What we know about you: almost nothing.

No accounts, no sign-up, no collection

The app has no user accounts. It does not ask for your name, email, phone number or contacts, and it has no analytics, advertising or crash-reporting libraries. We do not collect, store or sell personal information, and we have no servers that hold anything about you beyond what the public ledger holds, described below.

Your keys stay on your phone

The app creates a wallet (the app calls it your treasure chest) on your device: a signing key, a receiving key and, for wallets made with version 0.4 or later, twelve recovery words. These are kept in a file on the phone, sealed with a passphrase you choose. They never leave the phone unless you export them yourself. We cannot recover a lost passphrase or lost words; nobody can.

What the public ledger records

BerryChain is a public blockchain. When you act, the network records it permanently and anyone may read it:

• Your address, and the name you chose when you claimed your starter.
• Coins sent and received between addresses, with any public memo you typed.
• For each letter: the sender's address, the recipient's address, the block it was carried in, its size, and any coins attached. The letter's words, subject, signature and any picture are encrypted so that only the recipient's wallet can open them. Nodes, miners and we ourselves cannot read them.

Because the ledger is permanent, nothing written to it can be deleted, including by us. Use a fresh wallet for any correspondence you would not want linked to your address.

Network requests

The app talks to the seed nodes (seed1 and seed2 at berrychain.link) or to any node you configure, over HTTPS, to read the chain and to submit your transactions. A node sees your IP address and the requests you make, as any web server does; the seed nodes keep ordinary web-server logs for a short time for operations and do not use them for anything else. The app also fetches nothing from any third party.

Instant notices on iPhone (optional)

On iPhone, Settings has a switch called Tell me straight away. It is off unless you turn it on. When it is on, the app hands your phone's Apple push token to a BerryChain seed node, signed by your wallet, and the seed keeps the pairing of that token and your address. The seed then sends an Apple push the moment a letter for your address is carried in a block. The push says that a letter has arrived and nothing else: not who wrote it, not what it says, not any coins attached. This is the only thing any server of ours stores about you. Turn the switch off and the seed forgets the pairing at once; Apple is told nothing about your address. Android phones use the app's own background check instead and register nothing.

Parcels (large attachments)

A letter can carry a file too big for the chain. The app seals the file on your phone with a one-off key, pays a small BERRY fee to a seed node's parcel room, and uploads the sealed copy there; the key travels only inside the sealed letter. The parcel room keeps the sealed file for up to 30 days and hands it to the recipient's app, which checks it and opens it. The room learns the sender's address, the file's size and a hash of the sealed bytes: not the file name, not the contents, not who it is for. Burning the letter asks the room to delete the parcel at once.

Deleting your data

There is no account to close and nothing of yours on our servers except, if you chose it, two things you control from the app: the pairing of your phone with your address for instant notices (switch off Tell me straight away in Settings and the seed forgets it at once), and any parcel you sent (burn the letter that carried it and the parcel room deletes it at once; otherwise it is deleted after 30 days). Letters and transactions on the public ledger are permanent and cannot be deleted by anyone, including us; the app lets you remove or burn letters from your own device. To make the app forget everything, delete the app: the chest file and all local data go with it, and your twelve words remain the only way back.

Camera and photos

If you choose to attach a picture to a letter, the app asks the system camera or gallery for one picture, shrinks it on the phone, and seals it inside the letter. The picture is not sent anywhere else and no permission is used until you tap the button.

The Harbourmaster

Letters you write to the Harbourmaster address are answered by a language model run by the project. To write a reply, the model is shown the words of your letter and your recent letters to it. That text is sent to the model provider (Anthropic) for processing under their terms and is not used by us for anything but the reply. Do not write anything to the Harbourmaster that you would not tell a stranger.

Children

The app is not directed at children under 13 and we knowingly collect nothing from anyone.

Changes and contact

Changes to this policy are published on this page with a new date. Questions: open an issue at github.com/Keysersoze1991/berrychain.