Privacy Policy

Optional email accounts, no tracking

Local features work without an account. Email sign-in is optional and enables configuration sync, device management and purchase linking. We do not use advertising or analytics SDKs. Cloudflare Turnstile verifies email requests to prevent abuse; Cloudflare Email Service sends one-time verification codes.

Your keys stay on your device

In the native app, your wallet recovery phrase and private keys are generated on your device and stored, encrypted, in the device Keychain / Secure Enclave. They never leave your device and are never transmitted to us. Viewing your recovery phrase or sending funds is protected by Face ID / Touch ID. For the Android app, see “Android app” below.

Price Alerts (optional, Pearl Hub Pro)

If you unlock Pearl Hub Pro and add price alerts, the app sends our alert server (pearlhub.net, hosted on Cloudflare) what it needs to do that: this device's Apple push notification token, the alert conditions you set (for example "PRL rises to $1.20"), the app's display language and, if you limit notifications to certain hours, those hours and your time zone. The server uses them only to check the $PRL price every minute and notify you through Apple's push service when a condition is met. For price alerts it does not receive wallet recovery phrases or private keys. If you sign in, your notification token is associated with your account device. Removing all your alerts deletes this data from the server; tokens that Apple reports as no longer valid are deleted automatically. The Lock Screen live price works the same way: while it is running the server holds the push token Apple issues for it, and forgets it when it ends.

Offline Alerts (optional, Pearl Hub Pro)

Offline alerts are off until you switch them on for a pool monitor. When you do, the app sends the same alert server what it needs to ask that pool about that monitor: the pool's name, the payout address you entered for it (for F2Pool, the key of the read-only page link you entered, and its account name), the name you gave the monitor, the delay you chose, this device's push notification token and the app's display language. The server asks the pool's public API about that address every few minutes and notifies you when a worker has been offline for the time you chose, and again when it is back online; it keeps the worker names and online status the pool last reported, for that purpose only. It never receives your recovery phrase, private keys or balances. Switching the alert off, or deleting the monitor, removes it from the server.

Payment Alerts (optional, Pearl Hub Pro)

Payment alerts are off until you choose an address and switch them on. When you do, the app sends the same alert server that one PRL address, the name it has in the app (a wallet's or a monitor's, if any), this device's push notification token and the app's display language. The server reads each new block of the public Pearl blockchain and notifies you when a transaction pays that address; it keeps the IDs of the transactions it has notified you about, so it doesn't repeat them. It never receives your recovery phrase, private keys or balances. Switching the alert off removes the address from the server.

In-app purchases

Pearl Hub Pro is a one-time in-app purchase processed entirely by Apple. We never receive your payment details or your Apple Account; the app checks your purchase on-device with Apple's StoreKit. If you turn on the alerts above, the app also sends the alert server Apple's signed record of that purchase, and Apple notifies the server of purchases and refunds. The server keeps the purchase's transaction identifier, with the price and storefront country Apple reports, to confirm that alerts belong to a Pro purchase and to stop them if it is refunded.

Web version

The web version sends pool identifiers you add (including an F2Pool read-only link key) to our service to query the relevant pool. Results are cached briefly and are not associated with an identity. Your lists and preferences are stored in your browser. We never request recovery phrases or private keys.

The read-only wallet page sends watch addresses to our service, which queries Blockbook for balances and paginated transaction history, including fees and counterparties. Mining income queries also send your monitored payout addresses to exclude transfers between them. Transaction lookups on the same page send the transaction ID you enter, and our service queries Blockbook for that transaction. These results are briefly cached using hashed address and transaction keys. The web page cannot sign transactions. Its broadcast tab sends a transaction you signed elsewhere and paste there to our service, which passes it to the Pearl network through our own index and Pearl's official indexer; the transaction is not stored. Rebroadcasting a transaction by its ID has our service fetch it from one of those indexes and send it the same way. Watch addresses remain in local settings and optional encrypted sync. A collapsed card on the same page contains the Chrome extension download and installation guide.

USD exchange rates come from ExchangeRate-API's public USD feed; extended price history comes from BigONE's public PRL/USDT daily candles. These requests contain no wallet address or identity. The candlestick chart on the Market page is the one exception that does not pass through our service: your browser loads it directly from SafeTrade's public PEARL/USDT market data (safetrade.com), without an address, account or cookies, so SafeTrade receives your IP address. Network charts use public Blockbook samples retained by our service. Device lists, rental costs and calculator preferences remain in your browser and, if enabled, your encrypted settings sync. Synchronizing pool workers into your device list queries only the monitors you have enabled.

Email accounts and configuration sync

Signing in stores your email, random account and installation identifiers, device names, platform, login times and recent activity on Cloudflare D1. Six-digit codes expire in five minutes and are stored as keyed hashes. Request limits use keyed hashes of IP addresses and emails. Web sessions use Secure, HttpOnly cookies. Native apps keep access and refresh credentials in the device-only Keychain; the extension keeps them in local storage restricted to trusted extension contexts.

Sync includes public watch addresses (from the native app, each wallet's first receive address and its name, shown read-only on the Web), contacts (names, addresses and notes), monitors, alerts, devices, calculator inputs, language and display preferences. It excludes recovery phrases, private keys, wallet passwords, API secrets and signed transactions. Transport uses HTTPS. Cloud configuration is encrypted at rest with a key stored in Cloudflare Worker secrets. This is not end-to-end encryption: the server can read the configuration to validate it and process notifications.

Browser notification subscriptions belong to a local purchase credential or an account device. Signing out or removing a device revokes its sessions and stops its account notifications; a valid purchase saved in this browser can continue with local settings. Local caches are separated by account; sign-out restores guest settings. An account-managed setting is not also mirrored through iCloud. Wallet storage and local wallet unlock are independent of the account.

PRL checkout works without an email account. The browser automatically saves a random purchase credential in local storage before checkout. The server stores its hash, an installation identifier, order amounts and payment transaction identifiers. This credential can access only its purchases and browser notifications; it is excluded from exported and synced settings. A confirmed payment enables Pro in that browser. Optionally linking a verified email lets you restore purchases and use them on other devices. Clearing site data removes the local credential, so email linking is recommended for recovery. Linking an App Store purchase verifies Apple's signed transaction and associates its original transaction identifier with one account. Refunds revoke that purchase's entitlement while retaining independent valid purchases. Linked PRL and App Store purchases grant the same account Pro features in supported app versions. Local App Store purchases also work without an email account.

The account page provides configuration export, device removal, verified email changes and account deletion. Deletion removes your email and cloud configuration and revokes sessions and notifications. De-identified payment, purchase/refund and notification-claim records remain to prevent receipt replay and prevent revoked devices from reconnecting through older interfaces. Local wallets are not deleted. Expired codes and request budgets are cleaned up automatically; sessions expire after 30 days of inactivity or 90 days from sign-in.

Delete your account

In the iPhone, iPad, Mac or Android app, open Settings → Email account and choose Delete account. On the web, open pearlhub.net, choose Account, sign in with your email and choose Delete account. If you can no longer sign in, email support@pearlhub.net from the account's address and we will delete it. Deletion removes your email and cloud configuration and revokes sessions and notification registrations; the de-identified records described above remain, and wallets stay on your devices until you remove them there.

Chrome wallet extension

The extension encrypts recovery phrases and pending transaction records in local extension storage using your password. It does not sync private keys through a Chrome account or our web service. On mainnet, blockchain queries send account extended public keys, addresses and transaction identifiers first to our own Pearl blockchain index (reached at pearlhub.net/node; the Blockbook server described under “Wallet balances and transactions”), and to Pearl's official indexer when ours is unavailable or behind; on testnet only to the official testnet indexer. Transfers send the signed transaction to both. Recovery phrases and private keys are not sent. Uninstalling the extension removes its local wallet records.

On mainnet the extension requests the public PRL price and exchange rates from our service to show an estimate of your balance; these requests carry no wallet address or identity. Contacts you save (name, address and note) are stored unencrypted in local extension storage. Optional email account sync shares these contacts with Web and native apps, over HTTPS. Cloud configuration is encrypted at rest and readable by the server. Account credentials remain in trusted local storage. Signing out stops sync and restores guest contacts. Local account caches are separated by user, and no data is synced through your Chrome or Microsoft account.

Once you open its NOCK page, the extension also shows the NOCK address the same recovery phrase opens (see “NOCK (Nockchain) wallet” below). It asks NockBox's public node (rpc.nockbox.org), directly from your browser and with the same lock identifiers, and broadcasts the NOCK transactions you confirm there. To list the address's past transactions, it also sends the NOCK address, directly from your browser, to the nockscan block explorer (nockscan.com). When NockBox's node cannot be reached, the NOCK page offers the second node described there (216.158.95.10, plain HTTP); only if you allow it, through an optional site permission Chrome asks you to confirm, does the extension use it as well. The NOCK price comes from CoinGecko without any address or identity. The NOCK address and its history are stored unencrypted in local extension storage, like contacts, and are removed with the wallet.

Opening a public wallet address in the Web companion places the selected address in the URL fragment. The browser reads it after the page loads; it is not sent in the initial page request.

Android app

The Android app shows the web version's interface inside the app and adds a wallet, notifications and home-screen widgets. The web version and email account sections above apply to it.

The wallet works like the Chrome extension: recovery phrases and pending transaction records are encrypted on the device. Instead of a password, the encryption secret is a random value encrypted with a key held in the Android Keystore, and the app uses it only after your fingerprint, face or screen lock confirms. Recovery phrases and private keys never leave the device. App data is excluded from Android backups and device-to-device transfer, so a new phone needs your recovery phrase. Screenshots are blocked while a recovery phrase is shown. Mainnet balances and history are read from Pearl Hub's own blockchain index at pearlhub.net/node first. If it is unavailable or behind the chain, the app uses Pearl's official index at blockbook.pearlresearch.ai; testnet uses blockbook.testnet.pearlresearch.ai. Queries send extended public keys (xpubs, which can reveal all addresses of a wallet), addresses and transaction IDs. Transfers broadcast only transactions signed on the device to both mainnet indexes. Widgets use the same index order. A read-only wallet you add by address has no recovery phrase on the device and is queried by that address instead of an xpub. If you sign in to a Pro account with sync on, each wallet's name and first receive address sync with the web version's Wallet page, as in the native app; read-only wallets also take renames and removals made there.

The NOCK side of the wallet works as in the native app (see “NOCK (Nockchain) wallet”): it reads both public Nockchain nodes directly from the device, the second over plain HTTP, the NOCK price from CoinGecko, and the NOCK address's history from nockscan.com. The NOCK address and its history are stored unencrypted in the app's private storage.

If you turn on price or offline alerts, the app registers with Google's Firebase Cloud Messaging and sends our alert server its registration token instead of an Apple push token; everything else is as described in the alert sections above. Google delivers the notifications under its own privacy policy. Tokens Google reports as no longer valid are deleted automatically.

Home-screen widgets refresh while the app is closed: they request the public PRL price and, for the pool monitors you have, pool statistics from our service (the same requests the app makes), and read your wallet balance from the blockchain indexes as above. Widget data stays on the device.

The version from Google Play sells Pearl Hub Pro as a one-time Google Play purchase. Google handles the payment; we never see your card or Google account. To unlock Pro, the app sends our server the purchase token and order ID Google Play gives it. The server checks them with Google, confirms the purchase to Google, and later reads Google's list of refunded purchases to end Pro for refunded ones. If you are not signed in, the purchase is tied to a random purchase credential stored in the app, as for the web version's guest purchases. Signing in with email moves it to your account. Reinstalling, or another phone with the same Google account, restores it. The version downloaded from pearlhub.net offers PRL checkout as described for the web version.

The version downloaded from pearlhub.net checks pearlhub.net/downloads/android/latest.json at launch and on returning to the foreground, at most once every six hours, to show a newer installable version. This request sends no wallet address or account identity. Closing the notice hides that version. The app opens the signed APK download in the browser; installation still uses Android's system flow.

The Trade tab works with your own SafeTrade account. A SafeTrade API key and secret you add are encrypted with a key held in the Android Keystore and kept only on this device: they are excluded from backups, are not synced, and never reach our servers. The app signs each request on the device and sends it directly to safetrade.com with your API key (the secret itself is never sent): market data, your balances and orders, deposit addresses and history, and withdrawals. Every withdrawal first asks for your fingerprint, face or screen lock. USDT withdrawal addresses you save stay on the device.

Wallet balances and transactions

To show a wallet's balance and history, the native app first queries our own Pearl blockchain index (node.pearlhub.net, a Blockbook server we run, reached through Cloudflare). These queries send each wallet's extended public key (xpub), from which all of that wallet's addresses can be derived, and the transaction identifiers involved. They are used only to answer the request and are not stored. When our index is unavailable or behind, the app sends the same queries to Pearl's official indexer instead. Signed transactions are broadcast to both. The on-chain income shown for monitored mining addresses (which sends those payout addresses) and the network hashrate chart (which requests public blocks) use the same two indexes in the same order. Recovery phrases and private keys are never sent.

NOCK (Nockchain) wallet

The same recovery phrase also opens a NOCK address on Nockchain, derived on your device. To show its balance, the native app asks NockBox's public Nockchain node (rpc.nockbox.org) for the coins locked to that address, and when that node is unavailable, the public node the official Nockchain wallet uses by default (216.158.95.10). The second one is reached over plain, unencrypted HTTP, so others on the network path can see those requests. The requests carry two lock identifiers derived from your NOCK address, so a node can tell which address is asking. The same nodes answer the transaction and block lookups behind your NOCK history, and a NOCK send is broadcast to both of them. To list your past NOCK transactions, including ones made on another device or before you installed the app, the native app sends your NOCK address to the nockscan block explorer (nockscan.com); it does so only once you use NOCK in the app (open a NOCK page, hold NOCK or have NOCK history). The history it builds is kept on your device and never synced. Recovery phrases and private keys are never sent.

Third-party services the app contacts

To provide its features, the native app makes direct requests from your device to public services. These requests carry only what is needed to fulfill them (for example a wallet or mining address you enter), and each service has its own privacy policy:

• Pearl blockchain indexer (blockbook.pearlresearch.ai) — for balances, history, mining-address income and network charts when our own index is unavailable or behind; signed transactions are broadcast to it as well.
• Public market data (e.g. SafeTrade public ticker, CoinGecko) — to display the $PRL and NOCK prices and charts, for reference only.
• Nockchain public nodes (rpc.nockbox.org, run by NockBox; 216.158.95.10, the official Nockchain wallet's default node, plain HTTP) — for your NOCK balance, transaction status and block times; NOCK transactions you sign are broadcast to both.
• Nockchain explorer (nockscan.com) — your NOCK address, to list your NOCK transaction history once you use NOCK in the app or the Chrome extension; and the transaction itself when you open it in the explorer from its details.
• SafeTrade trading API (safetrade.com) — only if you add your own SafeTrade API key, to show your exchange balances, place or cancel your orders, show deposit addresses and deposit and withdrawal history, and send the withdrawals you confirm.
• Mining pool public APIs (AlphaPool, Lucky Pool, HeroMiners, Pearl Fortune, PearlHash, Kryptex, Jetski, Peryn, F2Pool) — to show stats for a mining address you choose to monitor.

We do not control these services. Native app queries go directly to them; web queries pass through our service as described in the Web version section, except the SafeTrade candlestick chart, which the browser loads directly.

iCloud sync (optional, Apple-encrypted)

While signed out of the email account, iCloud can sync your preferences (language, currency, pool setup) across your own devices through Apple iCloud, and a SafeTrade API key you add is kept in your iCloud Keychain. This data is handled by Apple under Apple's privacy policy; we have no access to it.

Children

The app is not directed to children.

Changes

We may update this policy from time to time. Material changes will be reflected on this page with a new "Last updated" date.

Contact

Questions about this policy? Reach us on Telegram at @prl_hub.