WalletBrake- We don't ask for your name, phone number or ID to use WalletBrake. An email address is optional, only if you want alerts by email.
- We never see, ask for or store your private keys or seed phrase.
- No tracking, no analytics, no advertising cookies, no selling of data.
- Your wallet addresses and transactions are on a public blockchain. Nobody, including us, can delete them.
- Server logs are kept for 14 days. Besides those, we store your Telegram chat ID or email address if you turn on alerts and, only until they expire, your sign-in (as a one-way code), your Telegram answers and your AI agent's open tasks.
01Who we are#
WalletBrake (“we”, “us”) is run by hd5-labs, based in India. We decide how and why the personal data described here is processed, so under most data protection laws we're its “controller” (or “data fiduciary”).
02What we process, and why#
| Data | Why we need it | How long we keep it |
|---|---|---|
| Wallet addresses of your vault, spending wallet, owner wallet and backup address, and the payments you make | To check payments against your limits, show your vault and send you alerts | We don't keep a permanent copy: it's on the public blockchain anyway. Recent activity is held in memory, cleared when the server restarts, and in server logs for 14 days. |
| Sign-in signatures from your wallet | To confirm you control the owner wallet before showing activity or settings | Checked, then discarded |
| Session cookie (app.walletbrake.com only) | To keep you signed in | Up to 12 hours. It's a random code, not linked to your identity. Our server keeps only a one-way hash of it, so you stay signed in through our updates; the hash can't be used to sign in. |
| IP address | To block abuse such as request floods | In memory for a few minutes. We don't keep access logs. |
| Server logs: vault addresses, payment amounts and alert messages (no IP addresses; email addresses only partly, like j***@example.com) | To find and fix problems and investigate attacks | Deleted automatically after 14 days |
| Agent tasks and payment notes (only if your AI agent uses tasks) | To hold the agent's payments to the job it described, and to check each one fits | On our server until the task ends (at most 24 hours). Payments made in a task show its description in your vault's activity. |
| Addresses your vault has paid (up to 1,000) | To catch look-alike addresses (address poisoning) before a payment goes out | On our server for as long as the vault is protected. They're also public on the blockchain. |
| Your Telegram answers (Approve or Reject) and questions still waiting for one | So the one payment you approved can go through, once, and a rejected one can't | On our server until the answer is used or expires (15 minutes) |
| Telegram chat ID (only if you turn on alerts) | To send your vault's alerts | Until you send /stop to our bot or ask us to delete it |
| Email address (only if you turn on email alerts) | To send a link that confirms the address is yours, then your vault's alerts | Until you press unsubscribe in any of our emails, remove it on your vault page, or ask us to delete it. An address that isn't confirmed within 24 hours is deleted. |
| Break the Brake attempts (only if you try the challenge) | To run it, show the board, and learn new attacks so WalletBrake can stop them | The message you wrote, the name you chose and the result, kept to improve WalletBrake. Your IP address is stored only as a one-way code, and counts your tries for the day. |
| Emails you send us | To answer you | Until your request is resolved, unless the law requires us to keep them longer |
We don't collect your name, phone number, email address (unless you turn on email alerts or write to us), government ID, location, contacts, device identifiers, private keys or seed phrases. We don't sell personal data, and we don't share it for advertising.
03Why we're allowed to#
Depending on the data, we rely on:
- providing the Service you asked for: checking payments, showing your vault, keeping you signed in
- legitimate interests: keeping the Service secure and stopping abuse and attacks
- your consent: Telegram and email alerts. Turn them off at any time: send /stop to our bot, or press unsubscribe in any alert email.
- legal obligations: when the law requires us to keep or disclose something
04Automated decisions#
The guardian decides automatically whether to approve, delay or refuse a payment, and whether to freeze your vault, using the limits and rules shown in the app. That's the protection you signed up for. When your AI agent pays as part of a task, an AI model also reads the payment against the task. It can only hold a payment back for you to approve or refuse it; it can never approve one the rules wouldn't. If you think a decision was wrong, write to us and a person will look at it. Your owner wallet can always unfreeze your vault and withdraw to your backup address without us.
06Who else is involved#
We use a few service providers. They process data only to provide their service to us:
- Cloudflare: domain, DNS, security and hosting of this website. It processes visitors' IP addresses to deliver pages.
- DigitalOcean (servers in India): hosts the app server.
- GitHub: our server downloads public lists of sanctioned addresses from it every few hours. Nothing about you is sent.
- Blockchain node providers (currently Tenderly, PublicNode and dRPC): our server uses them to read the blockchain and send freeze transactions. They see our server's requests, which can include vault addresses.
- Telegram: delivers alerts, if you turn them on.
- Resend: sends our emails, if you turn on email alerts. It receives your email address and each email's text, which includes your vault's address.
- An AI model provider: checks payments your AI agent makes as part of a task. For each one it receives the task's description, the payment's coin, amount, recipient address and budget used, and the agent's note. No wallet keys, names or emails. It processes this only to give us the check, under terms that don't let it train its models on the data. Write to us to find out which provider we use.
Your wallet app (Trust Wallet, MetaMask and others) talks to the blockchain directly under its own privacy policy. We don't control it.
We may disclose data if the law requires it, for example in response to a valid order from a court or authority.
07International transfers#
Our providers may process data in countries other than yours. Where the law requires it, we use recognised safeguards for these transfers, such as standard contractual clauses, and we follow any restrictions your country sets.
08Public blockchain data#
Your vault is a smart contract on a public blockchain (currently Base Sepolia, BNB Smart Chain Testnet and Ethereum Sepolia). Its address, settings and every transaction are visible to anyone and can't be changed or deleted by us or by you. If you want to stay private, avoid linking your wallet addresses to your real identity in public.
09Security#
We collect as little as possible, so there's little to leak. There are no passwords or account databases. Sessions and counters are held in memory, connections are encrypted (HTTPS), and the guardian's signing key never leaves the server. No system is perfectly secure. If a breach affects your personal data, we'll tell you and the authorities as the law requires.
10Your rights#
Depending on where you live, you may have the right to:
- know what personal data we hold about you, and get a copy
- have it corrected or deleted, except data on the public blockchain, which nobody can change
- object to or restrict how we use it
- withdraw your consent at any time
- complain to the data protection authority where you live
To use these rights, write to support@walletbrake.com. We answer within 30 days, or sooner if your law requires. Because we don't know who you are, we may ask you to prove you control a wallet, for example by signing a message, before acting on a request about it. We won't treat you differently for using your rights.
11Children#
WalletBrake is not meant for anyone under 18. We don't knowingly process children's personal data. If you think a child has used the Service, contact us and we'll delete what we hold.
12Changes#
If we change this policy, we'll update the date at the top. For important changes, we'll show a notice in the app.
13Contact#
- Support
- support@walletbrake.com
- Security
- security@walletbrake.com
- Run by
- hd5-labs, India