How Wire handles data
Wire keeps its main state in an encrypted file (AES-256-GCM), with permissions restricted to its owner. Engine files are also private; files holding secrets are encrypted. This is not a guarantee that data can never be accessed.
| Data kept | Purpose | Retention |
|---|---|---|
| Sender email; session token hash | Sender access | Email confirmation code: 15 minutes. Signed-in session: 24 hours. Sessions are deleted on expiry or when the sender is blocked. |
| NIM cards: sender and recipient emails, amount, message up to 160 characters, language, public card address, stage, dates and decorative image | Card operation, history, email and refund | Finished cards: email addresses and messages are erased 60 days after the card ends, if it holds nothing. Unpaid drafts: 2 days. Cancelled cards: 14 days. |
| USDC/USDT cards: sender and recipient emails, amount, message, public card address, refund token held by Wire and dates | Card operation, history, email and refund | Erased 60 days after the card ends, if it holds nothing. |
| Secret-keyed hash of the visitor’s IP address and a counter | Abuse prevention | About 1 hour. |
| Allowed and blocked email lists | Invitation-only access | Until an administrator removes them. |
| Record of reminders and notices sent | Avoid sending the same notice twice | Kept with the card. |
Keys and payment records
The engine keeps each NIM card’s private key, encrypted with its master key, to pay the recipient or refund it. USDC/USDT co-signing and relay keys are derived from that master key.
It also keeps a journal per NIM payout or refund: destination, signed transaction and transaction identifier, without a key. Email verification codes are kept as hashes with their expiry.
The margin ledger records the first eight characters of a card identifier, amounts and network costs per settled USDC/USDT payout. It contains no email or address. No retention period for these engine records is specified here.
Who else sees data
- MailerSend
- Sender and recipient emails, message, card amount, link and codes, to deliver emails.
- Cloudflare
- Visitor IP addresses and requests, to connect visitors to the server. Wire uses the forwarded visitor address only for rate limiting, as a hash.
- Blockchain nodes
- Card and relay addresses queried for balances, funding and network costs.
- NIM, Polygon and Ethereum
- Payments are public and permanent on their blockchains.
- Chainlink; CoinGecko as a fallback
- The coin identifier only, to price the network cost in the fee.
- Nimiq services, Nimpay and receiving wallets
- What you do with them to receive NIM. Their own terms apply.
What Wire does not keep
Wire has no passwords. It does not store the USDC/USDT link key: the key stays in the sender’s browser and recipient’s link. Wire sees the complete claim link once to email it, but does not store it.
Wire does not keep clear-text IP addresses, advertising identifiers or analytics. Email open and click tracking is disabled in every message. This does not mean Cloudflare or MailerSend sees no data.
Requesting deletion and its limits
Wire erases a card’s email addresses and message by itself 60 days after the card ends, if the card holds nothing. A card that still holds money keeps its data, because its sender may need to recover it. You can ask for an earlier removal for a card that is over. Payments stay on the blockchain, and backups keep what they held on the day they were made.
Send requests to the contact address below. No response deadline is promised here.
Wire cannot remove blockchain records, MailerSend delivery logs or Cloudflare data. Those providers’ own retention applies. Removing contact data cannot reverse a claimed payment.
Operator and contact
Phoenix Wire is operated by the person named below. Questions and requests, including deletion requests, go to the contact address below.
Operator name: Xcoder
Contact address: [email protected]