Privacy

Last updated: 2026-04-29.

PayCashu is a self-custody iOS wallet for Bitcoin, Lightning, and Liquid. We do not run servers that hold your funds, and we never see your seed phrase. The short version of this policy is: we collect as little as possible, and what little we do collect is described below.

What stays on your device

Your seed phrase is generated on your device and stored in the iOS Keychain, protected by the Secure Enclave and your device passcode or Face ID. It never leaves the device. Non-sensitive preferences (selected fiat currency, chosen layer, UI flags) are stored in AsyncStorage / localStorage on the device. We do not sync this data anywhere.

What our backend sees

The MERIDIAN backend at api.paycashu.com handles features that cannot live on the device alone: push notification routing, optional Lightning Address registration, and account-scoped metadata. It sees an opaque account identifier, an Apple push token, and — only if you choose to claim a Lightning Address — the username you picked. It never receives your seed, your private keys, or your transaction history.

Liquid Esplora

The wallet queries the Liquid blockchain through a self-hosted Esplora instance at liquid.paycashu.com. That server sees the addresses your wallet asks about and your IP address at request time. We do not log this data beyond what is needed to operate the service, and we do not link it to any account identifier.

Lightning Address routing

If you receive at a yourname@paycashu.com Lightning Address, the LNURL request is routed through ln.paycashu.com (a self-hosted breez-lnurl proxy) before being forwarded to your device. The proxy can see incoming payment metadata — sender IP, amount, and memo — by virtue of relaying the request. It does not see the preimage or your private keys.

This website

www.paycashu.com runs no analytics, no tracking pixels, and no third-party scripts. It is a static site served from Cloudflare Pages. Cloudflare sees standard request logs (IP, user agent, requested path) at the edge, the same as any website hosted there.

Your rights

Because almost all data lives on your device, you control it directly: deleting the app removes the seed, keys, and preferences. For account-scoped data on api.paycashu.com you can request export or deletion by emailing the address below; we will respond within 30 days.

Contact

Questions about this policy: hello@paycashu.com.