Last updated: 7 October 2026
This policy explains what personal data Solidus uses, why we use it, who else sees it and the rights you have over it. We have tried to keep it plain and short.
Who we are
Solidus is provided by Usque Ltd, a company registered in England and Wales with company number 15314252. Our registered office is 97 Alderley Road, Wilmslow, Cheshire, England, SK9 1PT. Usque Ltd is the data controller for the personal data described in this policy.
You can contact us about anything in this policy at support@novawallet.co.uk or by post at our registered office.
What this policy covers
- the Solidus apps for iPhone and Android
- the Solidus web wallet at vsolidus.co.uk/wallet
- the websites novawallet.co.uk and vsolidus.co.uk
- the classic web wallet at wallet.novawallet.co.uk, formerly called Nova Web Wallet, which is being retired
Solidus replaces Nova Wallet.
Your recovery phrase stays with you
Solidus is a non-custodial wallet. Your recovery phrases and private keys are created on your device and kept there. They are never sent to our server.
- On iPhone they are kept in the iOS Keychain, set to this device only.
- On Android they are kept in secure storage backed by the Android Keystore.
- In the web wallet they are kept in your browser’s storage, encrypted under a password you choose (using PBKDF2 and AES-GCM).
Because we never hold your recovery phrase, we cannot recover it if you lose it. We also cannot reverse a transaction or freeze funds.
The classic web wallet works differently
The classic web wallet at wallet.novawallet.co.uk is an older service and does not work in the way described above. It stores your email address and a hash of your password. To show your balances and to sign your transactions, your recovery phrase is handled on our server for each request. It runs on the same UK server as our account service.
This is the main reason we are retiring the classic web wallet. We ask everyone who uses it to move to the new Solidus apps or web wallet, where the recovery phrase never leaves your device.
Your Solidus account
You sign in to Solidus with an email address and password, with Google, with Sign in with Apple (in the apps only) or with Confrmo. Our account server stores:
- an account id, for every account
- if you sign in with email: your full name, your email address and a scrypt hash of your password (never the password itself)
- if you sign in with Google: your Google account id
- if you sign in with Apple: your Apple user id and, if Apple shares them with us, an email address (which may be a private relay address) and the name you gave when you first signed in
- if you sign in with Confrmo: a pseudonymous Confrmo handle and an email address only if you choose to share it in Confrmo
When you sign in we issue a signed sign-in token, which lasts 30 days.
Google, Apple and Confrmo (Confrmo Ltd) act under their own privacy policies when you use them to sign in.
Verified addresses (optional)
You can choose to prove that a crypto address belongs to a verified person. You do this with the Confrmo app, which carries out a passport check under its own privacy policy. If you do, we store:
- the network and the address
- your account id
- your Confrmo handle
- the date Confrmo checked you
- the date the address was verified
Anyone can look up whether an address is verified. The lookup shows only that it is verified and the dates. It never shows who you are. You can remove a verified address at any time in the app.
Blockchain data services
To show your balances and history and to send coins, Solidus sends your public addresses and account public keys (known as xpubs) to blockchain data services. These are public information, not your recovery phrase or private keys. The services are:
- our own explorers at ex1.solidusexplorer.net, ex2.veridiumcarbon.com and ex3.solidusexplorer.net (in the web wallet, these requests go through our account server)
- Trezor’s public Blockbook servers, for Bitcoin
- Atomic Wallet’s public server, for Dogecoin
- public JSON-RPC nodes for Ethereum and BNB Chain, run by publicnode.com, Cloudflare and Binance
- TronGrid and publicnode, for Tron
- Blockscout, for Ethereum history
These services see the IP address the request comes from.
When you send coins, the transaction is broadcast to a public blockchain. Blockchains are public and permanent. Nobody, including us, can change or delete a record once it is on a blockchain.
Prices
Prices come from LATOKEN’s public API, requested directly by the app or web wallet. LATOKEN sees the request and its IP address and nothing else about you.
Buying crypto
If you choose to buy crypto in Solidus, you do it through Transak, a third-party provider. To start a checkout we pass Transak the coin you want and your receiving address. Transak carries out its own identity checks and payment processing under its own privacy policy. We never see your card details.
Our websites
novawallet.co.uk, vsolidus.co.uk and the web wallet files are hosted by SiteGround (SiteGround Hosting Ltd). The websites run on WordPress. We do not add advertising or analytics trackers. WordPress may set cookies that the sites need to work.
The web wallet uses your browser’s storage to keep your encrypted recovery phrases, your choice of light or dark look and whether you are signed in.
Server logs and security
Our account server is in the UK, hosted by UKFast (ANS) in Manchester. Its access logs record the time, the request method, the path and the IP address of each request. They do not record query strings. In the web wallet, balance and history requests for VSolidus, Veridium, Bitcoin and Dogecoin pass through this server, and the path of those requests contains the public address or account public key being looked up, so these logs can hold public addresses for that time. We keep these logs for 14 days.
To protect the service from abuse we limit how often requests can be made. To do this we hold IP addresses in memory for a short time.
Why we use your data (lawful bases)
- Contract: to run your account and your wallet, which is the service you asked for.
- Consent: for verified addresses, which are optional. You can withdraw consent at any time by removing the address in the app.
- Legitimate interests: to keep the service secure, including rate limiting and server logs.
What we do not do
- We do not sell your personal data.
- We do not show advertising.
- We do not profile you.
How long we keep data
- Account data is kept until you delete your account.
- When you delete your account, the account, its sign-ins and its verified addresses are removed from our server straight away.
- Server access logs are kept for 14 days.
- When we update the account server we keep a copy of the account file on the same server in case the update has to be undone. Those copies are deleted after 30 days, so a deleted account can remain in one for up to 30 days.
- Records on a blockchain are permanent and cannot be deleted by anyone.
To delete your account, open Account in the app or web wallet, then Delete account. See our delete account page for full details.
Transfers outside the UK
Our account server is in the UK. Google, Apple and Transak may process your data outside the UK when you use them. They do so under their own safeguards, which are set out in their own privacy policies.
Your rights
Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data erased
- restrict how we use your data
- object to how we use your data
- receive your data in a portable form
- withdraw consent where we rely on it
To use any of these rights, email support@novawallet.co.uk. We will respond within one month.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk.
Children
Solidus is not for people under 18.
Changes to this policy
If we change this policy we will update it on this page and change the date at the top.