Your data, kept small.

• Your wallet address. When you connect MetaMask or sign in, we receive your public wallet address and a signature proving you own it. We never receive or ask for your private key or seed phrase.
• Order details. The card value you choose, your quote, and the payment transaction you send on Robinhood Chain. Blockchain transactions are public by nature.
• Email address. Used to deliver your card voucher and to contact you about an order. Rewarble, the card provider, also needs an email to redeem the voucher.
• Cardholder name and billing address. Required by the card provider to issue a card. We store them encrypted and share them only as described below.
• IP address. Our card supplier requires the IP address of the person ordering, for fraud and sanctions screening. We also use it for rate limiting.
• Support messages. If you contact us, we keep what you send so we can help.

Card numbers, expiry dates and security codes (CVV/CVC). When you redeem a voucher on Rewarble's website, the Tyvo extension reads the card details from that page in your browser and stores them only in your browser's local extension storage, so it can fill them in at checkout. They are never sent to Tyvo or anyone else by the extension. We also never ask for ID documents, selfies or bank details.

The extension asks only for the permissions it needs:

• storage. keeps your settings, your order references and your saved cards on your device.
• activeTab and scripting. fill your card into the checkout page you are on, only when you ask it to.
• clipboardWrite. copies a card detail when you tap copy.
• sidePanel. shows Tyvo in Chrome's side panel so it stays open while you pay.
• Site access. talks to api.tyvopay.app for your orders and to tyvopay.app to link your wallet. On rewarble.com it acts only while you are redeeming a Tyvo voucher: it fills in your email and code and reads the new card's details from that page so it can save them on your device.
• Checkout payment forms. when you ask it to fill a card, it can fill the payment fields a checkout embeds from Stripe, Braintree, Adyen, Shopify or Checkout.com. It writes your card into those fields; it doesn't read anything else from them.

The extension does not track your browsing, does not read pages you don't ask it to act on, and does not sell or share your data. Card details are kept only in the extension's local storage on your device. Removing the extension deletes everything it stored.

To quote and fulfil your order, deliver your voucher, process refunds, prevent fraud and comply with sanctions screening, keep our systems secure, and answer support requests. We do not sell your data and we do not use it for advertising.

• CryptoRefills. our card supplier: your email, cardholder name, IP address and order details, to issue your Rewarble VISA voucher.
• Rewarble. you give Rewarble your email, name and billing address directly when you redeem your voucher on their site. Their own privacy policy applies there.
• ChangeNOW and Relay. only if you use them to top up; they process that swap under their own policies.
• Infrastructure providers. DigitalOcean (our servers and database), Vercel (our website), and our email provider, under agreements that let them process data only for us.
• Legal requirements. when the law requires it, or to prevent fraud or protect our users.

Order and payment records are kept as long as needed to run the service, handle refunds and meet legal and accounting obligations. Voucher codes are stored encrypted. You can ask us to delete your personal information at any time; we'll delete what we are not required to keep.

Personal details and voucher codes are encrypted at rest. Our database accepts connections only from our own servers, over encrypted connections. No system is perfectly secure, but we design ours so the most sensitive data, your card details, never reaches us at all.

You can ask to see, correct or delete your personal information, or ask how we use it, by emailing contact@tyvopay.app. Depending on where you live, you may have additional rights under local law (for example the GDPR or the CCPA), and we'll honour them. Tyvo Pay is not for anyone under 18, and we do not knowingly collect data from children.

If we change this policy we'll update the date above; significant changes will be announced on the site or on X (@TyvoPay). Questions or requests: contact@tyvopay.app. Tyvo Pay is an independent project built on Robinhood Chain and is not affiliated with or endorsed by Robinhood Markets, Inc.