Privacy policy
BT LABS LTD (“BT Labs”, “we”) makes Epic Cash Mobile (Android, iOS) and Epic Cash Desktop (Windows, macOS, Linux), open-source wallets for the Epic Cash cryptocurrency. This page says what the apps send over the network, who receives it, what we keep and for how long. It covers every version from 26.10.20 on; where a version changes something, it says so.
Summary
- There are no accounts. You don't give us your name, email or phone number.
- Your recovery phrase, keys, balance and transaction history stay on your device. We never receive them.
- The apps contain no advertising, no analytics and no tracking. We sell no data.
- To work, a wallet talks to public servers: nodes and Epicbox servers. Some are run by us, many by others. Unless Tor is on, each server sees your IP address.
- We only receive personal data you give us yourself, in a problem report.
Wallet and keys
The wallet is non-custodial. The recovery phrase and keys are made on your device and stored encrypted there. We can't see, move or recover your funds. If you lose the device and the phrase, nobody can restore the wallet.
Servers the apps use
The app comes with a list of public servers. You can pick others from the list or add your own in Settings.
- Epic Cash node: reads the blockchain and posts your transactions. The node sees which outputs your wallet asks about and the transactions it posts. Mimblewimble transactions carry no amounts and no addresses. The default is a public node: node.btlabs.uk (run by us) in versions up to 26.10.23, node.epiccash.com from the release after 26.10.23. The list also has nodes run by BT Labs, EpicNet and Cypher Stack.
- Epicbox server: carries payment messages between wallets. It sees your Epicbox address (a public key), the address of the wallet you pay or are paid by, and when and how big each message is. The message itself is encrypted for the recipient. The default is epicbox.epiccash.com; epicbox.btlabs.uk (run by us) and others are listed.
- Direct payments (HTTP or Tor address): if you pay or are paid at an HTTP or onion address, the payment goes straight to that wallet, which sees your IP address unless Tor is on.
- Tor: when Tor is on, the apps reach these servers through the Tor network, which hides your IP address from them. Our own servers are reached at their onion addresses.
Servers we don't run
Nodes, Epicbox servers and other relays run by others are outside our control. They may keep logs of IP addresses, Epicbox addresses and message times, under their own policies, and we can't see or change what they keep. If that matters to you, turn Tor on, or choose servers you trust or run yourself.
Other connections
- Prices: to show a value in your currency, the app asks CoinGecko (api.coingecko.com) for the Epic Cash price, or our copy of it on status.btlabs.uk. Only the currency is sent.
- Server status: the app reads status.btlabs.uk to show whether listed servers are up.
- Updates: copies installed from our website check for new versions in a signed file on our server (epiccash.btlabs.uk) or its mirrors on GitLab (gitlab.com) and GitHub (github.com, attached to our latest release), and download the update from our server. Versions from Google Play, the App Store or F-Droid update through that store.
- Our signed file: the app reads a signed file on GitLab (gitlab.com) with our donation address and server details.
- Desktop, receiving over HTTP: if you receive payments directly over HTTP, the desktop app checks your public IP address and whether its port can be reached from outside. From the release after 26.10.23 it asks our status server (status.btlabs.uk), and no third party is involved. Versions up to 26.10.23 ask ipify.org for the IP and portchecker.io for the port check.
- Block explorer: if you tap a block or transaction link, your browser opens explorer.epiccash.com. Nothing is sent until you tap it.
QR scanner
The camera is used only while you scan a code. Pictures stay on the device and are never sent.
From the release after 26.10.23, every Android version (Google Play, our website and F-Droid) uses an open-source scanner (zxing-cpp) with no Google components, and nothing about scanning is sent anywhere. Until then, the Android versions from Google Play and our website (26.10.23 and earlier) use Google ML Kit to read codes. ML Kit runs on the device, but sends Google technical data about its own use: device model and Android version, app version, performance figures, error codes and a per-installation identifier. The F-Droid version has the open-source scanner in every version. On iPhone and iPad the scanner works on the device and sends nothing.
Linked devices
You can link your own devices that share one wallet, so they don't spend the same coins at the same time. Linked devices send each other short notices: which coins one device has set aside or released, and which transactions it made. The notices go through Epicbox servers (the first two in your Epicbox list) and are encrypted end to end with keys only your devices hold. The servers see only the devices' link keys, the time and the size of each notice. Your phrase and keys are never sent.
Problem reports
If you choose “Send feedback” or “Report a problem”, the app shows you the full report before it's sent. It contains your message, the app version, platform and network, the host names of your node and Epicbox server, and, unless you turn it off, the newest part of the app log. Recovery phrases, PINs, keys, addresses, balances and transactions are removed first. You may add an email address if you want a reply. The report is encrypted on your device so only we can read it, and goes to our server support.btlabs.uk.
We use reports only to answer you and fix problems. The server deletes each report automatically after 30 days. Copies we take to work on a problem are deleted when it's solved. To have a report deleted sooner, write to support@btlabs.uk and say roughly when you sent it, so we can find it.
What our servers keep
We run node.btlabs.uk, epicbox.btlabs.uk, status.btlabs.uk, epiccash.btlabs.uk and support.btlabs.uk on a server in the EU. They keep:
- Web access logs (node, Epicbox server, update and download files, this website): IP address, time, request, response and the app or browser name. They are used only to keep the service running and stop abuse, are never linked to a wallet, and are deleted after 14 days.
- Status and price API: logged without IP address or app name.
- Problem reports: no access log; the report service stores no IP address. Reports are deleted after 30 days.
- Epicbox messages: kept, encrypted, only until the recipient collects them, and deleted after 7 days at most.
- Download counts: a private counter reads the download logs and keeps daily totals only, with no IP addresses or per-person records.
Connections over Tor to our onion addresses reach us without your IP address.
Sharing
We don't sell or share personal data, and we don't use it for advertising. We hand data over only if the law requires it. The servers listed above receive what is described here because the app has to talk to them to work.
Legal basis
We keep short-lived server logs under our legitimate interest in running secure services. We process a problem report because you choose to send it to us.
Children
The apps are for adults (18+) and are not directed at children. We don't knowingly collect data from children.
Your rights
Under UK GDPR you can ask to see, correct or delete personal data we hold about you, or object to its use. In practice this can only be a problem report or a server log line. Write to support@btlabs.uk. If you're unhappy with our answer, you can complain to the Information Commissioner's Office (ico.org.uk).
Changes
If this policy changes, the new version appears on this page with a new date. Where a change depends on the app version, this page says which versions it applies to.
Who we are
The data controller is BT LABS LTD, a company registered in Scotland (SC881480), Office 1 Technology House, 9 Newton Place, Glasgow, G3 7PR, United Kingdom. Email: support@btlabs.uk.