Privacy Policy

Camera Permission

The Application requests camera permission solely for QR code scanning, to read wallet addresses and transaction details.

No photos or videos are captured, stored, or transmitted. The camera is only active while you are using the QR scanner, and you can revoke this permission at any time in your device settings without affecting any other feature.

Microphone Permission

If you use the voice-input button in the Takumi AI Agent chat, the Application requests microphone permission to record your voice. The recording is sent to our servers to be converted to text (speech-to-text) so the Agent can respond to it, and is not used for any other purpose.

Microphone access is only active while you are actively recording a voice message, and you can revoke it at any time in your device settings.

Contacts Permission

Some flows (for example, buying mobile credit/data for someone) let you pick a phone number from your device's contact list instead of typing it. Your contacts are read on-device only, to populate that picker, and are never uploaded to or stored on our servers. This permission is optional and only requested when you tap "pick from contacts."

Biometric Authentication

If you enable Face ID, fingerprint, or another biometric lock, that authentication is handled entirely by your device's operating system. The Application only receives a yes/no result confirming that you unlocked your device; your biometric data itself is never accessed, transmitted, or stored by us.

Google Sign-In

You may sign in using your Google account. This gives us your Google account email address and name, which we use to create or recognize your account and to send a one-time verification code to your email as a second sign-in step. We do not receive or store your Google password.

Signing in with Google does not, by itself, create a wallet or give us access to your funds. Your wallet's private keys remain generated and stored on your device, independent of your Google account, unless you choose to back them up as described below.

Optional Encrypted Backup to Google Drive

If you opt in, the Application can back up your wallet's seed phrase to your own Google Drive. Before anything leaves your device, the seed phrase is encrypted on-device with a passphrase only you know (Argon2id key derivation and AES-GCM encryption). We store only that encrypted blob, and only in your Drive's hidden, app-specific storage area ("appDataFolder") — a space that is not visible in your regular Drive file list and that no other application can read.

The Application only requests access to its own app-specific folder in your Drive. It cannot see, list, or modify any other files in your Google Drive. We do not store your passphrase anywhere, do not have the means to decrypt your backup, and cannot recover it for you if you forget your passphrase. You can remove a backup at any time from within the Application, or by deleting it directly from Google Drive.

TakumiPay's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Wallet and Blockchain Data

Public wallet addresses, on-chain balances, and transaction activity are, by the nature of public blockchains, visible on the relevant network and not private to us. The Application reads this public data to display your balances and history. We do not control, and are not responsible for, data recorded on a blockchain itself.

Takumi AI Agent

Messages you send to the Takumi AI Agent (typed or transcribed from voice) are sent to our servers and, in turn, to the third-party AI model providers that power the Agent, in order to generate a response or carry out a requested action. We ask those providers not to use your conversations to train their models. Avoid including sensitive personal information in your messages to the Agent that isn't necessary for the request.

Device and Usage Data

The Application uses a privacy-respecting analytics service to understand how the app is used and to fix bugs. This is tied to a random identifier generated for your device (not your name, email, or wallet address), and may include your device's IP address, operating system, app version, and which screens or features you use. Because one device can hold several wallets, this identifier is scoped to the device, not to any single wallet.

We do not access your device's precise or approximate location.

How Information Is Shared

We do not sell your personal information. We may share information described above with:

• service providers who process data on our behalf, such as our analytics provider, email provider (for verification codes), and the AI model providers described above — each bound to use the data only to provide their service to us;
• Google, only for the Sign-In and optional Drive backup features you choose to use;
• as required by law, such as to comply with a subpoena or similar legal process; or
• when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.

Data Retention and Deletion

We retain account data for as long as you use the Application and for a reasonable period thereafter. You can delete an encrypted Drive backup at any time from within the Application or from Google Drive directly. To request deletion of other data we hold about you, contact us at support@takumipay.xyz and we will respond within a reasonable time. Uninstalling the Application stops all further local data collection.

Children

The Application is not directed at soliciting personal information from young children, and we do not knowingly collect personal information from a child without the consent required by that child's local law. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at support@takumipay.xyz so we can take appropriate action.

Because the Application can be used to hold and transfer real value, we encourage parents and guardians to supervise use by minors.

Security

We use industry-standard technical and organizational measures to protect the information described in this policy, including client-side encryption for Drive backups and secure, OS-level storage for keys on your device. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating this page. Continued use of the Application after changes are posted constitutes your acceptance of the revised policy.

This privacy policy is effective as of July 11, 2026.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at support@takumipay.xyz.