KlipbitNeo — Privacy Policy
Last updated: October 6, 2026
1. Who we are
This Policy describes how KlipbitNeo software handles information when you use it. KLIPBIT LTDA (CNPJ 68.234.941/0001-23) is the entity responsible for this software and acts as data controller for the limited information it handles, in accordance with the Brazilian Lei Geral de Proteção de Dados (LGPD) and other applicable data protection laws.
2. Core principle
KlipbitNeo is designed to operate with the minimum data possible. The architecture is self-custodial: your private keys, Recovery Phrase, and digital assets remain exclusively on your device. We do not have access to them and we do not want access.
Your account uses your email, verified by a one-time code. Your Recovery Phrase is encrypted on your device with a password only you know (AES-256-GCM), and the encrypted copy is stored on our servers so you can recover your wallet on any device. KlipbitNeo cannot decrypt your backup — only you have the password.
3. What we do NOT collect
To be clear, KlipbitNeo never collects:
- Private keys, Recovery Phrases, or wallet passwords (even with backup enabled — the backup is encrypted on your device before leaving);
- Identity documents, government ID numbers, selfies, or any identity-verification data (Section 4.2);
- Your wallet balances (the app reads them from the blockchain; we do not store them);
- Precise location (GPS);
- Contacts, photos, files, or data from other apps;
- Biometric data (fingerprint and Face ID are processed locally by your device — never transmitted).
4. What we collect
The software may collect or process the following data, depending on the features you use:
4.1 Account and encrypted backup
To create an account you provide your email address, verified by a one-time code. Your Recovery Phrase is encrypted locally on your device (AES-256-GCM with the password you set) and the encrypted copy is stored on our servers automatically, so you can recover your wallet on any device. The stored copy is unreadable without your password — KlipbitNeo cannot access your keys. If you import an existing wallet from its Recovery Phrase, no email or backup is required.
4.2 Local currency access (licensed providers)
To access local currency rails you may optionally complete an identity verification with a licensed provider operating in your country. That data collection (identity, documents) is performed directly by that provider, under its own privacy policy, and the provider holds the applicable license in its market. KlipbitNeo does not collect, store, or have access to that data. Activating a provider is optional and at your own discretion. When you buy digital assets through a licensed provider, that provider collects and processes your identity and payment data as an independent controller under its own privacy policy; KLIPBIT LTDA does not receive those documents.
4.3 Diagnostics and telemetry
The app sends technical diagnostic data to our servers so we can detect crashes, failed transactions and delivery problems. This includes: app version and build number, device platform (iOS or Android), error messages and technical stack traces, timing measurements, and step-by-step progress markers from payment and transfer flows. For events tied to a blockchain transaction, the diagnostic record can include your public wallet address and the transaction signature — both of which are already public on the blockchain. When the app contacts our servers, the server also records the request's IP address and browser/device identifier (user-agent) for security, abuse prevention and rate limiting.
Diagnostic data is used only to operate, secure and improve the service (legal basis: legitimate interest, LGPD Art. 7, IX). It is not used for advertising, not sold, and not shared with advertising companies.
Your seed phrase, private keys and password never leave your device and are never included in diagnostic data.
Diagnostic logs are retained for up to 6 months and then deleted automatically. To exercise your LGPD rights regarding diagnostic data, contact us at the address in the Contact section; include your public wallet address so we can locate records tied to it.
4.4 Product analytics
To understand which features are used and where people get stuck, the app sends usage events to PostHog, an analytics service that processes this data on our behalf. This includes the screens you open, milestones such as account created or a swap or transfer completed (with the asset and network, never the amount), and technical details such as app version, device model, operating system, language and approximate location derived from your IP address. Events are linked to a random identifier generated on your device — not to your email or wallet address — and that identifier is reset when you log out.
PostHog processes this data in the United States (international transfer under LGPD Art. 33). Legal basis: legitimate interest (LGPD Art. 7, IX). It is not used for advertising and is not sold.
4.5 KlipbitPay (accepting payments)
If you use KlipbitPay to accept payments, we store what is needed to run your store: store name, currency, accepted tokens and settings, and — only if you choose to publish them — a logo, address or map location; the products and prices you register; the terminals you pair (a device identifier, label and operator name); and a record of each charge (amount, token, tip, fee, status, the transaction signature and the payer's public wallet address, which is already public on the blockchain).
Payments go directly from the payer's wallet to yours in a single on-chain transaction; KLIPBIT LTDA never holds the funds. Store data is kept while your store is active and deleted on request. Legal basis: performance of the service you requested (LGPD Art. 7, V).
4.6 Swap and Bitcoin savings records
When you complete a swap or move funds into your Bitcoin savings, we keep a record (assets, amounts, transaction signature and public addresses) to show your history, reconcile fees and support you. These transactions are also public on the blockchain.
4.7 Web browsing data
The web interfaces (website and web app) are hosted on Vercel, which may automatically collect IP address, browser type, and access data per its own privacy policy. The website uses Vercel Web Analytics, which is cookieless and does not identify you. KlipbitNeo does not use tracking cookies or conversion pixels.
4.8 Browser extension
KlipbitNeo is also available as a browser extension. Everything in this policy applies to it in the same way, with the following additions.
To let websites offer KlipbitNeo as a connection option, the extension adds a small wallet connector to the pages you open. It does not read, collect or transmit the content of the pages you visit, and it does not send us the addresses of the sites you visit or connect to. The list of websites you have connected is kept only in your browser, where you can see and remove each one in Settings. A website receives your public wallet address only after you approve the connection in the KlipbitNeo window, and nothing is signed without your approval in that same window.
When you approve or reject a connection or a signing request from a website, the diagnostic record described in Section 4.3 includes the type of request, its outcome and, where a transaction was sent, its signature, together with your public wallet address. It does not include the website's address. We use this to investigate failed requests. It is kept for the same period as other diagnostic data and is not used for advertising or sold.
The product analytics described in Section 4.4 record that a website request happened and whether it was approved, rejected or failed, linked to the same random identifier. They do not include the website's address or your wallet address. You can turn these usage events off at any time in the extension's Settings (Share anonymous usage data).
Your encrypted Recovery Phrase, the list of websites you have connected, your saved addresses and your display preferences are stored in the browser on your computer. Removing the extension, or using Delete account, erases them from that browser. Your Recovery Phrase, private keys and password never leave your device unencrypted and are never included in diagnostic or analytics data.
Data collected through the extension is shared only with the service providers that host and process it on our behalf, as listed in this policy. It is never used or transferred for advertising, and never sold. The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
4.9 KlipbitPay terminal app
KlipbitPay is a companion app for store owners who use KlipbitNeo to accept payments. It turns a second phone or tablet into a payment terminal paired to the owner's store. It holds no wallet, no Recovery Phrase and no keys: it only displays payment requests, and every payment goes directly to the owner's own wallet.
To pair a device, the app uses the camera to scan the pairing code shown in KlipbitNeo. It creates a random device identifier, stored only on that device, and sends it with the pairing code to our servers so the store owner can see and remove paired terminals. The camera is used for nothing else, and no images are stored or transmitted.
The terminal stores its pairing session and display preferences on the device. If the app crashes, it sends us a diagnostic record of the kind described in Section 4.3 (error message, app version, platform), with no personal data. The terminal app includes no product-analytics software. Un-pairing the terminal in KlipbitNeo, or deleting the app, ends its access.
5. Blockchain data
The software cannot erase, modify, or hide data already recorded on a blockchain. If you made a transaction, that transaction data is permanent. This is an inherent characteristic of blockchain networks, not a design choice.
6. Local storage (your device)
The software stores locally on your device:
- Private keys and Recovery Phrase — in your device's secure storage (Keychain/SecureStore), encrypted by the device;
- Preferences — language, selected network, interface settings;
- Cache — temporary data to improve performance.
This data remains exclusively on your device. If you uninstall the app, all local data is erased. If you do not have a copy of your Recovery Phrase or an active encrypted backup, your assets will be permanently and irreversibly lost.
7. Data sharing
KlipbitNeo does not sell, rent, or trade user data. Data may be shared only in the following circumstances:
- With infrastructure providers — database, hosting, and blockchain RPC providers process technical data necessary for operation;
- With analytics providers — PostHog (United States) processes the usage data described in Section 4.4 on our behalf;
- With a licensed local provider — if you choose to activate local currency access, your identity-verification data is submitted directly to the licensed provider under its own privacy policy, and is never stored by KlipbitNeo;
- On the blockchain — transactions are public by nature.
We do not use data for advertising, profiling, or any purpose beyond the operation of the software.
8. Your rights
KLIPBIT LTDA (CNPJ 68.234.941/0001-23) acts as data controller. You may exercise the rights provided by data protection laws (LGPD, GDPR) by contacting hello@klipbit.com. In practice:
- Access and portability — your assets and keys are on your device. You already have full access;
- Deletion — you can request removal of your account, backup, store data and analytics data at hello@klipbit.com. Blockchain data cannot be erased;
- Minimization — the software already collects the minimum necessary by design;
- Uninstall — uninstalling the app erases all local data. If you do not have a copy of your Recovery Phrase or an active encrypted backup, your assets will be permanently and irreversibly lost.
9. Security
The project adopts reasonable security practices, including encryption in transit (HTTPS/TLS), secure storage of sensitive credentials, and code review. However, no system is infallible.
Security vulnerabilities can be reported at hello@klipbit.com.
10. Minors
The software is not intended for anyone under 18 years of age. We do not intentionally collect data from minors. If you believe a minor has provided data through the software, please contact us so we can remove it.
11. Changes to this Policy
This Policy may be updated at any time. The current version will always be available on this page with the date of the last update. Continued use of the software after changes indicates acceptance of the updated Policy.
12. Contact
For privacy questions, data removal requests, or vulnerability reports: hello@klipbit.com