Privacy Policy

1. The Non-Custodial Guarantee

Smirk is a non-custodial service.

• Private Spend Keys: Your private spend keys (the keys required to move money) are generated and stored locally on your device. They are never transmitted to our servers.
• No Access: We cannot "freeze" accounts or "seize" funds because we do not hold the keys to move them.

2. Information We Collect

To facilitate social tipping and identity verification, we collect the following:

A. Monero & Wownero Private View Keys

To provide a fast mobile and browser-extension experience without requiring you to download the entire blockchain, Smirk collects and stores your Private View Keys for Monero (XMR) and Wownero (WOW).

• Purpose: These keys allow our Light Wallet Server (LWS) to scan the blockchain on your behalf to identify incoming tips and update your balance.
• Limitation: A View Key cannot be used to spend your funds. It only allows the server to see that a transaction has occurred. Your funds remain secure and spendable only by your local Smirk wallet (browser extension or mobile app).

B. Social Identity Data

When you link a social account (Telegram, Discord, etc.), we store:

• Your platform-specific User ID and Username.
• Your public wallet address (so others can find you to send tips).

C. Transaction Metadata & Payloads

• Encrypted Payloads: The ciphertext of the tip (which we cannot read).
• Status & Timestamps: Metadata regarding when a tip was created or claimed.

D. Bitcoin & Litecoin Public Addresses

To show your BTC and LTC balances and broadcast your transactions, our backend queries Electrum/Fulcrum servers with your publicwallet addresses. The default configuration uses public Electrum servers, the same kind most non-custodial wallets use; a self-hosted operator can point at their own node instead.

• What is shared: only public address strings and signed transaction bytes — never seed phrases or private keys.
• What we store: nothing additional on our side beyond what is already in your wallet's local view.

E. Wallet Fingerprint

On first login your wallet derives a one-way fingerprint(SHA-256 of your seed) and sends it to our backend as a stable, anonymous identifier. It is used to associate your wallet with social handles and tip history across devices, and is the value our backend joins on internally. It is not reversible back to your seed and cannot be used to spend your funds.

F. Optional Dapp Connections (window.smirk)

Smirk exposes a window.smirk API to web pages so dapps like smirk.cash, claim pages, and merchant sites can request a connection or a signature from your wallet. Connections are per-origin and require an explicit approval prompt the first time a site asks; you can revoke any origin at any time from Settings. You can also globally disable thewindow.smirk surface from Settings — when off, pages cannot detect that Smirk is installed.

• What gets shared: only the public material you approve (asset public keys, addresses) plus the signatures you explicitly authorize per request.
• What we do not share: seed phrases, private spend keys, balances of un-authorized assets, history of other origins.

G. Optional Crypto Swaps

Smirk offers in-wallet crypto swaps (e.g. BTC ↔ XMR) via third-party aggregators such as Trocador. We do not operate an exchange ourselves. When you choose to swap, the wallet queries the third-party aggregator for quotes and routes the trade through them.

• What gets shared with the aggregator: the asset pair, amount, and your destination and refund public addresses — exactly what the aggregator needs to fulfill the trade.
• Subject to the aggregator's own privacy policy: we are a passthrough at trade time. Trocador's policy lives at trocador.app/en/privacypolicy/.
• Referral commission: Such Software receives a referral commission (around 1% of the swap amount) from Trocador, already reflected in the quoted rate. We are never in custody of or in the settlement path for the swapped funds — see our Terms for details.
• Opt-in: no swap data leaves your device until you tap to request a quote.

H. Nostr Identity & name@smirk.cash

Smirk v0.3 gives your wallet a Nostr identity — a public key ("npub") derived from your seed. If you choose a Smirk username and link your npub, our backend stores that username ↔ npub mapping and publishes it in a public NIP-05 directory at /.well-known/nostr.json, so others can verify you as name@smirk.cash and route messages to you.

• Public by design: a username and npub are public identifiers meant to be looked up. Any name you link is publicly resolvable; a name you have not linked returns nothing (the directory does not reveal whether a name exists).
• Optional: you do not need a username to use the wallet — it exists only to give you a name@smirk.cash handle and let people find you.
• Derived, not custodial: your npub is a public key; the matching private key stays on your device with your seed.

I. Encrypted Messaging (Nostr Direct Messages)

Smirk v0.3 supports end-to-end encrypted direct messages over the Nostr protocol (NIP-17 "gift-wrapping"). Messages are encrypted on your device before they leave it. They travel through Nostr relays — public relays and, optionally, one operated by Such Software — which carry only ciphertext they cannot read.

• What a relay we operate can see: the encrypted envelope, the recipient's public key (needed to deliver it), and basic metadata (timing, size). It cannot see message contents, and the gift-wrapping hides the real sender.
• Retention: a relay we operate stores encrypted messages briefly (currently about 30 days) so your other devices can fetch them, then deletes them.
• Your choice of relay: you can use other Nostr relays instead of, or in addition to, ours — messaging does not depend on us.
• Opt-in: messaging is a feature you choose to use.

J. IP Addresses

Like any internet server, our backend receives your device's IP address with each request. We store only a salted, one-way hash of it, and only for rate-limiting and abuse prevention (for example, throttling automated signups). We do not use it to track you or link it to your wallet, and self-hosting avoids sharing it with us at all.

3. How We Protect Your Data

• Backend Security: Our Rust-based backend utilizes SQLx type safety and memory-safe architecture to protect your stored view keys and social data.
• No Sale of Data: We do not, and will never, sell your social handles, transaction history, or view key data to third parties.
• Legal requests: We may access, preserve, or disclose the limited data we hold to comply with valid legal process or applicable law, or to report unlawful content (such as child sexual abuse material) as the law requires.

4. Third parties you choose to enable

Some features connect you to independent third parties operated by others, not by us — Trocador for swaps, the Electrum servers noted above, and any site you connect to through the window.smirk interface. Those endpoints see whatever your interactions with them entail, and each has its own privacy policy. We neither control nor monitor those connections, and we are not responsible for how those parties handle your data.

5. Children

Smirk is not directed to people under 18, and we do not knowingly collect data from minors. If you believe a minor has used Smirk and you want to delete any associated state, uninstalling the extension or app on the relevant device removes all local data; contact us at the address below to remove associated backend records.

6. Your rights

Your seed phrase and private spend keys never leave your device, and uninstalling removes all local state. For the limited data our backend does hold (Monero/Wownero view keys, your wallet fingerprint, linked social handles, and encrypted tip metadata), residents of the EU/UK (GDPR Articles 15–22) and California (CCPA / CPRA) may request access to, correction of, or deletion of that data by emailing support@such.software. We do not sell your data.

For data held by third parties you've used through Smirk (Trocador, node operators, Electrum servers), contact those providers directly using the privacy contact in their respective policies.

7. Changes to this policy

We'll post any update to this page with a new effective date. Material changes will be announced via @such_software and the app's release notes. Continued use of Smirk after a change indicates acceptance of the revised policy.