Privacy Policy

1. Information We Collect

We collect information necessary to deliver secure, compliant, and seamless cryptocurrency management services:

• Account Credentials: Username, email address, country of residence, and contact information provided during registration.
• Authentication Secrets: Cryptographic hashes of your password and 6-digit transaction passcode (salted and hashed via Argon2/Bcrypt).
• Blockchain Data: Public cryptographic addresses, transaction hashes, asset balances, and swap history. (Note: Public ledger data is intrinsically public across blockchain networks).
• Device & Network Telemetry: IP addresses, browser agent, operating system characteristics, and security audit timestamps to detect anomalous login patterns.

2. Non-Custodial Secret Phrases

When you generate or import a 12-word Secret Recovery Phrase on FRX Wallet:

• Your recovery phrase is encrypted using AES-256-GCM prior to secure storage.
• No FRX Wallet administrator or automated service has access to your plaintext recovery phrase.
• You maintain ultimate mathematical ownership of your private keys and cryptographic signers.

3. How We Use Your Information

Your information is processed strictly for legitimate operational purposes:

• Facilitating cryptocurrency deposits, withdrawals, swaps, and portfolio calculations.
• Authenticating user sessions and validating 6-digit passcodes during sensitive actions.
• Sending critical notifications including verification codes, login alerts, and transaction receipts.
• Detecting, investigating, and preventing fraud, account takeovers, and cybersecurity incidents.
• Complying with applicable legal, regulatory, and tax reporting requirements.

4. Data Protection & Security Controls

We deploy robust organizational and technological safeguards to protect your personal data:

• Encryption in Transit: All data exchanged between your browser and FRX Wallet servers is encrypted using modern TLS 1.3 cryptographic suites.
• Encryption at Rest: Database records, encrypted key backups, and sensitive configuration tables are encrypted at rest with military-grade AES-256.
• Access Control: Administrative access follows strict least-privilege principles, multi-factor hardware keys, and continuous activity audit logging.

5. Cookies & Local Preferences

We use essential cookies and browser LocalStorage solely to maintain your active authenticated session and remember user preferences, such as your display theme (Dark Mode / Light Mode). We do not deploy tracking cookies for cross-site behavioral marketing.

6. Your Rights (GDPR, CCPA & Global)

Depending on your jurisdiction, you may have specific statutory data rights:

• Right of Access: Request a comprehensive export of all personal data held about you.
• Right to Rectification: Update inaccurate or incomplete account information via settings.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your account records, subject to statutory AML retention mandates.
• Right to Restriction: Restrict certain processing activities where lawful grounds exist.

7. Data Protection Inquiries

To exercise your statutory privacy rights, report privacy concerns, or contact our Data Protection Officer (DPO), please email [email protected].