This document was last updated on August 17, 2026

Nova Products Privacy Notice

Last Updated: August 17, 2026

Version: 2.0

Previous Versions: Nova Wallet, Nova Spektr, Polkadot Vault.

  1. This Privacy Notice

Please carefully read this Privacy Notice as it provides you with information about your personal data being processed in connection with your access to and use of the Nova Products. This Privacy Notice explains which types of personal data we hold on you, how we collect and process such data, how long we keep it, and so on. We try to adhere to the principle of data minimisation and design Nova Products to operate without collecting any personal data from you wherever possible.

  1. Interpretation

Unless otherwise provided in this Privacy Notice, capitalised terms used in this Privacy Notice have the meaning determined in the Nova Products Terms of Service (the “Terms”). You should read the Terms carefully as they affect your obligations and legal rights. In this Privacy Notice, “personal data” and “personal information” are synonyms. They refer to any information that identifies or can reasonably identify you, either directly or indirectly.

  1. Contact Details

We, Novasama Technologies PТЕ. Ltd. established under the laws of Singapore, are the data controller for the data collected under this Privacy Notice, meaning we determine how and why your data is processed. If you have any questions about this Privacy Notice or your data processing, please contact us at:

Nova Wallet:[email protected]

Nova Spektr:[email protected]

Polkadot Vault:[email protected]

  1. Type of Data

The categories of personal data collected depend on how you interact with us, use the Nova Products, and the requirements of the applicable laws. We collect and process the following types of personal data:


a. Wallet Data

A Wallet is a set of software tools enabling you to store and manage your Virtual Assets and interact with blockchain-based infrastructure. The Wallet Data available to us includes Wallet addresses, which are public blockchain addresses associated with your Wallet, and related transaction data, which may include transaction ID, amount, status, time and date, and similar information. While a Wallet address alone does not identify a specific individual, when combined with other data (such as a name, nickname, or email address), it may enable identification. As a result, such combined data could be considered personal information. However, we design Nova Products in a way that avoids the need for us to collect your personal data, ensuring that your Wallet Data remains anonymised and non-personal. We encourage you to help maintain this approach, for example, by avoiding linking your Wallet with any personal identifiers.


Note to Android users of Nova Wallet:

Also, to access your Wallet, a seed phrase is used, which is a sequence of words that secures and unlocks your Wallet. As the Nova Products are non-custodial, we never store your seed phrase or have access to it. If you lose it, neither we nor any other person can recover your seed phrase or restore access to your Wallet. In Nova Wallet, you can back up your seed phrase in two ways: (i) manually, by writing it down and securely storing it so that no third party can access it; or (ii) through your device’s storage or cloud storage, such as Google Drive. If you use the Nova Wallet on Android, you may be offered the option to back up your seed phrase to Google Drive. In this case, we never process your personal data stored by Google (email, profile name, and profile picture) in the internal logic of the Nova Wallet, do not receive access to it or store it locally, and use this authorisation solely to enable technical access to the Google Drive API via Google’s built-in mechanisms. While we must technically request access to your Google account email to know to which account a back-up of a seed phrase should be done, we do not process your email, name, or profile picture. This is carried out exclusively through Google’s code libraries, and the data is processed, and controlled solely by Google. Therefore, we cannot link such personal data to your Wallet Data or identify specific individuals using the Nova Wallet. Also, please note that the manual back-up option, where we do not need to initiate access to any personal data, is always available for you.


b. Crash Data

When a crash occurs in Nova Products available as mobile applications in stores (Nova Wallet and Polkadot Vault), certain technical information about that event may be made available to us by application stores (Google Play, Apple App Store). This data is collected and controlled by the respective application store providers, not by us, and is only shared with us in aggregated form necessary to diagnose and fix issues. Both Apple App Store and Google Play collect app crashes data from users who have opted to share their data with that store and developers. You can learn more about how Apple and Google collect and process this data in their respective privacy documentation (Apple, Google).


i. Apple App Store

Crash reports from Apple App Store may contain the following: (i) App Apple Identifier — the unique Apple ID assigned to the app; (ii) App Version — the version of the app in which the crash occurred; (iii) Device — the device on which the event occurred; (iv) Platform Version — the OS version of the device on which the event occurred.


ii. Google Play

It includes crash data from the app. For example, the number of times the app has crashed on the device or other information directly related to a crash.


c. Analytical Data


i. Google Analytics

When you access and use the Nova Websites, certain data may be collected automatically via the Google Analytics, such data include the following: (i) Internet Protocol (IP) address, (ii) the type of device used, (iii) the device operating system, and (iv) the browser used, if any. After collecting the personal data, Google Analytics creates reports about the use of the website, which contain the aggregated information where we do not see any data pertaining to a particular person. In other words, we cannot identify you from the other visitors of the website. In Nova Products itself we never use technologies that enable us to identify or track users.


ii. branch.io

Certain Analytical Data is collected and processed by Branch Metrics, Inc. (https://www.branch.io) integrated with the Nova Wallet. We receive from Branch the aggregated data about the number of clicks (unique and general) on the advertising link, and the platform on which the user uses Nova Wallet (Apple or Android). The data that Branch gathers from users of Nova Wallet includes device IDs, which are unique identifiers assigned to specific devices, usually by the device’s operating system. However, as mentioned above, we only have access to aggregated data, which does not allow for identification of a specific individual. Branch gathers the following types of device IDs: IDFV, android_id, and BFPID.


IDFV is a unique device identifier assigned by Apple. It is a string of alphanumeric characters generated once (usually at device setup) and allows app vendors to track the behaviour of the same user across different apps provided by the same vendor. It helps to analyse user engagement, improve customer satisfaction, and personalise products.


android_id serves a similar purpose for Android. It is generated once but may change after a factory reset. The android_id generation method consists of three elements: app, user, and device. Each new combination of these elements generates another android_id.


BFPID is not only a data but a process: at the time of a click on an advertising link, a snapshot is created. After the Nova Wallet is opened, a similar snapshot is taken and compared with the database of recent clicks on advertising. When a match is found, it means that a particular click caused a successful install. This helps analyse the efficiency of marketing campaigns.


You can discover more about Branch’s data collection practices in their Privacy Policy.


iii. Cloudflare

Any logs of your interactions with the Nova Websites, including IP addresses, traffic routing data, system configuration information, and other information about traffic to and from the Nova Websites.


d. Communication Channels Data

When accessing or participating in our Communication Channels (e.g., X (Twitter)), you may provide personal data such as nicknames, names, photos, messages, comments, and other shared information. Additionally, the operators of the Communication Channels may automatically generate certain anonymised statistical and analytical data regarding the use of the Communication Channels.


Under applicable laws, we may act as a data controller or joint controller of this data. If we are deemed a joint controller, you may exercise your data protection rights with both us and the respective Communication Channel. However, we can only assist with processing operations explicitly covered in this Privacy Notice.


e. Contact Data

This may include name, contact details, social media account handles, and other data, depending on what information you provide to us. Please do not provide personal data unless it is reasonably necessary or requested by us. Note that we may also collect certain other information, which may be required under the applicable laws.

  1. Data Use

Your personal data is processed as follows:


a. Wallet Data

We use the Wallet Data to ensure the Nova Products operation, to enable you to use its functionality, and to improve the Nova Products. The lawful basis for such data processing is the performance of a contract with you, and our legitimate interest to improve the Nova Products. We may also process the Wallet Data if required under the applicable law or if necessary to protect our right or rights of third parties.


b. Crash Data

To diagnose and fix bugs or crashes, or to make future performance improvements. The legal basis for the processing of Crash Data is your consent while you opted in to provide such info to the respective application store provider, and our legitimate interest to fix bugs and improve the Nova Products.


c. Analytical Data


i. Google Analytics

Analytical Data helps us to analyse the use of the Nova Websites and provide a better user experience by improving the Nova Websites user flow and interface. The legal basis for the processing of Analytical Data is your consent with respect to the data collected by Google Analytics.


ii. branch.io

For monitoring the success rate of our marketing campaigns related to Nova Wallet, we use services provided by Branch Metrics, Inc. (https://www.branch.io). They provide us with information showing how successful the advertising is, such as the number of clicks (unique and general) on the advertising link, and the platform on which the user uses Nova Wallet (Apple or Android). We never provide Branch with access to Wallet Data, and we have only limited access to aggregated, non-personal Analytical Data that Branch gathers. Therefore, it is impossible for us to use Analytical Data to identify a specific individual or, by combining Analytical Data with Wallet Data, to infer the financial standing of a specific individual. The lawful basis for such data processing is our legitimate interest to conduct marketing campaigns.


iii. Cloudflare

To ensure security and availability of the Nova Websites, we use services from Cloudflare. To provide these services, Cloudflare processes your interactions with the Nova Websites. Cloudflare does not make available to us any information tied to the IP address of a particular user, but only data in aggregated form. You can find out more about data processing practices of Cloudflare in their Privacy Policy. The lawful basis for such data processing is our legitimate interest to ensure the security and integrity of the Nova Websites.


d. Communication Channels Data

We use the Communication Channels Data (i) to communicate with visitors, participants, and subscribers; (ii) to handle requests and inquiries received via Communication Channels; and (iii) to gather statistical insights on audience reach and engagement. The lawful basis for such data processing is our legitimate interest in achieving the stated purposes. However, beyond the data processing outlined in this Privacy Notice, we have no control over how Communication Channels handle your personal data in connection with your use of their services.


e. Contact Data

To respond to your inquiry. The lawful basis for such data processing is our legitimate interest to respond to your inquiry.

  1. Processing Period

As a general rule, your personal data is kept as long as it is necessary for the purposes it was collected. It may be retained longer if required to meet our legal obligations, in relation to legal proceedings, or to protect our rights and legitimate interests or those of third parties. The default storage periods are as follows:


a. Wallet Data

We retain Wallet Data for as long as your Wallet remains connected to the Products. Once the Wallet is disconnected, we no longer store or process that data. Note that due to the nature of a blockchain, the Wallet Data may be stored permanently on the applicable blockchain, not by us, and may be accessed and viewed by any person at any time. For more details, refer to the ‘Features of Blockchain Data Processing’ section of this Privacy Notice below.


b. Crash Data

For 56 days for Google Play, and for a certain unspecified period for Apple App Store. Apple App Store states that data is available beginning from January 1, 2024. These retention periods are set by the applicable store providers and not by us. Store providers may decide to change these retention periods.


c. Analytical Data


i. Google Analytics

We process Analytical Data for up to two (2) years. This retention period depends on the provider of analytical solutions.


ii. branch.io

Branch processes Analytical Data for as long as we use their services or until we ask them to stop such processing.


iii. Cloudflare

Cloudflare processes Analytical Data until we stop using their services or until the data is no longer needed to analyse and improve their services.


d. Communication Channels Data

We do not set retention periods for statistical and analytical data, as it does not allow for the identification of any individual. Any other data is stored as long as it is not deleted by either you or the respective operator of the Communication Channel.


e. Contact Data

For six (6) years from the last date when you contacted us regarding the same matter. We set this retention period due to the statutes of limitations under applicable law.

  1. Data Sharing

a. General

We do not sell or rent out your data. We may share it in line with this Privacy Notice, applicable laws, the Terms, or with your consent. Appropriate measures will be taken to protect your data during such transfers.


b. Recipients

Given the purposes outlined above, your personal information is shared with the following categories of recipients: (i) Affiliates; (ii) marketing, support, and technical teams; (iii) social networks and users of such social networks; (iv) analytical solution providers; (v) hosting service providers; (vi) government authorities, upon their request or if necessary to comply with our legal obligations; (vii) another entity if we sell or otherwise transfer the Nova Products or a part of them; and (viii) operators of the Third-Party Services integrated with the Nova Products.


c. Third-Party Services

The Nova Products may include integrations with, or otherwise enable access to, the Third-Party Services. We do not control or endorse these Third-Party Services and are not responsible for their privacy practices. You should review the privacy policies of any Third-Party Services, external websites or apps you visit. In some cases, the Nova Products include integrations or features that rely on Third-Party Services that collect more information than described in this Privacy Notice, such as a fiat debit card or swap functionality available within the Nova Wallet. This implies that we do not process, collect, access, transmit, receive, or store any personal data related to such Third-Party Services. Instead, the Third-Party Service provider collects this data directly from you and acts as the sole data controller in respect of that processing. We are neither a processor nor a joint controller for identity verification data processing activities.


Note with respect to the fiat debit card available within the Nova Wallet:

The Third-Party Service provider offering the debit card requires the user’s IP address from our side to verify that it is the same user. To reduce risks associated with transfers even of IP addresses, we have designed this integration in a way that avoids direct data exchange. Instead of sharing the IP address, we generate and share with that Third-Party Service provider only a hashed version of your IP address, not an IP address itself. A hash is a one-way cryptographic encryption of data, which cannot be reversed to reveal the original information. A hash has a certain value that will always be different if initial input data differs. That Third-Party Service additionally and separately hashes the IP address they observe from your connection and compares the two values locally. If the hashes match, they can verify the user is the same without your actual IP address being transferred through transnational networks.

  1. Features of Blockchain Data Processing

Certain data, such as wallet address and relevant blockchain transactions, may interact with public and decentralised blockchains that work autonomously. “Decentralised” means no one controls or operates the blockchain. “Public” means anyone can access blockchain data, and this access cannot be restricted. By design, blockchain records are permanent and cannot be changed or deleted. Transactions are also irreversible, which may limit your ability to exercise certain data protection rights. Since information that was entered in a blockchain becomes publicly available, we cannot control or manage access to it. The decision to use blockchain or carry out any transactions is entirely up to you.

  1. Automated Decision-Making

Automated decision-making is the process of making a decision by automated means without any human influence on the outcomes. We do not make any automated decisions based on your personal data. If we intend to process your personal data by any automated means, we will do our best to inform you about the same prior to such processing.

  1. Data Subject Rights

a. Verification

In case you wish to exercise your data subject rights, we may request certain information from you to verify your identity and confirm that you are entitled to exercise such rights.


b. Blockchain Data Processing

Please note that when interacting with blockchain networks, you may not be able to fully exercise certain rights under applicable data protection laws regarding your blockchain transactions. For example, we may be unable to delete, correct, or restrict your data available on a public blockchain, such as wallet address and processed transactions. For more details, refer to the ‘Features of Blockchain Data Processing’ section of this Privacy Notice.


c. Data Subject Rights

According to the applicable legislation, you have the following rights. Please note that depending on the applicable legislation you may have more rights than listed below.


i. Right to Access

You can request to see if we process your personal data. If we do, you can ask for details about the processing, a copy of the data to verify its accuracy and legality, and information about the ways in which such personal data has been or may have been used or disclosed.


ii. Right to Correction

You can request to correct or complete any incomplete or inaccurate data. We may need to verify the accuracy of the new information you provide.


iii. Right to Deletion

You can request the deletion of your personal data if we no longer need it, we processed it unlawfully, or we must erase it to comply with the law. We may not always be able to fulfil your request due to legal or technical reasons, which will be explained in our response.


iv. Right to Withdraw Consent

You can withdraw your consent at any time, giving us a notice reasonably in advance, if we are processing your data based on your consent.


v. Right to File a Complaint

You can file a complaint with a supervisory authority if we violate your rights or legal obligations. The competent authority may depend on your location. For Singapore it is the Personal Data Protection Commission.


vi. Right of Private Action

If you have suffered a loss or damage because we have breached the Singapore Personal Data Protection Act, you may take legal action in court to seek compensation or other relief.

11. Personal Data of Children

The Nova Products are not intended for children under 18 years (or older if local laws set a higher age). We do not knowingly collect or use personal data from children. If we learn that a child has provided us with personal information, it will be promptly deleted. Parents or guardians who believe their child’s data has been collected should contact us.

12. Modifications and Updates

This Privacy Notice is under regular review, and may be updated at any time. If any changes to this document are made, we will change the “Last Updated” date and version number at the top of this Privacy Notice. Please review this Privacy Notice to check for the updates.

This document was last updated on August 17, 2026