Privacy Policy

When you create an account and sign in we collect your account address and, depending on the method you use, your email address and the basic profile details provided by your chosen identity provider, such as your name or picture. You may voluntarily add a username and additional contact details.

When you register a recipient for a cash withdrawal we collect the details needed to locate them and hand over the money: their name, identity document, phone number, locality and address. If you choose hand delivery, also the location of the delivery point; if you choose a transfer, the destination card details.

For each operation we keep the amounts, the fees applied, the delivery method and its status, along with references to transactions recorded on blockchains, which are public by their very nature.

As you browse the site, our hosting provider automatically logs technical data such as IP address, browser type and operating system, for security and usage measurement purposes.

We neither request nor keep identity documents from the sender: the service does not currently require sender identity verification.

When you provide personal data to complete an operation, register a recipient or handle a refund, we understand that you consent to its processing solely for that specific purpose.

If at any point we needed to process your data for a different purpose, we would ask you expressly and you could decline without that affecting your use of the service.

You may withdraw your consent at any time by writing to info@tropycash.com. Note that certain processing is essential to providing the service, so withdrawing it may mean you can no longer use it.

We use the data to authenticate you, execute and track the operations you request, make delivery possible at the destination, respond to your enquiries, prevent fraud and misuse, and maintain and improve how the service works.

We do not sell or transfer personal data for advertising purposes, and we do not send marketing communications.

We may disclose your personal data when a law or a competent authority requires us to, or when it is necessary to investigate a breach of our terms of use or fraudulent use of the service.

To provide the service we rely on external providers, which process data only to the extent needed to perform their role:

Some of our providers may operate in jurisdictions other than yours, so your data could be subject to different regulations.

The site contains links to third-party services, such as blockchain explorers. Following them takes you off our site and this policy no longer applies: we are not responsible for the privacy practices of those services, whose policies we recommend you review.

Data is kept in a managed database that only our server can reach. Your browser never connects to it directly: external access is revoked and all connections are encrypted.

Your two-step verification secret is stored encrypted. The rest of the data is protected through access control and our infrastructure provider's encryption at rest, rather than by encrypting each field individually. We state this precisely because the difference matters.

Your recovery phrases never reach our servers at any point. They are generated and used in isolation within your own browser and removed from memory once each operation ends.

No system is completely secure. We apply recognized security practices, but we cannot absolutely guarantee protection against every unauthorized access.

We use cookies and browser local storage so that the service works: keeping you signed in, remembering your preferences — such as language or currency — and retaining the settings of the tools we integrate. We do not use advertising or cross-site tracking cookies.

Your browser also stores data that avoids repeating work on every visit, such as the emails you have used to sign in or your account's addresses and public keys. Private keys are never stored.

Some of the third-party tools we integrate also store their own information in your browser, subject to their respective policies.

You can delete all of the above at any time from your browser settings. Doing so will sign you out and clear your saved preferences, without affecting your funds.

We keep your account data, the recipients you register and your operations for as long as the account exists, since the history must be able to reflect who each transfer was sent to. Ancillary technical records are deleted periodically.

When you delete a recipient it stops appearing in the application, though its record is kept so that completed operations still reflect their destination. If you want it effectively erased, request it by email.

You may request access to your data, its correction or its deletion, as well as raise a complaint, by writing to info@tropycash.com from the address linked to your account. These requests are handled manually, as soon as we are able to.

Two limits are beyond our control: information recorded on a blockchain is public and permanent, so it cannot be deleted, and we may need to retain records of operations already executed.

The service is not directed at minors. By using it you declare that you are of legal age in your place of residence. If we find that we have collected data from a minor without the appropriate authorization, we will delete it.

We reserve the right to amend this policy at any time. Changes take effect once published and the date of the latest revision appears at the top of the document. When a change is material, we will notify it inside the application.

For any question about this policy, write to us at info@tropycash.com.