COWBOLT
PRIVACY POLICY

Last Updated: October 15, 2026

1. WHO WE ARE AND WHAT THIS COVERS

This Privacy Policy explains how Cowbolt LLC ("Cowbolt," "we," "us") handles information when you use the Cowbolt mobile application for iOS and Android (the "App") and the cowbolt.com website (the "Website"). Cowbolt LLC is a Florida limited liability company; our address is 7901 4th St N #33477, St. Petersburg, FL 33702. Questions, requests and complaints: hello@cowbolt.com. By using the App or the Website you acknowledge this Policy and agree to our Terms and Conditions.

2. INFORMATION WE COLLECT IN THE APP

• Your display name.
• Your account login key: a private key string our server generates at sign-up and stores encrypted. It is your login credential. The App has no email address, phone number or password.
• Your preferences: language, unit of account or currency, notification, sound and vibration settings, and a color.
• Your country, derived from your IP address when the App connects. We store only the two-letter country code, not the IP address, in your account.
• A profile picture, if you upload one.
• Content you create: groups and group members, expenses and amounts, expense attachments, chat messages and chat attachments, reactions, and contacts and friend relationships. Other members of a group you join can see what you post to that group.
• Wallet data: wallet addresses (Bitcoin, Liquid, Lightning address and LNURL), transaction records and queued transactions, and swap records.
• Your push-notification token and a device identifier (iOS identifierForVendor or the Android device id), so we can deliver notifications.
• Technical logs: our servers log requests, including your IP address and, when you are connected, your user id, display name, approximate city and country, and user agent.
• Analytics: see Section 5 (Firebase Analytics) and the operator usage statistics in Section 4.

Chat message text is stored encrypted at rest on our servers. This is not end-to-end encryption: our servers can read chat content.

3. YOUR WALLET AND RECOVERY PHRASE

Please read this section carefully. Cowbolt is a self-custody wallet, not a hosted or custodial wallet.

• Your 12-word wallet recovery phrase is created for your wallet and stored in secure storage on your device (iOS Keychain or Android Keystore). Cowbolt does not store your recovery phrase and cannot read your wallet's keys from our systems.
• Wallet operations you request (balances, sending, invoices, swaps, history) are performed with your keys through the wallet SDK (Breez) and relayed to the networks. Cowbolt does not hold your funds.
• If you enable the in-app iCloud backup (iOS), the App stores your login key and recovery phrase in your iCloud container, protected by your Apple account; Cowbolt cannot access it.

You are responsible for keeping your own copy of your recovery phrase. We cannot recover funds if it is lost and cannot reverse blockchain transactions.

4. HOW WE USE INFORMATION

• To provide the App: accounts, groups, expenses, chat and wallet operations.
• To send push notifications. Notification text, including the sender name and message text of chats and the expense name and amount, is passed to Apple and Google push services through Amazon SNS.
• To secure the service and diagnose errors, including from the logs described above.
• For usage statistics. We compute aggregate counts (users, groups, transactions) and per-user usage analytics visible to Cowbolt's operators only: user id, display name, country, language, sign-up date, groups and last activity.
• To comply with law and to enforce our Terms.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we run no advertising in the App.

5. SERVICE PROVIDERS AND OTHER RECIPIENTS

• Amazon Web Services (AWS): hosting; private S3 file storage accessed through short-lived presigned links (about 10 minutes); SNS push delivery; log storage.
• Google Firebase: Firebase Cloud Messaging for push delivery, and Firebase Analytics, which records a login event in the App. Firebase Analytics is switched off in the iOS build configuration. On Android it is not disabled, so Google automatically collects standard app-usage data (such as an app-instance identifier, device model and operating-system version, approximate country, and events such as first open and session start) in addition to the login event, and processes it under Google's own terms.
• Apple and Google: app stores and push services; iCloud if you use the iCloud backup.
• Breez: the wallet SDK for Liquid and Lightning. Your wallet's addresses, invoices and amounts are processed with it to carry out the transactions you request.
• SideSwap: for Bitcoin/Liquid pegs, your Bitcoin or Liquid address is sent.
• Blockstream: blockchain data. Your derived Bitcoin addresses and signed transactions are sent to look up and broadcast transactions.
• FastForex: currency rates. No user data is sent.
• Baserow (Website only): stores the sign-up and contact forms described in Section 10.

We also disclose information if required by law or legal process, to protect rights and safety, or in a merger, financing or sale of the business. Blockchain transactions are public and permanent and cannot be deleted by us or anyone else.

6. RETENTION AND DELETION

• Account and content data is kept while your account exists. Chat messages and uploaded files have no automatic expiry; a file is deleted when it is replaced or when its parent item is deleted.
• Production server logs are kept for 180 days in Amazon S3 and then expire.
• To delete your account, email hello@cowbolt.com with your display name. Because accounts have no email address, we verify a request by asking you to prove control of the account, for example by confirming recent account activity or performing an action we specify inside the App. On a verified request we permanently delete your account and associated data, including your wallet records and the wallet-software state files kept for your wallet, within 30 days. The App does not currently have an in-app delete button. Before you ask, withdraw any balance to a wallet you control: deleting the account deletes the server-side wallet records, and funds left in it may become unrecoverable. Content you posted in a shared group is deleted or anonymized where deletion would break other members' records.
• Deleted data can remain in database backups and logs until they rotate out. Blockchain records cannot be removed.
• Website form submissions (Section 10) are kept for up to 24 months after your last contact with us, then deleted, or earlier on request.

7. SECURITY

Sensitive fields are encrypted at rest in our database and files are stored privately in S3. No system is perfectly secure. Your funds are protected by your recovery phrase, which only you hold. Keep a backup; Cowbolt cannot restore it. Keep only amounts in the App that you can afford to lose.

8. CHILDREN

The App and the Website are not directed to children under 13 and you must be at least 13 to use them. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us information, email hello@cowbolt.com and we will delete it.

9. YOUR CHOICES AND RIGHTS

• You can turn push notifications off in the App and in your device settings.
• All users: you can ask us at hello@cowbolt.com to tell you what we hold about you, correct it, or delete it. We do not discriminate against anyone for making a request.
• US state privacy laws (for example California, Colorado, Connecticut, Texas, Virginia): depending on where you live you may have the right to know, access, correct and delete personal information, to receive a portable copy, and to opt out of sale, sharing for targeted advertising and profiling. We do not sell or share personal information for those purposes, so there is nothing to opt out of. In the last 12 months we collected these categories: identifiers (display name, user id, device identifiers, IP address, push token); commercial information (expense, transaction, swap and wallet records); internet and network activity (request logs, and Firebase Analytics on Android); approximate location (country, and approximate city in logs, derived from IP); images and attachments you upload; website-form details (name, email, company, role, message); and sensitive personal information (your account login key and wallet recovery phrase). Sources: you, your device and members of groups you join. We use and keep each as described in Sections 4 and 6 and disclose it to the recipients in Section 5. We use sensitive personal information only to provide and secure the Services. You may appeal a refusal by replying to our decision email; if unresolved you may contact your state attorney general. An authorized agent may submit a request with your written permission.
• European Economic Area, UK and Switzerland: Cowbolt LLC is the controller. Our legal bases are: performing the contract with you (providing the App and your wallet), our legitimate interests (security, fraud prevention, operating and improving the service, usage statistics), compliance with legal obligations, and consent where we ask for it (for example push notifications and iCloud backup, which you can withdraw at any time). You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local data protection authority. Because wallet data is recorded on public blockchains, erasure cannot reach on-chain records. We do not make decisions based solely on automated processing that have legal or similarly significant effects. We have not appointed an EU or UK representative; contact us at the address above for any request.
• The Website does not respond to Do Not Track signals. We do not sell covered information as Nevada law defines it; Nevada residents may send requests to hello@cowbolt.com.

10. WEBSITE

cowbolt.com has two forms. The waitlist form collects your email address, and the contact/join form collects your name, email address, company, role and message. Both are stored in Baserow to contact you about Cowbolt. We do not send marketing email unless you have signed up to hear from us, and you can ask us to remove you at any time. The Website does not run Google Analytics or the Google tag (removed October 2026) and uses no advertising or analytics cookies. Our web host may keep standard server logs (such as IP address and pages requested).

11. INTERNATIONAL TRANSFERS

Cowbolt is operated from the United States. Your data is processed on AWS infrastructure and by the providers in Section 5, which may be located outside your country, including in the United States. Where the law requires a transfer mechanism, we rely on the safeguards our major providers (AWS, Google) offer, including their data-processing terms with standard contractual clauses and their participation in the EU-U.S. Data Privacy Framework where applicable.

12. CHANGES

We may update this Policy. The date at the top changes when we do. For material changes we will give at least 30 days' advance notice in the App or on the Website.

13. CONTACT

Cowbolt LLC, 7901 4th St N #33477, St. Petersburg, FL 33702 · hello@cowbolt.com.