Sybil Wallet · sybil.cash
Privacy policy
Your keys stay with you. Here is what stays on your device and what leaves it when you use the wallet.
Who publishes Sybil
This privacy policy covers Sybil Wallet and sybil.cash, published by naoufal. Updated 30 September 2026. For privacy questions or deletion requests, contact nawfalona@gmail.com.
Your wallet stays on your device
Sybil is a self-custody wallet. You create or import a local wallet, not an online Sybil account. Recovery phrases, signing keys, wallet history, balances, settings and contacts are stored on your device. The app uses operating-system secure storage for software-account secrets. Your recovery phrase, private keys and unlock password or passcode are not sent to Sybil servers. You can explicitly export secrets; protect any copies you make.
Connections to networks and service providers
Syncing, checking balances, estimating fees and broadcasting transactions require network requests. Zcash lightwalletd providers receive block and transaction requests, signed transactions and, for transparent-wallet features, address-related queries. Base RPC providers receive account addresses, contract queries and signed Base transactions. Providers can observe your IP address, request timing and technical connection information. Shielded Zcash transactions protect their on-chain sender, recipient and amount; this does not make all network traffic anonymous. You can change the wallet's Zcash and Base endpoints.
Funding public names and swaps
Optional funding and swap features send assets, amounts, destination or refund addresses, quote requests and transaction status requests to the providers involved. Current integrations include NEAR Intents / 1Click and KyberSwap. Sybil's Cloudflare-hosted gateway forwards requests to 1Click and Base RPC requests to PublicNode. These requests can link a Zcash deposit to a public Base account. Price lookups may contact CoinGecko. Each provider processes requests under its own policies; provider use and retention are not controlled by the wallet.
Public Zcash names are public
Registering a .zec name publishes its name, Base owner, receiving address and associated contract activity on Base. These records can be viewed by anyone and may remain in blockchain history after an address update, transfer or name release. Public names are optional and do not verify a person's identity. Do not publish another person's details without their permission.
Contacts and private delivery
Manually saved names, addresses and notes are local. Sybil does not read your phone's address book. Private contact exchange shares the details you approve with the other participant. In an introduction, the introducer can see the approved receiving address. Optional SimpleX delivery encrypts packets end to end; relay operators can observe connection metadata and temporarily store encrypted messages. Transport confidentiality does not prevent your recipients from retaining or sharing details. Private delivery currently works while the wallet is open, with Tor off.
Device permissions and exports
The camera is used for QR scanning; camera images are not uploaded by Sybil. Bluetooth is used for supported hardware-wallet connections. On older Android versions, Bluetooth discovery can require the location permission; Sybil does not use it to determine your geographic location. Optional biometric unlocking uses the operating system; Sybil does not receive biometric templates. Files, QR codes, copied details and encrypted contact backups are exported only when you choose those actions. Clipboard contents and exported files may be accessible to other software or anyone you share them with.
Website, gateway and support requests
Cloudflare hosts sybil.cash and Sybil's gateway. It processes IP addresses, requested URLs and technical request information to deliver and protect the services. Gateway abuse prevention uses IP-derived rate-limit identifiers and counters. Application request-body logging and Worker observability are disabled in the current deployment. The website does not embed advertising or visitor analytics. If you email support, your email address and the information you send are processed by the publisher and email provider to respond to you. Never send recovery phrases, private keys or passwords to support.
Security and retention
Default network endpoints use encrypted connections, and private contact packets and connection-backup archives use encryption. Local wallet data is retained until you remove it. Exported files and backups remain wherever you saved or shared them. Gateway rate-limit state is short-lived; no wallet profile or hosted contact backup is created by Sybil. Support correspondence is retained as needed to handle the request; contact the privacy email to request its deletion. Network, relay, hosting and email providers may retain data under their own policies, and blockchain records are permanent. No device or network service can promise absolute security.
Removing data and your choices
Use Settings → Accounts → Remove account to remove a local wallet account. Removing the final account resets the wallet's local state. Removing wallet data does not move your funds or erase blockchain history. Back up recovery phrases and connection backups before resetting if you want to retain access. Delete exported files and clipboard copies separately. You can avoid optional public names, swaps and private delivery. You may ask nawfalona@gmail.com about data the publisher holds, including access, correction or deletion requests. The publisher cannot erase records held by recipients, blockchains or independent providers.
Joining the Android beta
The Android testing signup links to the Sybil Android Beta Google Group. Google processes your membership under its own privacy policies. The group owners and managers can see your membership email to administer tester access; the member list and member email visibility are restricted to owners and managers. Joining the group does not create a Sybil wallet account or send us wallet keys. Leave the group through Google Groups to end your membership, and opt out of the Play test separately if you joined it. Sybil.cash does not collect signup emails through a website form.
Children and policy updates
Sybil is intended for adults and is not directed to children. Sybil does not sell personal data or use it for advertising. This policy may change as the wallet and its integrations change; the dated policy at https://sybil.cash/privacy is the current published version.