Privacy Policy

1. Introduction

This Privacy Policy ("Privacy Policy") explains how XWHALE TECHNOLOGY SDN. BHD. (Registration No. 202601002128 (1664225-A)) ("XWHALE", "NOXCAT", "we", "us", or "our") collects, uses, stores, processes, discloses, transfers, and protects information when you access or use NOXCAT Wallet, our websites, mobile applications, software, products, features, and related services (collectively, the "Services").

NOXCAT Wallet is designed as a secure self-custodial wallet for everyday finance. The Services may include wallet creation, account login, encrypted key backup, digital asset management, swaps through third-party decentralized exchange aggregators, friend-to-friend encrypted messaging, membership and rewards management, security tools, and other related features.

This Privacy Policy applies to:

NOXCAT Wallet mobile applications
NOXCAT Wallet websites
NOXCAT-related software and services
Customer support interactions
Any other product, service, or feature that links to this Privacy Policy

This Privacy Policy does not apply to third-party websites, decentralized applications, blockchain networks, decentralized exchanges, wallet connection services, membership providers, reward issuers, or other third-party services that you may access through or in connection with NOXCAT. Such third parties are responsible for their own privacy practices.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you should not access or use the Services.

2. Company Information

NOXCAT Wallet is operated by:

XWHALE TECHNOLOGY SDN. BHD. Registration No. 202601002128 (1664225-A) A company incorporated in Malaysia under the Companies Act 2016.

Registered Office:

612, Jalan Haruan 4/8, Oakland Commercial Centre, 70300 Seremban, Negeri Sembilan, Malaysia

Business Address:

F-12-03, Pusat Perdagangan Bandar Bukit Jalil, Persiaran Jalil 1, 57000 Kuala Lumpur, Malaysia

Websites:

Support Contact: support@noxcat.io

3. Information We Collect

We collect information only where reasonably necessary to provide, maintain, secure, improve, and comply with legal obligations relating to the Services. The types of information we collect may vary depending on how you use NOXCAT Wallet.

3.1 Account Information

When you create or access a NOXCAT account, we may collect and process:

Email address
Google account login information
Apple ID login information
Authentication information received from third-party login providers
Unique user identifier assigned by NOXCAT
Account creation time
Account status
Account preferences
Security settings
Login history
Account recovery settings

We use this information to create and maintain your account, authenticate your access, prevent unauthorized access, support account recovery, provide customer support, and maintain service security.

3.2 Wallet Information

When you create, import, connect, or use a wallet through NOXCAT, we may collect and process limited wallet-related information, including:

Public wallet addresses
Supported blockchain networks
Wallet configuration settings
Token display preferences
Public blockchain transaction metadata
Network interaction data
Wallet connection records
Transaction status information
Gas fee estimates and related transaction information

Blockchain data is generally public. Transactions, wallet addresses, smart contract interactions, token balances, and other blockchain activity may be publicly visible on the relevant blockchain network and through third-party blockchain explorers.

NOXCAT does not control public blockchain networks and cannot delete, modify, conceal, or reverse information recorded on a blockchain.

3.3 Encrypted Backup Information

NOXCAT may provide optional encrypted backup services.

If you enable encrypted backup, the following may be processed:

Encrypted private key backup data
Encrypted seed phrase or recovery phrase backup data
Backup status
Backup timestamp
Backup recovery configuration
Backup version information
Account identifier associated with the encrypted backup

Private keys and seed phrases are encrypted before being stored. XWHALE does not possess the decryption keys necessary to decrypt your encrypted private keys, seed phrases, or recovery data.

XWHALE cannot view, access, recover, or decrypt your private keys or seed phrases.

3.4 Device Information

When you access or use the Services, we may collect:

Device type
Device model
Operating system
App version
Browser type
Language settings
Region settings
IP address
Device identifiers
Push notification token
Mobile network information
Log data
Crash logs
Diagnostic information

This information helps us operate the Services, troubleshoot issues, prevent abuse, improve performance, and maintain security.

3.5 Usage Information

We may collect information about how you interact with the Services, including:

Features used
Screens viewed
Session activity
Interaction events
Error reports
Crash reports
Performance data
App activity data
User preferences
Service usage patterns

We use this information to improve product functionality, understand feature usage, diagnose technical issues, prevent fraud, and enhance user experience.

3.6 Customer Support Information

When you contact us for support, we may collect:

Name or contact details you provide
Email address
Support request content
Technical issue description
Screenshots or files you voluntarily provide
Wallet address if voluntarily provided
Device information related to the issue
Communications between you and our support team

We use this information to respond to your request, investigate issues, improve our Services, and maintain service quality.

We will never ask you for your private key, seed phrase, recovery phrase, wallet password, or decrypted backup contents.

3.7 Messaging Metadata

NOXCAT may provide friend-to-friend encrypted messaging functionality.

NOXCAT does not store message contents on its servers.

However, to operate encrypted messaging, we may process limited metadata, including:

Sender identifier
Recipient identifier
Message delivery status
Message timestamp
Contact relationship status
Message routing information
Technical delivery logs

Such metadata is used solely to enable message delivery, maintain service reliability, prevent abuse, and protect the integrity of the messaging service.

3.8 Membership and Rewards Information

NOXCAT may allow users to view, organize, or interact with memberships, loyalty programs, rewards, points, benefits, or brand-related accounts.

Depending on how a membership or rewards feature is implemented, we may process:

Membership display information
Loyalty program identifiers
Reward balance information
Membership status
Brand partner identifiers
User-authorized membership data
Reward synchronization status
Benefit eligibility information

NOXCAT currently intends to act as an interface or management layer for third-party membership and rewards programs. We do not necessarily issue, control, guarantee, or redeem third-party rewards unless expressly stated.

3.9 Security Feature Information

To support account protection and security features, NOXCAT may process information related to:

Security preferences
Trusted device settings
Recovery configurations
Emergency security configurations
Login protection settings
Suspicious activity signals
Risk flags
Security alert history
Account protection status

NOXCAT may provide optional security features, including features designed to help protect users from unauthorized access, theft, coercion, fraud, or other security threats.

Such features are provided on a best-effort basis and do not guarantee protection against all forms of loss, theft, coercion, malware, fraud, unauthorized access, phishing, or social engineering.

NOXCAT may provide swap functionality through third-party decentralized exchange aggregators, decentralized exchanges, smart contracts, liquidity providers, or other third-party infrastructure.

When you use swap-related features, we may process:

Public wallet address
Token pair selected
Network selected
Estimated price
Estimated gas fees
Slippage settings
Transaction status
Transaction hash
Public blockchain confirmation data
Interaction metadata with third-party providers

NOXCAT does not act as a centralized exchange or custodian. Swap transactions are executed through third-party protocols, smart contracts, or liquidity sources.

3.11 Future Real-World Asset Information

NOXCAT may in the future support tokenized representations of real-world assets, including but not limited to precious metals, commodities, equities, funds, or other financial products.

If such services become available, additional information may be collected depending on regulatory requirements, product structure, third-party provider requirements, and applicable laws.

Such information may include eligibility information, jurisdictional information, compliance information, or other data required to provide access to such services.

Additional privacy notices, disclosures, or terms may apply.

4. Information We Do Not Collect

NOXCAT is designed around privacy and self-custody principles.

Unless expressly stated otherwise, we do not collect or store:

Private keys in plaintext
Seed phrases in plaintext
Recovery phrases in plaintext
Decrypted encrypted backup contents
End-to-end encrypted message contents
Government-issued identification documents
Financial account login credentials
Bank account passwords
Biometric identifiers controlled by your device
Full payment card details
Unencrypted wallet recovery credentials

NOXCAT cannot decrypt your encrypted wallet backup if you lose the required decryption credentials.

NOXCAT cannot access, read, or recover end-to-end encrypted message contents.

NOXCAT cannot reverse, modify, or delete public blockchain transactions.

5. Self-Custody Wallet Disclosure

NOXCAT Wallet is a self-custodial wallet.

This means you are responsible for controlling and safeguarding the cryptographic credentials that provide access to your digital assets.

NOXCAT does not:

Hold customer digital assets
Control user wallets
Authorize transactions on your behalf
Custody your assets
Guarantee recovery of lost wallets
Reverse blockchain transactions
Freeze or restore blockchain assets
Control blockchain networks
Control third-party smart contracts

You are solely responsible for:

Keeping your account secure
Protecting your device
Protecting login credentials
Maintaining recovery access
Reviewing transactions before signing
Verifying recipient addresses
Understanding the risks of blockchain transactions

If you lose access to your wallet, encrypted backup, recovery credentials, account, or device, you may permanently lose access to your digital assets.

6. Encrypted Backup Services

NOXCAT may provide optional encrypted backup services for private keys, seed phrases, or wallet recovery data.

When enabled, encrypted backups may be stored on infrastructure operated or controlled by XWHALE or its service providers.

6.1 Encryption Before Storage

Private keys and seed phrases are encrypted before being stored.

XWHALE does not possess the decryption keys necessary to access, view, recover, or decrypt encrypted wallet backup data.

6.2 User Responsibility

You are solely responsible for maintaining the credentials, passwords, devices, authentication methods, or other materials required to decrypt and recover your encrypted backup.

If you lose access to the required decryption credentials, XWHALE may be technically unable to help you recover your wallet.

6.3 Backup Availability

Encrypted backup services are provided as a convenience feature.

NOXCAT does not guarantee that encrypted backups will always be available, error-free, uninterrupted, or recoverable.

Backup failures may occur due to:

User error
Device loss
Forgotten credentials
Network interruption
Software bugs
Service outage
Account compromise
Unauthorized access
Data corruption
Force majeure events

XWHALE is not responsible for any loss arising from your failure to maintain access to your backup credentials or recovery methods.

7. Messaging Services

NOXCAT may provide encrypted messaging functionality between approved contacts or friends.

7.1 End-to-End Encryption

Messages are protected using end-to-end encryption.

NOXCAT does not store message contents on its servers.

NOXCAT cannot access, read, decrypt, recover, monitor, or disclose message contents.

7.2 Message Metadata

To operate the messaging service, we may process limited metadata, such as:

Sender identifier
Recipient identifier
Delivery status
Message timestamp
Contact status
Technical routing information

This metadata is used to deliver messages, maintain service reliability, prevent abuse, and secure the messaging system.

7.3 User Responsibility for Messages

Although NOXCAT cannot access message contents, users remain responsible for the content they send.

You should not use NOXCAT messaging to send unlawful, fraudulent, abusive, harmful, infringing, harassing, threatening, deceptive, or malicious content.

7.4 Legal Requests

Because NOXCAT does not store message contents, we may be unable to provide message contents in response to legal or regulatory requests.

Where legally required, we may provide limited account information or metadata that we possess.

8. Security Features

NOXCAT may provide optional security features designed to help protect users, accounts, wallets, and assets.

Such features may include account protection, trusted device management, recovery settings, suspicious activity alerts, emergency protection settings, or other safety tools.

Security features are intended to reduce risk, but they cannot eliminate all risks.

NOXCAT does not guarantee protection against:

Theft
Coercion
Phishing
Malware
Device compromise
Social engineering
Unauthorized access
Loss of credentials
Smart contract exploits
Blockchain protocol failures

Users remain responsible for using security features properly and maintaining their own device and account security.

9. Memberships and Rewards

NOXCAT may allow users to view, manage, organize, or interact with memberships, loyalty programs, points, rewards, benefits, and brand-related services.

Memberships, loyalty points, rewards, benefits, and related information displayed through NOXCAT may be provided by third-party organizations.

NOXCAT does not necessarily:

Issue loyalty points
Determine redemption values
Guarantee reward availability
Control third-party membership programs
Control expiration rules
Guarantee benefit eligibility
Guarantee continued availability of any program

Any disputes relating to third-party memberships, rewards, loyalty points, benefits, or redemption must be resolved directly with the applicable provider.

10. Future Real-World Asset Services

NOXCAT may in the future support access to tokenized representations of real-world assets ("RWA"), including but not limited to:

Precious metals
Gold
Commodities
Equities
Funds
Financial instruments
Other tokenized assets

Availability of RWA-related services may vary by jurisdiction and may be subject to additional terms, eligibility requirements, disclosures, compliance checks, and regulatory restrictions.

Where required, NOXCAT or third-party providers may request additional information before enabling access to such services.

This Privacy Policy may be supplemented by additional product-specific privacy notices if RWA services are launched.

11. How We Use Information

We may use information for the following purposes:

11.1 Providing the Services

Create and manage accounts
Authenticate users
Provide wallet functionality
Enable wallet backup
Enable wallet recovery
Display wallet balances
Display transaction status
Provide messaging functionality
Provide membership and rewards functionality
Provide swap interface functionality
Provide customer support

11.2 Security and Fraud Prevention

Detect suspicious activity
Prevent unauthorized access
Protect user accounts
Prevent fraud
Investigate abuse
Enforce security policies
Protect the integrity of the Services
Comply with sanctions restrictions

11.3 Service Improvement

Analyze feature usage
Improve app performance
Diagnose errors
Fix bugs
Improve user experience
Develop new features
Conduct internal research

11.4 Communications

Send service notices
Send security alerts
Send account notifications
Respond to support requests
Notify users of policy updates
Provide operational messages

11.5 Legal and Compliance

Comply with applicable laws
Respond to lawful requests
Enforce our Terms of Use
Protect legal rights
Prevent prohibited activity
Maintain business records

We do not use end-to-end encrypted message contents for analytics, advertising, or personalization because we cannot access such contents.

12. Cookies, Analytics, and Similar Technologies

We may use cookies, software development kits, analytics tools, crash reporting tools, log files, and similar technologies to operate and improve the Services.

These tools may collect:

Device information
App usage information
Performance information
Crash data
Diagnostic data
Session information
Technical identifiers

We may use third-party analytics or infrastructure providers to help us understand how users interact with the Services and to improve reliability, security, and user experience.

We do not use such tools to access private keys, seed phrases, decrypted wallet backups, or encrypted message contents.

Depending on your device settings and applicable law, you may be able to limit certain analytics or tracking technologies through operating system settings, browser settings, or app permissions.

13. Third-Party Services

The Services may allow you to access, connect to, or interact with third-party services, including:

Blockchain networks
RPC providers
Wallet connection services
Swap aggregators
Decentralized exchanges
Smart contracts
Decentralized applications
Token issuers
Membership providers
Rewards providers
Analytics providers
Cloud infrastructure providers
Customer support tools

Third-party services are not controlled by NOXCAT.

Your use of third-party services may be subject to separate terms of use, privacy policies, fees, risks, and disclosures.

NOXCAT is not responsible for:

Third-party privacy practices
Third-party security practices
Third-party service availability
Third-party content
Third-party transaction execution
Third-party fees
Third-party errors
Third-party losses
Third-party compliance obligations

You should carefully review the privacy policies and terms of any third-party service before using it.

We do not sell your personal information.

We may share information in the following circumstances:

14.1 With Service Providers

We may share information with vendors and service providers who help us operate the Services, including hosting providers, analytics providers, customer support tools, security providers, infrastructure providers, and technical service providers.

These service providers are authorized to process information only as necessary to provide services to us.

We may share information when you direct us to do so or provide consent.

For example, you may authorize us to connect with a membership provider, rewards provider, wallet connection service, or third-party application.

14.3 For Legal Reasons

We may disclose information if we reasonably believe disclosure is required to:

Comply with applicable law
Respond to lawful requests
Comply with court orders
Respond to regulatory inquiries
Enforce our Terms of Use
Protect rights, safety, and security
Prevent fraud or abuse
Investigate prohibited activity

14.4 Business Transfers

If XWHALE is involved in a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction, information may be transferred as part of that transaction, subject to appropriate protections.

14.5 Aggregated or De-Identified Information

We may share aggregated, anonymized, or de-identified information that does not reasonably identify you.

15. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

Provide the Services
Maintain your account
Provide customer support
Maintain security
Prevent fraud and abuse
Comply with legal obligations
Resolve disputes
Enforce agreements
Maintain business records

Retention periods may vary depending on the type of information and the reason it is collected.

Encrypted backups may be retained while your account remains active or until deleted in accordance with applicable procedures.

Certain information may be retained after account deletion where required by law, necessary for legitimate business purposes, or needed to protect rights, safety, and security.

Public blockchain data cannot be deleted by NOXCAT.

16. Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect information.

These safeguards may include:

Encryption
Access controls
Secure storage practices
Network security measures
Logging and monitoring
Internal access restrictions
Security reviews
Authentication controls

However, no method of transmission, processing, or storage is completely secure.

We cannot guarantee absolute security.

Users remain responsible for:

Maintaining device security
Protecting login credentials
Protecting recovery credentials
Avoiding phishing
Reviewing transaction details
Keeping software updated
Using official NOXCAT applications and websites

NOXCAT will never ask you to disclose your private key, seed phrase, recovery phrase, or decrypted backup.

17. Blockchain Transparency

Blockchain networks are generally public, decentralized, and immutable.

This means:

Public wallet addresses may be visible
Token balances may be visible
Transaction history may be visible
Smart contract interactions may be visible
Blockchain records may be permanent
Blockchain records may not be deleted or modified

Even if you delete your NOXCAT account or request deletion of personal information from our systems, information recorded on public blockchains may remain permanently available.

NOXCAT does not control blockchain networks and cannot alter public blockchain records.

18. Financial Information Disclaimer

Information displayed through NOXCAT may include wallet balances, token prices, asset information, swap estimates, reward information, RWA-related information, or other financial data.

Such information is provided for informational purposes only.

NOXCAT does not provide:

Investment advice
Financial advice
Legal advice
Tax advice
Trading advice
Recommendation to buy, sell, hold, or swap any asset

You are solely responsible for your own financial decisions.

Digital assets and tokenized assets may be volatile, risky, and subject to loss.

You should consult qualified professional advisors where appropriate.

19. International Transfers

XWHALE is incorporated in Malaysia, but the Services may be accessed globally.

Your information may be processed, stored, or transferred in jurisdictions other than your country of residence.

These jurisdictions may have data protection laws that differ from those in your jurisdiction.

Where required by applicable law, we will take reasonable steps to protect transferred information.

By using the Services, you acknowledge that your information may be transferred and processed internationally.

20. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information, including the right to:

Access personal information we hold about you
Request correction of inaccurate information
Request deletion of certain information
Withdraw consent where processing is based on consent
Object to certain processing
Request restriction of processing
Request a copy of certain information
Lodge a complaint with a data protection authority

To exercise your rights, contact us at: support@noxcat.io

We may need to verify your identity before processing your request.

Some requests may be limited where we must retain information for legal, security, fraud prevention, dispute resolution, or legitimate business reasons.

NOXCAT cannot delete or modify public blockchain data.

NOXCAT cannot provide access to encrypted message contents because we do not store or have access to such contents.

NOXCAT cannot decrypt encrypted wallet backups because we do not possess the required decryption keys.

To delete your account and associated data, see noxcat.io/delete-account.

21. Children's Privacy

The Services are intended only for individuals who are at least 18 years old.

We do not knowingly collect personal information from individuals under 18.

If we become aware that we have collected information from a minor, we may delete such information and suspend the relevant account.

Parents or guardians who believe that a minor has provided information to us may contact: support@noxcat.io

22. Sanctions Compliance and Restricted Jurisdictions

NOXCAT does not provide Services to individuals, entities, or jurisdictions where such access would violate applicable sanctions laws or restrictions.

You may not use the Services if you are:

Located in a sanctioned jurisdiction
Subject to sanctions
Listed on an applicable sanctions list
Prohibited from using the Services under applicable law

We reserve the right to restrict, suspend, or terminate access where required by law or where we reasonably believe that continued access may create legal, regulatory, security, or compliance risk.

23. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we may notify you by:

Posting the updated Privacy Policy on our websites
Displaying a notice in the app
Sending an email to the address associated with your account
Using other reasonable communication methods

The updated Privacy Policy will become effective when posted or as otherwise stated.

Your continued use of the Services after the updated Privacy Policy becomes effective means that you acknowledge the updated Privacy Policy.

If you do not agree with the updated Privacy Policy, you should stop using the Services.

24. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or our privacy practices, please contact us:

XWHALE TECHNOLOGY SDN. BHD. Registration No. 202601002128 (1664225-A)