Privacy Policy
1. Introduction
This Privacy Policy ("Policy") explains how ONE COMPANY ("ONE WALLET," "we," "us," or "our") collects, uses, shares, and protects information in connection with the ONE WALLET application and related services (collectively, the "App"). It applies to all users of the App worldwide.
Data controller. The controller responsible for the processing described in this Policy is:
ONE COMPANY
3F, KLTS Block C, No. 78 Jalan Gombak, Kuala Lumpur, Malaysia
Email: support@onewallet.store
Where the App runs. ONE WALLET is delivered as a Telegram Mini App (TMA) — it runs inside the Telegram client, in a secure in-app browser view, rather than as a standalone app installed from an app store. Telegram is the identity provider for your account. This Policy describes what ONE WALLET receives, uses and stores; it does not govern Telegram's own handling of your data, which is subject to Telegram's Privacy Policy.
ONE WALLET is built on a privacy-first, minimal-collection philosophy. Because the App is a self-custodial multi-chain wallet, we have intentionally designed our systems so that the material that grants control of your funds — your reconstructed private key, your Recovery Phrase, and your PIN — is never transmitted to us and never stored on our servers. Section 5 explains exactly how key custody works, including what we do and do not hold.
This Policy forms part of, and is incorporated into, the ONE WALLET Terms of Use. By using the App, you agree to the practices described here. If you do not agree, you must not use the App.
2. Summary at a Glance
For quick reference, the essentials of how we handle data:
| Category | What Happens |
|---|---|
| Private key, Recovery Phrase, PIN | Never collected. Reconstructed and used only on your device. See Section 5. |
| Personal identity (name, ID, address) | Not collected. No KYC is required. |
| Telegram account | Numeric ID, username, display name, photo and language are received from Telegram. Phone number, contacts and messages are not. |
| Device and network info | Collected for security, fraud prevention, and diagnostics. |
| Public wallet addresses | Collected for balance display, reward tracking and service functionality. |
| Recovery email | Collected only if you choose to enable email recovery. Used to send one-time codes. See Section 5. |
| Data sold to advertisers | Never. We do not sell personal data. |
| Exporting your wallet | You can export your private key at any time and move to another wallet. See Section 5.3. |
| Users under 18 | Not permitted to use the App. |
3. Information We Collect
We collect only the minimum information reasonably necessary to operate, secure, and improve the App.
3.1 Telegram Account Information
When you open the App, Telegram provides a standard Mini App session payload identifying your account. From it we receive and use:
- Your numeric Telegram user ID;
- Your Telegram username, where you have set one;
- Your display name and profile photo, used to render your in-app profile;
- Your interface language and locale.
We do not receive, and cannot request, your Telegram phone number, contact list, chat contents, group memberships, or message history. Telegram does not disclose these to Mini Apps.
Your Telegram user ID is the primary identifier we use to recognise your account, attribute mining and referral rewards, and investigate abuse or support requests.
3.2 Public Wallet Addresses
To display balances, surface transaction history and deliver rewards, we collect and associate public wallet addresses that you generate or import within the App. These addresses are, by the design of every supported blockchain, publicly visible on-chain to anyone — we do not treat them as confidential, and we do not link them to your real-world identity because we do not collect your identity.
3.3 Device and Technical Information
When you use the App, we automatically collect limited technical information, including:
- Device type, model, and operating system version;
- App version, crash signals, and performance diagnostics;
- Approximate IP address, used to infer general region for security and compliance;
- Anonymized device identifiers, for fraud prevention and anti-abuse controls on the mining program;
- Session timestamps and event counters.
For security-relevant events — such as enabling Multi-Share Recovery or completing a wallet recovery — we record the time of the event and an approximate, city-level location derived from IP, so that we can show you that information in your in-app notifications and so that suspicious activity can be identified.
3.4 Activity and Reward Records
Because the App operates a mining program, a referral program and a merchant payment network, we necessarily maintain records of the activity that produces rewards and settlements, including mining point accrual, reward credits, referral relationships between accounts, and completed merchant payments. These records are tied to your Telegram user ID and your public wallet addresses.
3.5 Recovery Email
If you choose to enable email recovery (Section 5.1), we collect and store the email address you bind to your wallet. We use it for one purpose only: sending the one-time code that unlocks your Email Shard during recovery. We do not use it for marketing, newsletters, or any other messaging. Binding an email is optional; you may use the wallet without one.
3.6 Support Communications
If you voluntarily contact us — for example, by email — we will receive whatever information you choose to share, including your email address and the contents of your message. Please do not send us your Recovery Phrase, private key, or PIN. We will never ask for them, and legitimate support will never require them.
4. What We Do NOT Collect
To remove any ambiguity, ONE WALLET does not collect, request, store, or otherwise process:
- Your private key or Recovery Phrase — see Section 5 for exactly how these are handled;
- Your PIN, password, or biometric data — biometric unlock is performed locally by your device's operating system, which never shares the biometric itself with us or with any app;
- Your legal name, date of birth, government ID, passport, driver's licence, tax number, or KYC documents;
- Your home address, phone number, or precise GPS coordinates;
- Your email address, unless you bind one for email recovery (Section 3.5) or send us one by contacting support;
- Your Telegram phone number, contacts, or messages;
- Your banking, card, or bank-statement information;
- Any information about your photos, calendar, or microphone.
Because we do not collect this information, we cannot disclose it — to anyone, under any circumstances.
5. Your Keys: Custody, Multi-Share Recovery, and Export
This section describes precisely how key material is handled, because vague language about self-custody is common in this industry and we would rather be exact.
5.1 Multi-Share Key Architecture
ONE WALLET uses a Multi-Share key architecture based on Shamir's Secret Sharing. Your wallet key is split into four independent shares, held by different parties:
| Share | Held by |
|---|---|
| Social (Telegram) share | The third-party key-management network, bound to your Telegram login |
| Device share | Your own device, in the App's local storage |
| Recovery Phrase | You, and only you — a 24-word phrase shown once at setup |
| Email Shard | Held on our side, and released only after you enter a one-time code sent to your bound email. You never see the shard itself. |
Any two of the four shares reconstruct your key. The Email Shard is optional — you are offered it after setting up your Recovery Phrase, and can add it later from Settings. If you skip it, your wallet uses the other three shares. No single party — including ONE COMPANY — holds enough share material to reconstruct your key or move your funds. When you sign a transaction, the two available shares are combined on your device, in memory, used to sign, and then discarded.
5.2 What We Store About Your Keys
We store a one-way cryptographic hash of your Recovery Phrase, used solely to verify that a phrase submitted during recovery is the correct one. A hash cannot be reversed: it does not allow us, or anyone obtaining it, to derive your phrase or your key.
Where you have enabled email recovery, we also hold your Email Shard and your bound email address. The Email Shard is one share out of four — on its own it is useless, and it is released only against a valid one-time code sent to your email.
We do not store your private key, your Recovery Phrase in readable form, or any combination of shares sufficient to reconstruct your key. At most one share of your key is ever in our hands.
Consequences of this design, stated plainly:
- We cannot move, freeze, or seize funds in your wallet.
- We cannot recover your wallet for you if you lose the required shares. If you can no longer produce any two of your four shares, the wallet cannot be restored by anyone, including us.
- We cannot comply with any demand — from a government, a court, or any other party — to hand over your key, because we do not possess it. The Email Shard alone does not constitute your key.
5.3 Exporting Your Private Key
You can export your wallet's private key at any time, from Settings → Security → Private Key, after verifying with your biometric or PIN.
The exported key is a standard key that can be imported into any compatible third-party wallet. Exporting requires no approval or cooperation from us, and does not depend on our services being available. You are never locked into ONE WALLET.
Treat an exported key with the same care as a Recovery Phrase: anyone who obtains it gains full and irreversible control of the wallet. Never share it with anyone, including anyone claiming to represent ONE WALLET.
6. How We Use Information and Our Legal Basis
We use the limited information we collect solely for the operational purposes below. For users in the European Economic Area, the United Kingdom, and other jurisdictions with equivalent laws, the applicable legal basis under Article 6 GDPR is stated alongside each purpose.
| Purpose | What we use | Legal basis |
|---|---|---|
| Providing the Service — displaying balances, routing transactions, crediting rewards to the correct address | Telegram ID, public addresses, activity records | Performance of a contract (Art. 6(1)(b)) |
| Security and anti-abuse — detecting fraud, bot activity, sybil attacks, mining abuse, unauthorized access | Device and technical information, approximate region, activity records | Legitimate interests (Art. 6(1)(f)) — protecting users and the integrity of the platform |
| Compliance and eligibility — geographic restrictions and sanctions screening required under the Terms of Use | Approximate region | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
| Performance and stability — diagnosing crashes, measuring latency, improving reliability | Crash and diagnostic data | Legitimate interests (Art. 6(1)(f)) |
| Product improvement — understanding, in aggregate, which features are used | Aggregated and anonymized usage metrics | Legitimate interests (Art. 6(1)(f)) |
| Email recovery — sending one-time codes to unlock your Email Shard | Bound email address | Performance of a contract (Art. 6(1)(b)) |
| Support — responding to your inquiries | Whatever you send us | Performance of a contract (Art. 6(1)(b)) |
| Service notices — important operational or security announcements | Telegram ID | Legitimate interests (Art. 6(1)(f)) |
We do not use the information we collect to build advertising profiles, and we do not sell your information to third parties. We do not carry out automated decision-making that produces legal or similarly significant effects on you.
Where we rely on legitimate interests, you have the right to object — see Section 11.
7. Public Blockchain Disclosure
You acknowledge and understand that public blockchains are transparent by design. Every transaction you make — including the sending address, the receiving address, the asset, and the amount — is permanently recorded on-chain and visible to anyone in the world, regardless of any action taken by ONE WALLET. This is a property of the underlying blockchain networks and is outside our control.
Please assume that anything you do on-chain is public, immutable, and potentially linkable to any other on-chain activity associated with the same address. No request to us, including a deletion request, can remove or alter on-chain data.
8. How We Share Information
We share information only in the narrow circumstances described below.
8.1 Service Providers (Processors). We share limited information with trusted service providers acting on our behalf under contract, bound by confidentiality and data-protection obligations, and permitted to use the information only to perform services for us. The categories are:
| Category | What they receive |
|---|---|
| Cloud hosting and infrastructure | Platform data as stored and processed |
| Key-management network | The Telegram-bound key share and authentication signals (never a reconstructable key) |
| Email delivery provider | Your bound email address and the one-time code, for delivery only |
| Error reporting and performance monitoring | Crash reports and diagnostic data |
| Product analytics | Aggregated and anonymized usage metrics |
| Blockchain node and data providers | Public wallet addresses and public on-chain queries |
A current list of our sub-processors is available on request to the contact address in Section 16.
8.2 Third-Party Protocols. When you initiate an on-chain action such as a swap or bridge, the relevant transaction data (including your public address, amounts, and routing information) is transmitted to the applicable third-party decentralized protocol and recorded on the relevant blockchain. These third parties are independent of ONE WALLET and their handling of data is governed by their own terms and policies.
8.3 Legal and Safety Requirements. We may disclose information where we reasonably believe disclosure is required by a valid legal process (subpoena, court order, or equivalent), to comply with sanctions or regulatory obligations, to investigate suspected violations of our Terms, or to protect the rights, property, or safety of ONE WALLET, our users, or the public. Where legally permitted, we will notify the affected user before disclosure. We cannot disclose key material, because we do not hold it (Section 5.2).
8.4 Corporate Transactions. If ONE COMPANY is involved in a merger, acquisition, reorganization, or asset sale, information may be transferred to a successor entity subject to this Policy.
8.5 No Sale of Personal Information. We do not sell, rent, or trade personal information to advertisers, data brokers, or other third parties for their independent use.
9. Data Retention
We retain information only for as long as is reasonably necessary for the purpose that justified collecting it, to comply with applicable legal obligations, to enforce our Terms, and to resolve disputes. Our retention criteria by category:
| Category | Retention |
|---|---|
| Account records (Telegram ID, public addresses) | For the life of the account, and for a limited period afterwards to handle disputes and reversals |
| Reward, mining and referral credit history | At least 2 years, as financial records required for audit, dispute resolution and compliance |
| Merchant payment and settlement records | For the period required by applicable financial record-keeping obligations |
| Security and fraud-prevention logs | For the period necessary to investigate and prevent abuse, then deleted or irreversibly anonymized |
| Crash and diagnostic data | A short operational period, then deleted or irreversibly anonymized |
| Support correspondence | For the period necessary to resolve the matter and handle any follow-up |
| Recovery Phrase hash | For as long as Multi-Share Recovery is enabled on the wallet |
| Bound email address and Email Shard | For as long as email recovery is enabled on the wallet |
| On-chain data | Permanent — outside our control and not deletable by us |
Note that reward and referral records describe relationships and transactions involving more than one user. Where a record is required to substantiate another user's rewards or a completed settlement, we may retain it even after a deletion request, in a minimized form.
10. Security
We implement administrative, technical, and organizational measures designed to protect the information we collect against unauthorized access, alteration, disclosure, or destruction. These measures include transport encryption (TLS), access controls, secure software-development practices, anomalous-activity monitoring, and periodic review of our systems.
Breach notification. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to you, we will also notify you directly, without undue delay, through the App or another channel available to us.
However, no method of transmission or electronic storage is perfectly secure. You are responsible for maintaining the security of your device, keeping your operating system up to date, and — above all — safeguarding your Recovery Phrase, your PIN, and any private key you export. A compromised Recovery Phrase or private key gives the holder full and irreversible control of your wallet. Never share either with anyone, including anyone claiming to represent ONE WALLET.
11. Your Rights and Choices
Subject to applicable law, you have the following rights regarding the information we hold about you:
- Access — to obtain confirmation of whether we process your data, and a copy of it;
- Correction — to have inaccurate information corrected;
- Deletion — to have your information deleted, subject to the exceptions below;
- Restriction — to have processing restricted in certain circumstances;
- Objection — to object to processing based on our legitimate interests;
- Portability — to receive certain information in a structured, machine-readable format and have it transmitted to another controller;
- Complaint — to lodge a complaint with the data-protection authority in your country of residence or place of the alleged infringement.
How to exercise them. Email support@onewallet.store with the subject line "Privacy Request", stating the right you wish to exercise and the Telegram username or user ID associated with your account. We do not require identity documents; we will verify your request through the Telegram account in question. We will respond within 30 days, and will tell you in advance if a complex request requires an extension. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive.
Two limits, stated plainly rather than buried:
- On-chain data cannot be erased or corrected by us. Blockchain records associated with a public wallet address are permanent and outside our control. A deletion request removes what we hold; it cannot remove blockchain history.
- Certain records are retained despite a deletion request where retention is required or permitted by law — including financial, reward and settlement records, and security logs relevant to fraud investigation. See Section 9.
You may also disable device permissions such as notifications from your device's operating system settings, and you may stop using the App at any time. Before doing so, export your private key (Section 5.3) — your on-chain assets remain yours, but you will need the key to access them elsewhere.
12. International Data Transfers
ONE COMPANY is established in Malaysia, and the App is used worldwide. Information we collect may be processed, stored, or transferred in countries other than the one in which you reside, including countries that have not been the subject of an adequacy decision by the European Commission.
Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), together with supplementary technical and organizational measures where required. You may request a copy of the relevant safeguards by contacting us at the address in Section 16.
13. Cookies and Similar Technologies
The App runs inside Telegram's in-app browser view. It uses local storage on your device for functions that are strictly necessary to operate the wallet — most importantly, holding your Device key share (Section 5.1) and your session and interface preferences. Clearing this storage removes your Device share; make sure you can still recover your wallet before doing so.
We do not use cookies or similar technologies for advertising, cross-site tracking, or profiling. Where our service providers use lightweight analytics SDKs, they do so strictly for the operational and analytics purposes described in Section 6, and never for third-party advertising.
If we operate supporting websites, those websites may use strictly-necessary and analytics cookies. Where required by law, you will be presented with a cookie notice on first visit and may adjust your preferences.
14. Children's Privacy
ONE WALLET is not directed at, and is not intended for use by, individuals under the age of eighteen (18). We do not knowingly collect information from children. If we become aware that a user is under 18, we will take reasonable steps to disable the relevant access and delete any information we may have unintentionally collected. If you believe a minor has provided us with information, please contact us immediately using the details in Section 16.
15. Changes to This Policy
We may update this Policy from time to time to reflect changes to the App, applicable law, or our practices. When we do, we will update the "Last Updated" date and version number at the top of this Policy and, where changes are material, provide a more prominent notice within the App or on our official channels. Your continued use of the App after an update constitutes acceptance of the updated Policy.
16. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your information, please contact:
ONE COMPANY
3F, KLTS Block C, No. 78 Jalan Gombak, Kuala Lumpur, Malaysia
Email: support@onewallet.store
For privacy requests specifically, please use the subject line "Privacy Request" — see Section 11 for what to include. We aim to respond to privacy-related inquiries within 30 days.
By using ONE WALLET, you acknowledge that you have read and understood this Privacy Policy.