base network through Candide, which also pays the network fee on your behalf and recovers it in digital dollars. Candide receives the transaction and your wallet address — information that becomes public on the blockchain anyway.

Trading

You can swap digital dollars for other tokens and back. Pesso never holds the tokens: the trade runs from your own wallet, and you approve each one.

Getting a price. To quote a trade, our server asks a trade provider — KyberSwap first, 0x if KyberSwap can’t — for a route. It sends your wallet address (as the account that trades and receives the tokens), the two tokens, the amount, how far the price may move, and Pesso’s fee and fee address. KyberSwap is also told the request comes from Pesso. Neither provider receives your name, email or Privy user identifier. Before you approve, we test the trade — for a less-known token, a buy followed by a sale back — through Alchemy, which receives your wallet address and the prepared transaction.

Sanctions screening. Before quoting, we check your wallet address, and the address that signs for it, against a public sanctions list published on the Base blockchain by Chainalysis. The check is a read of that public list, made through Alchemy; nothing is sent to Chainalysis, and we store nothing about the result. If the check can’t be completed, we don’t offer the trade. The check is based on addresses only — we never ask where you live, and collect no location, residence or eligibility information to trade.

Finding a token. When you search for a token by name, the text you type is sent to DexScreener to find matches. When you look at a less-known token, its address — never yours — is sent to GoPlus, and to honeypot.is when GoPlus is unavailable or leaves a fact empty, for facts about the token. We keep those facts for up to 24 hours; they are about the token, not about you.

Stock tokens. Some of the tokens you may hold are stock tokens issued by Coinbase. Pesso no longer lets you buy stock tokens; you can still sell the ones you hold. To know which tokens those are, our server reads Coinbase’s public list of stock tokens; the request carries nothing about you — no wallet address, name or email. For a stock token we also read, through Alchemy, the token’s own state on the Base blockchain (how many shares each token is worth, and whether the issuer has paused it) and the stock’s public market price from a Chainlink price feed on the blockchain; nothing is sent to Chainlink. To show your holding in shares and to check the issuer allows your wallet to sell the token, those reads include your wallet address — information that is public on the blockchain anyway. Before your first stock sale, Pesso links to the issuer’s terms on base.org; if you open that link, your browser leaves Pesso and base.org’s own terms and privacy policy apply. We ask nothing about where you live to sell stock tokens either. A stock sale is stored like any other trade (below).

What we store for each trade. When you approve a trade we save:

• your Privy user identifier and your wallet address
• the trade’s identifiers, including its transaction hash once it lands on the blockchain
• the tokens, the amounts quoted, the minimum you agreed to receive and the amount you received
• which provider carried it, its fee, Pesso’s fee and the network fee
• whether it went through, and when

We use this to show the trade in your activity and to confirm it on the blockchain. It does not contain your email or name.

Fee records. For every completed trade we also keep a record of Pesso’s fee — even when the fee is zero: the transaction identifiers, the fee and its rate, the kind of token, the provider and when it happened, linked to your Privy user identifier. We keep these for our accounts. If you delete your records (see Your rights), we replace your identifier on them with a random code, so the fee records no longer point to you.

Notes on your transfers

You can add a short note when you send money. We store the note encrypted, and Pesso can read it — we hold the key so that you and the person you paid can see it in your activity. An encrypted copy is also written permanently to the public Base blockchain with the transfer.

• Who can read it: you, and a recipient who is a Pesso user. Someone you sent to by plain address or QR code cannot read it.
• Who can delete it: only the note’s author — the sender, or for a payment request, the person who made the request. Deleting destroys the key, so no one, including Pesso, can read the copy on the blockchain again. The encrypted copy itself stays there, unreadable.

Payment requests

If you create a payment request link — yourself, or from your own software with an API key — we store, for each link:

• your email address, which is shown to anyone who holds the link, so they know who is asking to be paid
• the amount or amounts, and how many times the link can be paid
• any return or notification web addresses you add
• any note you add, stored encrypted — Pesso can read it (as for transfer notes)
• the link’s status and how many times it has been paid
• when a payment arrives, the payer’s wallet address, so we can match the payment to the link

Anyone who holds the link can read it before signing in. While the link is open, its page shows your email, the amount, your note, when the link expires and whether it can be paid more than once — to anyone who opens it, whether or not they have a Pesso account. Once the link is paid, expired or deleted, the page shows only your email and that it can no longer be paid. Anyone you share the link with can pass it on, so share it only with people you are happy to see your email and your note. Request pages are marked so search engines do not index them.

Opening someone’s request link. Before you sign in, Pesso stores nothing about you. To stop the page being read in bulk, our server counts how often each internet (IP) address opens request pages, in memory only, for up to 10 minutes; it is never written to our database. If you choose to sign in from the page, your browser remembers which request you were paying until you close the tab, so you come back to it afterwards.

Deleting a link removes the note and the web addresses straight away. We keep a minimal record that the link existed and how it was paid, so past payments still make sense in your activity.

API keys

If you create an API key to make requests from your own software, we store only a one-way hash of the key — we cannot read or recover it, which is why it is shown to you only once. Alongside it we keep its first characters (so you can recognise it), the label you gave it and when it was last used. Deleting a key stops it working immediately.

Webhooks

If you make payment requests from your own software, you can register https web addresses (“endpoints”) where Pesso tells your server a request has been paid. For each endpoint we store the web address and a signing secret, kept encrypted, so your server can check a message really came from Pesso.

When a payment to one of your requests is verified on the blockchain, Pesso sends your endpoint:

• the transaction identifier (its hash on the blockchain), the amount and the time
• the payer’s wallet address
• the request’s identifier
• the request’s note, in clear text — decrypted, so your software can read it
• whether the payment is a duplicate of one already received

It never contains the payer’s name or email. For each message we keep a delivery record — how many times we tried and the last response your server gave. Deleting an endpoint deletes its secret and its delivery records.

If you pay someone’s request, the requester may have set up a webhook, so your wallet address and the request’s note may be sent to the requester’s own server, which Pesso does not run.

Connecting to apps

If you connect Pesso to an app, the connection runs through WalletConnect (Reown). Pesso never recommends or lists apps; you only connect to ones you choose.

Service alerts

So we notice problems quickly, our servers send a short alert to a private team channel on Discord when a purchase through Coinbase is accepted or fails. The alert contains your Privy user identifier, the Coinbase order reference, the amount, and any error code — never your email, phone number or wallet address.

Measuring ads in the iPhone app

The iPhone app uses AppsFlyer to learn which advertising brought you to Pesso, and at which step people stop when they add money. We use it for that alone — not to show you ads, and not to build a profile of you.

• When the app opens, AppsFlyer’s software in the app tells AppsFlyer that Pesso was installed or opened, with the information about your device that AppsFlyer collects for this (see AppsFlyer’s privacy policy). It does not wait for your permission, and it does not use your advertising identifier until you give it.
• When you sign in, the app gives AppsFlyer a scrambled code for your account — a one-way hash of your Privy user identifier, never the identifier itself — and our server stores the link between your account and the AppsFlyer identifier of this install (see below).
• When your first money arrives, our server tells AppsFlyer, once: the AppsFlyer identifier of your install, the scrambled code, the amount in dollars and when it arrived. Never your name, email, phone number or wallet address. The app also tells AppsFlyer, once per device and with no amount, that your first money has arrived, so Apple’s aggregate ad reports can count it.
• When you add money, the app tells AppsFlyer which step you reached: opening Add money, each set-up step, opening Coinbase’s payment page, and whether the payment went through, was cancelled or failed (with a general reason, never Coinbase’s message). It also sends a rough range for the amount, such as “$10–49” — never the exact amount, and never your name, email, phone number, wallet address or card details. If you allow tracking, AppsFlyer may link these steps to your device’s advertising identifier.
• Asking permission. When your first money arrives, or the first time you open your home screen with money in your wallet — never at launch and never in the middle of something you are doing — Pesso explains, then shows Apple’s “Allow Pesso to track your activity…” prompt, once. Your answer is shown under Account → Ad measurement. If you allow it, AppsFlyer may use your device’s advertising identifier to match the install to the ad you saw. If you decline, it is not used: Apple’s own systems (SKAdNetwork and AdAttributionKit) then report installs to advertisers only in aggregate, without identifying you. You can change your answer at any time in iPhone Settings.
• When you delete your account, we delete our link to your installs and ask AppsFlyer to erase its data for each of them (an OpenDSR erasure request).

What our servers store for the iPhone app

Everything listed above for the web — notes, payment requests, API keys, webhooks, trades, fee records, your balance history and your first deposit — is stored the same way when you use the app. The app adds one record per device you sign in on: your Privy user identifier, the AppsFlyer identifier of that install, and which Pesso environment wrote it. We also note when your first deposit was reported to AppsFlyer, so it is reported only once.

What stays on your device

Pesso stores a few things in your browser, and only for the app to work: your theme choice, payments in progress, a purchase in progress, your app connections, whether you have already seen the notices about less-known tokens and about selling stock tokens, and — until you close the tab — the request link you were paying when you signed in. We use no cookies for tracking, and no analytics.

On iPhone, the app keeps:

• your sign-in session, held by Privy’s software in the iPhone Keychain
• transactions in progress — each one you have approved but that has not yet landed, with its identifiers and, for a trade, its amounts — in a file in the app’s private storage, so it can still be followed if the app closes. It is removed when the transaction lands, and is not cleared by signing out, because a transaction in it may still go through
• a purchase in progress — Coinbase’s order reference, when it started and your balance at that moment, so the app can tell when the money arrives; it lapses after an hour
• the last five people you sent to, as you typed them (an address, a name or an email)
• your theme choice, whether you have seen the less-known-token notice, whether your first money has arrived, whether you have been asked the permission question above (so it is asked only once), and which accounts on this device have been linked to the AppsFlyer identifier

The app keeps no copy of your balance or activity: it reads them fresh each time, and our server tells your iPhone not to store them.

3. Why we’re allowed to use it

• To provide the wallet you asked for — signing you in, showing your balance and activity, keeping your transfer notes, payment request links, API keys and webhook endpoints, telling a requester’s endpoint when their request is paid, and processing transactions, quoting and recording your trades. Legal basis: performing our contract with you.
• To keep Pesso working and secure — service alerts and diagnostics. Legal basis: our legitimate interests in running a reliable service.
• Sanctions screening of wallet addresses before a trade. Legal basis: legal obligation.
• Keeping our accounts — fee records, kept after you delete your records, without your identifier. Legal basis: legal obligation (bookkeeping).
• Understanding how many people start using Pesso — the note of your first deposit. Legal basis: our legitimate interests in understanding how Pesso is used.
• Measuring which ads bring people to the iPhone app, and where adding money stops — AppsFlyer, the install record, the add-money steps and the first-deposit report. Legal basis: your consent, given through Apple’s prompt, for the advertising identifier; our legitimate interests in measuring our advertising for the rest.

4. Who we share it with

We don’t sell your information, and we share it only with the providers that make Pesso work:

• Privy — sign-in and wallet security
• Apple — Sign in with Apple (through Privy); Apple Pay; App Store ad measurement (SKAdNetwork, AdAttributionKit)
• AppsFlyer — measuring which ads bring people to the iPhone app (install data, the scrambled account code, the add-money steps with a rough amount range, the first-deposit amount)
• Alchemy — reading public blockchain data and prices, testing trades, sanctions-list reads, stock-token state and stock price feeds
• KyberSwap — quoting and routing trades (wallet address, tokens, amounts)
• 0x — quoting and routing trades when KyberSwap can’t (same data)
• DexScreener — token search (the text you type)
• GoPlus, honeypot.is — facts about a token (the token’s address only)
• Coinbase — adding money (its own terms apply); its public list of stock tokens (nothing about you is sent); blockchain data for your balance history (your wallet address and token addresses only)
• Candide — submitting transactions and paying network fees
• WalletConnect / Reown — connecting to apps you choose
• Neon — storing your notes, payment requests, trade records and the other records above, in the United States
• Vercel — hosting Pesso and its servers, in the United States
• Discord — private service alerts to our team

Where each of the other providers processes information varies; see the provider’s own privacy policy. We may also disclose information where the law requires it.

5. Where your information is stored

Our servers and your records are hosted in the United States, by providers including Neon and Vercel. Where information is transferred from the United Kingdom or the European Economic Area, we rely on appropriate safeguards — such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, or the EU–US Data Privacy Framework and its UK Extension where a provider is certified under it.

6. How long we keep it

• Transfer notes — until the note’s author deletes it, or until the account is deleted. The encrypted copy on the blockchain is permanent, but unreadable once deleted.
• Payment request links — until you delete the link, or the account is deleted. Deleting removes the note and web addresses; a minimal record that the link existed and how it was paid is kept for as long as we need it for our accounts and legal obligations.
• API keys — the hash, prefix, label and last-used time until you delete the key, or the account is deleted.
• Webhook endpoints — the web address, the encrypted signing secret and the delivery records until you delete the endpoint, or the account is deleted. Messages already delivered to your server are yours; we cannot delete them there.
• Trade records — until you delete your records, or until your account is deleted.
• Your first deposit — until you delete your records, or until your account is deleted.
• Your balance history — until you delete your records or your account. It can be rebuilt from public data the next time you open a chart.
• Fee records — for as long as we need them for our accounts and legal obligations. Deleting your records removes your identifier from them; the amounts and dates stay.
• Token facts — up to 24 hours. They are about a token, not about you.
• Records on your device — until you sign out or clear your browser; purchases in progress expire on their own. On iPhone, until you delete the app; transactions in progress until they land, purchases in progress for an hour.
• iPhone install records — until your account is deleted. AppsFlyer’s own copy: until we ask it to erase it on account deletion, otherwise as AppsFlyer’s own privacy policy sets out.
• Service alerts — deleted after 90 days.
• Blockchain transactions — permanently, and publicly. They cannot be deleted by anyone.

7. Your rights

You can ask to see, correct, export or delete your information, or object to how we use it, by writing to support@pesso.xyz. You can also complain to the UK Information Commissioner’s Office (ico.org.uk); if you are in the European Union, you can complain to your local data protection authority.

Deleting your records: email support@pesso.xyz from the address you sign in with. Deleting removes your trade records, your balance history and the note of your first deposit, and replaces your identifier on our fee records with a random code. Your transactions stay on the blockchain and in your activity as plain transfers, because the blockchain is public and we cannot change it.

Deleting your account: in the iPhone app, open Account and choose Delete account. On the web, email support@pesso.xyz from the address you sign in with. Because deleting your account deletes the only key that can sign for your wallet, you must first move out any money above one cent — the app shows your balance and will not delete otherwise. Deleting removes everything listed under Deleting your records above, plus your transfer notes (made unreadable everywhere, including on the blockchain), your payment request links, API keys and webhook endpoints, your iPhone install records, and your Privy account and its wallet key; we also ask AppsFlyer to erase its data for your installs. What stays: the blockchain’s public record of every transaction; the fee records, without your identifier; a minimal record that each of your payment request links existed, so anyone holding one sees it was deleted; and anything already delivered to a requester’s own server. If you used the same sign-in on pesso.xyz, you lose access there too.

8. Children

Pesso is not for anyone under 18.

9. Changes

If we change this policy we’ll update the date above and, for significant changes, tell you in the app.