Privacy policy

1. Controller

Malek Al-Sadek, Bitcoin & Satoshi, Kolonnenstraße 8, 10827 Berlin, Germany. Email: malek.rsh@protonmail.com. Contact via X: @BITCOIN_SAT0SHI (https://x.com/BITCOIN_SAT0SHI).

This website is the public product and compliance presence for the non-custodial wallet Bitcoin & Satoshi.

2. Website logs

Accessing the site may generate ordinary connection data: IP address, time, requested URL, user agent. This is for operation, security, and debugging.

Logs are not used for advertising. Retention follows operational need (typically days to weeks).

3. Language preference

The selected language (EN/DE/FR/ES) may be stored locally in your browser (localStorage). It is a technical preference only — not a tracking cookie and not shared with third parties.

4. No ad tracking

This site does not use marketing pixels, profiling, or third-party ad networks.

5. The wallet (non-custodial)

Private keys and recovery phrases are generated and stored on your device. We do not receive, store, or restore them.

Bitcoin transactions visible on-chain are public on the Bitcoin network. That is not processing by us; it is a property of Bitcoin.

The App

The Bitcoin & Satoshi app is a self-custodial wallet. Your seed phrase and private keys stay only on your device (the iOS keychain) and are never sent to us.

For push notifications and the VIP check we run our own server (a Cloudflare Worker). We process your device push token (device ID), the public key of your wallet as a pseudonymous identifier (user ID), your Lightning address so payment notifications can be delivered, and — for VIP access — the VIP status and, only on the path that uses a balance of 1 million sats, the balance reported and signed by the app and the time of that report (other financial data / purchases).

These data are used only so the app can function. They are not used for tracking, not sold, and not shared with third parties, except with Apple (the APNs push service) and Cloudflare as a technical processor. Push registrations are deleted automatically after 90 days of inactivity. When you delete the wallet in the app, the data on the device are removed. The app contains no advertising and no analytics or tracking SDKs.

6. Third parties: on-ramp / off-ramp (e.g. MoonPay, Ramp Network)

If you buy or sell bitcoin with payment methods in the app, you leave our processing and use the partner’s service.

The partner is an independent controller (or joint controller under its own policy) for identification, payments, and legal duties. Their privacy notice applies. MoonPay: https://www.moonpay.com/legal/privacy_policy Ramp Network is also an independent controller under its own privacy notice: https://ramp.network/privacy-policy

In this model we do not sell you bitcoin and we do not execute your fiat payment.

7. Hosting

The website is served from cloud infrastructure. Technically necessary processing (delivery, TLS, DDoS protection) may be performed by the hosting provider as a processor.

8. Legal bases

Operating the website: Art. 6(1)(f) GDPR (legitimate interest in a secure service).

Statutory information duties: Art. 6(1)(c) GDPR.

Correspondence if you contact us: Art. 6(1)(b) or (f) GDPR.

9. Your rights

You have rights of access, rectification, erasure, restriction, portability, and objection under Art. 15–21 GDPR, and the right to lodge a complaint with a supervisory authority.

For data that exists only on your device or only on-chain, we cannot produce records from a custody account — we do not operate one.

10. Age

We do not direct this website or the wallet at children, and we do not knowingly collect personal data from children. Send and receive can be used without an account with us and without sending us identity data, including by minors. Where local law requires a parent or guardian to supervise, that duty stays with them.

Buy and sell are not offered to anyone who has not reached the age of majority in their country of residence. The partner runs its own age and identity checks. A parent may not submit a minor’s identity to the partner through our software.

The country and date-of-birth check on this website is calculated in your browser. We do not receive or store that date of birth. If you believe we have received a child’s personal data, contact us on X and we will delete what we hold.

11. International transfers

The site is hosted on infrastructure that may process connection data outside your country, including in the United States. Where the GDPR requires a transfer tool, the host’s safeguards (such as the EU Standard Contractual Clauses) apply to that processor. On-ramp partners transfer data under their own notices. We do not sell personal data.

12. Security of this site

The site is served over TLS. We do not operate a database of keys, seed phrases, or identity documents. We do not run accounts and we do not store balances; only for the VIP check may a balance reported and signed by the app be stored briefly on our server.