Privacy Policy

About Bag

Bag ("the app", "we", "our") is a free, open-source Bitcoin portfolio monitor for Android, developed by UXAVIA. The app is available on Google Play and via direct download (website, F-Droid, sideload).

Source code is available at github.com/UXAVIA/bag under the GNU General Public License v3.

Data collected by Bag

Bag does not collect any personal information. Specifically:

• No account required. There is no sign-up, login, or user account of any kind.
• Wallet data stays on your device. Your extended public keys (xpubs), addresses, and balances are stored locally in encrypted storage (Android Keystore) and are never transmitted to our servers.
• No analytics or crash reporting. We do not embed any analytics SDKs, advertising SDKs, or crash reporting services.
• No usage tracking. We do not track how you use the app, which features you access, or how often you open it.

Network requests made by the app

Bag connects to the following external services to function. These connections are initiated by the app and carry only the minimum data required:

• Bitcoin nodes / Electrum servers. To fetch wallet balances, the app queries a Bitcoin node or Electrum server (configurable). Your xpub or addresses are sent to the server you choose. By default, Bag uses a public server; for maximum privacy you can point it at your own node.
• Price feeds. To display fiat values, the app fetches Bitcoin exchange rates from a public price API. No personal data is included in these requests.
• Sentinel (optional). If you use the Sentinel watch-only feature, the app contacts the Sentinel API with your configured public keys. This is an opt-in feature.

None of these connections involve our servers collecting or storing your data.

Bag Pro — purchase and licence

Bag Pro unlocks additional features. How the purchase is handled depends on which version of the app you use:

• Google Play. Purchases are processed entirely by Google Play Billing. We do not receive any payment details or personally identifiable information. Google's privacy policy governs data collected during the purchase: policies.google.com/privacy.
• Direct / F-Droid / sideload. Purchases are processed by OpenNode (a Bitcoin payment processor). OpenNode's privacy policy applies to payment data. Our backend receives a payment confirmation and issues a cryptographic licence key. We store only a one-way hash of the licence ID — no email address, name, or payment details are retained by us.

Licence verification happens entirely on-device using a cryptographic signature check. The app does not contact our servers after the initial unlock.

Data we do NOT collect

• Name, email address, or any contact information
• Device identifiers, advertising IDs, or IP addresses
• Location data
• Financial data beyond what is necessary to issue a licence key (direct purchases only)
• Health or biometric data
• Photos, files, or contacts

Children's privacy

Bag is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

Data retention and deletion

Because Bag does not collect personal data, there is nothing for us to retain or delete on our end. All app data is stored on your device and can be removed at any time by uninstalling the app or clearing its data via Android Settings.

For direct purchases, the only data we hold is a hashed licence ID (no personal information). If you wish to have this removed, contact us at the address below.

Open source

Bag is fully open source. You can audit exactly what the app does and what network requests it makes at any time: github.com/UXAVIA/bag.

Changes to this policy

If we make material changes to this privacy policy, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

Contact

If you have questions about this privacy policy or your data, contact us at:

[email protected]