iMe Wallet Privacy Policy

Date of publication and entry into force: 6 December 2025 (edited 9 November 2026)

This Privacy Policy explains how iMe Lab FZCO ("iMe", "we", "us", or "our") processes personal data when you use iMe Wallet, the self-custodial wallet provided as a Telegram mini app through the bot @iMe_wallet_bot (the "Service"). It is the privacy policy of the Service and of @iMe_wallet_bot. Capitalized terms have the meanings given in the iMe Wallet User Agreement.

What this policy does not cover.

• Telegram. Telegram processes your account and everything you do on Telegram, including the data it passes to mini apps, under the Telegram Privacy Policy.
• The iMe apps, websites, and other iMe bots. They are covered by the iMe Privacy Policy, including the data the iMe apps send when they open iMe Wallet.
• Third-Party Services. Providers that you use through the Service, such as exchange and payment providers and dApps, process your data under their own privacy policies.
• Blockchains. Transactions and balances recorded on a blockchain are public and are not controlled by anyone, including us.

In short:

• Your Seed Phrase is stored on your device, encrypted. The Service is designed so that we never receive your Seed Phrase or Private Keys.
• Your wallet addresses are linked to your Telegram ID on our servers so that the Service can work. Your transactions are public on the blockchain.
• We do not sell your personal data.

1. Who we are

1.1. iMe Lab FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, is the controller of the personal data described in this policy. We process it in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where applicable, other data protection laws, including the EU and UK General Data Protection Regulation.

1.2. You can contact us about privacy via Telegram @iMeMessenger or at support@imem.app.

2. Summary

3. Telegram and iMe Wallet

3.1. The Service runs inside Telegram. Telegram passes the Service basic data about your account when you open it, as it does for any mini app, and processes your use of Telegram under its own policy. Telegram is not our processor, and we are not responsible for its processing.

3.2. We do not receive your phone number, your Telegram login code, the content of your Telegram chats, or your contacts.

4. Data we process and why

4.1. Opening the Service and signing in

4.1.1. When you open the Service, Telegram passes it your Telegram ID, first and last name, username, language, whether you have Telegram Premium, a link to your profile photo, whether @iMe_wallet_bot may message you, and a parameter showing how you opened the Service — for example, from an iMe app or through a payment link. Our servers use this data to sign you in and link your Wallets and settings to your Telegram ID.

4.1.2. The Service creates a random installation identifier, stores it on your device, and sends it to our servers when you sign in. We record the installation on which each Wallet was created.

4.1.3. Requests to our servers include the language of the interface. If you choose a language in the settings, we store it so that we can communicate with you in that language. Our servers and infrastructure providers also see your IP address.

Why: to provide the Service (contract); to keep it secure (legitimate interests).

4.2. Your Wallets

4.2.1. When you create or import a Wallet, the Service sends our servers its addresses and public keys on each supported network, a signature that proves you control them, and whether the Wallet was created or imported. We link them to your Telegram ID and use them to show your balances and history and to provide the features of the Service.

4.2.2. The names and emoji you give your Wallets stay on your device, except in backups (Section 4.5). Tokens you add to or hide in a Wallet are stored on our servers for that Wallet.

4.2.3. Our servers record, together with your Telegram ID, when you open a Wallet or a token in the Service, to keep its data up to date and to understand how the Service is used.

4.2.4. If you move to a new Wallet, as described in Section 5.7 of the iMe Wallet User Agreement, our servers record which Wallet replaced which.

Why: to provide the Service (contract); to improve it (legitimate interests).

4.3. Your Seed Phrase, keys, and unlocking

4.3.1. Your Seed Phrase is generated or entered on your device and stored there in encrypted form. Private Keys are derived from it on your device, and transactions are signed on your device. The Service is designed so that we never receive your Seed Phrase or Private Keys. They leave your device only if you copy them, back them up (Section 4.5), or share them yourself.

4.3.2. On mobile devices, the key that decrypts your Seed Phrase combines a secret stored in Telegram's secure storage on your device with a key share held by our servers. When you enter your PIN, the Service proves to our servers that you know it without sending the PIN itself, and our servers return the key share. Our servers store a value derived from your PIN and the device secret that lets them check it. The key share alone cannot decrypt your Seed Phrase. On other devices, the key is protected by a password you set and does not leave your device.

4.3.3. If you turn on biometric unlock, the key share is also stored in Telegram's biometric storage on your device, and unlocking with biometrics does not contact our servers. Your fingerprint or face is checked by your device. We do not receive biometric data.

Why: to provide and secure the Service (contract; legitimate interests).

4.4. Blockchain data

4.4.1. To show your balances, transaction history, and prices, our servers request data about your addresses from blockchain nodes, explorers, indexers, and market data providers, and may store copies of it.

4.4.2. Some requests go directly from your device to blockchain nodes and services, such as TronGrid or public network nodes. They see your IP address and the request.

4.4.3. The transactions you make are published on the blockchain and can be seen by anyone, permanently.

Why: to provide the Service (contract).

4.5. Backups

When you back up a Wallet, the Service encrypts its Seed Phrase on your device with a password you choose and saves the backup to your Telegram Cloud, the storage that Telegram provides to the Service for your Telegram Account, or to a file. We do not receive the backup or the password. The backup also contains the Wallet's name, emoji, and one of its addresses without encryption.

4.6. Sending, swaps, and payments

4.6.1. To prepare a transfer, a swap, or a payment, the Service sends our servers its details, such as the network, assets, amounts, the sending and receiving addresses, and the memo. Our servers obtain quotes from exchange providers, prepare the transaction, and, after you sign it on your device, publish it on the blockchain. Transactions for dApps are handled as described in Section 4.8.

4.6.2. Exchange providers receive the details needed to quote and execute your swap, such as the assets, amounts, and addresses.

4.6.3. When an app asks you to pay from iMe Wallet, we receive the payment request from the app, including the recipient, the amount, and the app's name, and we record whether you paid or canceled it, linked to your Telegram ID.

4.6.4. Your recent recipients and address book are stored only on your device.

Why: to provide the Service (contract).

4.7. Buying and selling with fiat currency

4.7.1. To show offers, we determine your country from your IP address. You can change it in the Service. When you request offers or create an order, we receive the asset, network, currency, amount, payment method, and provider you choose, and your country. We pass the order to the provider together with the address of your Wallet that will receive or send the Virtual Assets.

4.7.2. You then go to the provider's website. The provider collects your identity, payment, and other details there under its own privacy policy and may link them to your Wallet address. We may receive information about the status of your order from the provider. We do not receive your card details or identity documents.

Why: to provide the feature you request (contract).

4.8. dApps

4.8.1. When you connect a dApp, it receives your addresses on the networks it requests and, for some networks, your public key and a proof that you control the address. The dApp also receives the messages and transactions you sign for it.

4.8.2. Connections pass through third-party networks, such as the WalletConnect network and TON Connect bridges. Information about your connections is stored on your device.

4.8.3. To show you a dApp's name and icon and to warn you about suspicious dApps, the Service sends the dApp's web address to our servers, which check it and may load the dApp's details from it.

4.8.4. When a dApp asks you to approve a transaction, the Service sends its details to our servers to estimate the fee. After you sign it, the transaction is sent from your device directly to the blockchain network.

Why: to provide the feature you request (contract); to protect you from fraud (legitimate interests).

4.9. Analytics, error reports, and logs

4.9.1. We use Google Analytics for Firebase to understand how the Service is used. The Service sends events about the screens and dialogs you open. Google Analytics also collects data automatically, such as device and browser characteristics, an approximate location derived from your IP address, and an analytics identifier stored in cookies on your device. The events sent to Google Analytics are not linked to your Telegram ID.

4.9.2. Error reports are sent to an error-monitoring tool that we host on our own infrastructure. They are linked to your Telegram ID and may include your installation identifier, the identifiers of your Wallets in the Service, technical details of the error, and the actions that preceded it.

4.9.3. The Service has an optional diagnostic mode that saves logs on your device. The logs leave your device only if you share them, for example with our support.

Why: to understand how the Service is used, fix errors, and keep it working (legitimate interests).

4.10. Clipboard and camera

The Service reads your clipboard only when you tap "Paste". To scan a QR code, the Service uses Telegram's scanner, and we receive only the scanned text.

4.11. Use in other iMe services

4.11.1. We may use the fact that you have a Wallet linked to your Telegram ID in other iMe services. For example, advertisers on iMe Ads can choose to show advertising to people who use iMe Wallet, as described in the iMe Privacy Policy. For this, we use only whether you have a Wallet and whether you use it. We do not share your addresses, balances, or transactions with advertisers, and advertisers see only the size of their audiences, not who is in them. You can object to this use (Section 5.2).

4.11.2. Other iMe services may deliver rewards, such as tokens, to your Wallet. To do so, they use your address in iMe Wallet.

Why: to fund and improve the iMe services (legitimate interests or, where the law requires it, your consent); to deliver the rewards you earn (contract).

4.12. Messages from @iMe_wallet_bot

@iMe_wallet_bot may send you messages about the Service and other iMe services, such as service notices, changes to our documents, announcements, news, and offers. To send them, we use your Telegram ID and language. Telegram delivers them only if you have started the bot or allowed it to message you. You can stop them at any time by blocking the bot in Telegram.

Why: service notices (contract); news and offers (legitimate interests or, where the law requires it, your consent).

4.13. Support

When you contact us, we process your messages and the information you provide, to help you and improve the Service (contract; legitimate interests).

4.14. Security and abuse prevention

Our servers and our infrastructure providers, including Cloudflare, process your IP address, request data, and logs to deliver and protect the Service, prevent abuse, and investigate incidents. Our infrastructure sets a technical cookie on your device to route your requests to our servers (legitimate interests).

4.15. Where data comes from

We obtain personal data from you and your device through the Service; from Telegram, when you open the Service; from blockchain networks and blockchain data providers; from exchange and payment providers; and from apps that ask you to pay from iMe Wallet.

5. Legal bases

5.1. Depending on where you live, we rely on the following legal bases.

5.2. Where we rely on legitimate interests, you can object to the processing by contacting us under Section 1. You can always object to processing for direct marketing, including profiling for advertising.

5.3. Under the UAE Personal Data Protection Law, we process data on the basis of your consent, the performance of our contract with you, or our legal obligations.

5.4. The data described in Sections 4.1 to 4.3 is needed to provide the Service: without it, you cannot use the Service. Other data is processed only when you use the relevant feature, such as swaps, fiat offers, or dApps, or as described in Sections 4.9 and 4.14.

5.5. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

6. Your choices

6.1. Deleting a Wallet. When you delete a Wallet in its settings, the Service removes it from your device, disconnects the dApps connected to it, and unlinks it from your Telegram ID on our servers.

6.2. Signing out. "Sign out & clear all data" on the unlock screen removes your Wallets and unlock settings from your device and disconnects your dApps. Other data, such as your address book, may remain on your device, and your backups are not deleted. To make sure that your Wallets are unlinked from your Telegram ID on our servers, delete each Wallet in its settings before you sign out, or contact us (Section 10.2).

6.3. Backups. You can delete a backup from your Telegram Cloud in the Service. Backup files are under your control.

6.4. dApps. You can disconnect a dApp in the Service at any time.

6.5. Messages. You can stop messages from @iMe_wallet_bot by blocking the bot in Telegram.

7. Who we share data with

We share personal data only as described in this policy:

• service providers that process data for us under contract — hosting and infrastructure providers, including Cloudflare, and Google (Firebase);
• independent providers that receive data in connection with features you use and process it under their own policies — blockchain nodes and data providers, exchange providers, fiat payment providers, dApps you connect, and the WalletConnect network and TON Connect bridges;
• the recipients of your payments, who receive the transaction;
• other iMe services, to the extent described in Section 4.11;
• competent authorities, courts, and professional advisers, where required by law or needed to establish, exercise, or defend legal claims;
• a buyer or successor in a merger, acquisition, or reorganization, under this policy.

We do not sell personal data. We require our service providers to protect personal data to a standard at least equivalent to this policy.

8. International transfers

Our servers and our service providers are located in different countries, including the United Arab Emirates, the United States, the European Union, and others, whose data protection laws may differ from yours. When we transfer personal data from the EEA or the UK to a country without an adequacy decision, we use safeguards permitted by law, such as the European Commission's standard contractual clauses. You can ask us for a copy of these safeguards under Section 1. When we transfer personal data from the United Arab Emirates, we do so as permitted by the UAE Personal Data Protection Law.

9. Retention

9.1. We keep the link between your Telegram ID and a Wallet until you delete the Wallet in the Service (Section 6.1) or ask us to delete your data, so that your Wallet works when you open the Service again. We keep your settings until you ask us to delete your data. If we stop providing the Service, we delete this data. In each case, we may keep data for longer where the law requires it.

9.2. We keep other personal data only for as long as needed to provide the Service, to detect, prevent, and investigate fraud, abuse, and security incidents, to handle requests and disputes, and to meet our legal obligations. Logs and diagnostic data are kept for a limited period. After that, we delete or anonymize the data.

9.3. Data recorded on a blockchain is public and permanent. Neither we nor anyone else can delete it.

10. Your rights

10.1. Depending on where you live, you may have the right to access your personal data and receive a copy, correct it, delete it, restrict or object to its processing, receive it in a portable format, withdraw consent at any time (this does not affect processing before the withdrawal), and lodge a complaint with a data protection supervisory authority, including the authority in your country of residence or place of work, or where the alleged infringement took place.

10.2. To exercise these rights, contact us under Section 1. To delete your data, message @iMeMessenger from the Telegram Account whose data you want deleted, or email support@imem.app. We accept deletion requests from all users, wherever they live. If you write to us by email, we may ask you to confirm the request from the Telegram Account it concerns. We respond within one month; for complex requests, we may extend this by up to two further months and will tell you if we do. We may refuse or limit a request where the law allows.

10.3. Deleting your data does not affect your Virtual Assets: they stay at your blockchain addresses, and you can access them with your Seed Phrase. Make sure you have it before you ask us to delete your data. Wallets on your device and backups in your Telegram Cloud are under your control; you can delete them in the Service (Section 6).

10.4. If you are in the United Kingdom, you can complain to us first under Section 1, and we will acknowledge your complaint within 30 days.

11. Children

The Service is intended only for people aged 18 and over. If we learn that we hold personal data of a person under 18, we will delete it unless we must keep it by law.

12. Security

12.1. We implement reasonable technical and organizational measures designed to protect data against unauthorized access, misuse, loss, alteration, or disclosure. The Service is designed so that your Seed Phrase is stored only in encrypted form and your Seed Phrase and Private Keys are never sent to us. No method of storage, transmission, or processing is completely secure.

12.2. Where a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you, and we will notify the competent supervisory authority where applicable law requires.

13. Changes

We may update this policy. The updated version is published in the Service with a new date. If a change is material, we will also let you know about it, for example in the Service, in a message from @iMe_wallet_bot, or in the official iMe channels. Where the law requires your consent to a change, we will ask for it.

14. Contact

iMe Lab FZCO
Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates

• Support: Telegram @iMeMessenger (preferred) · support@imem.app
• Website: imem.me