Who we are
Zua is a shielded payment app for Zcash, operated by PT Pentahelix Sistem Terpercaya ("Zua," "we," "us"). This policy covers the Zua web app, its API for developers, and the public pages that payers open, such as invoices, payment links, and checkout pages.
The source code is open source. You can read exactly what the app does instead of taking this document on trust.
Summary
- Your keys never reach us. The mnemonic that controls your funds is derived on your device from your PIN or passkey, and it is never transmitted to Zua.
- We store account and payment metadata, not your spending keys: who you are on Zua, which invoices and links you created, and which payments settled them.
- No advertising, no analytics, no trackers. The app ships no third-party analytics, advertising, or session recording scripts.
- No identity verification. Zua does not ask for identity documents. A verified badge means a username or receipt signature was checked against a public key, not that we confirmed who a person is.
- Payments are public at the network level. Shielded transactions hide amounts and addresses, but the fact that a transaction exists, and when, is visible on the Zcash blockchain.
Keys and your browser
Zua runs the Zcash wallet inside your browser, compiled to WebAssembly. Your device derives the wallet keys, scans compact blocks, decrypts your notes, and builds the zero-knowledge proofs for spending. Our servers coordinate accounts, invoices, and statuses; they do not hold the keys needed to move funds.
What stays on your device
| Item | Where it lives |
|---|---|
| Wallet keys | Your mnemonic is derived from your PIN or passkey on your device. It is never sent to Zua. |
| Wallet database | A copy of your wallet database is cached in your browser storage so the next unlock is faster. It is encrypted with a key derived from your PIN or passkey, and it stays on that device until you clear the site data. |
| Memos | Payment memos are decrypted in your browser and cached only there, so invoices and cashier screens can show them again. |
| Receipts | Receipt files are generated and stored on your device. Zua keeps the record of the payment, not a copy of the file. |
Why we cannot recover your funds
Because the keys are derived from your PIN or passkey, we cannot reset them, and we cannot restore access to a balance for you. If you lose both your PIN and your passkey, the funds in that account stay where they are. Keep the recovery method you chose available.
What we store
Everything below is stored on our servers so the product can work across devices and so payers can see what they owe.
| Category | Examples | Why |
|---|---|---|
| Account | Privy user ID, email address or Google account, username, account type, business name | Sign-in, your public profile, and the tools enabled for your account |
| Payment identities | Unified addresses and the Orchard receiver of each address you publish or invoice with | Matching an incoming payment to its invoice, request, or payment link |
| Payment records | Invoices, payment links, requests, claim links, checkouts, amounts, references, status, transaction IDs, and the contacts you choose to save | Showing your history, settling records, and telling payers what is still due |
| Developer integrations | API key hashes, webhook URLs, webhook signing secrets, and webhook delivery logs | Authenticating your API calls and retrying webhook deliveries |
| Notifications | Notification preferences and a log of what was sent | Avoiding duplicate emails and honouring your choices |
Public profiles
A username and, for business accounts, a business name are public. They appear when someone opens your payment link, invoice, or claim link, and they are used to resolve "send to @username" payments before a transfer is built.
Receipts and payment disclosure
A receipt is a signed statement about a payment. Whoever holds the file can use it to reveal the outputs it lists, including amounts. Share receipts the way you would share a bank statement, not the way you would share a link.
Developer data
If you create an API key, we store a hash of it and never the key itself. Webhook signing secrets are stored so that deliveries can be signed. Webhook payloads include the checkout data you sent us, so avoid putting personal data in descriptions that do not need it.
Payment privacy
Zcash shielded transactions keep amounts, addresses, and memos out of public view. Zua only accepts shielded addresses, so a payment through Zua does not publish a balance or a recipient list on the blockchain. What remains public is that some transaction was mined, in which block, and its fee.
Reading your own notes requires the wallet to fetch compact blocks. That traffic goes through a public lightwalletd proxy, which sees your IP address and the blocks you ask for, in the same way any node you connect to would. Zua is not the operator of that proxy.
Memos
Zua uses memos to attach an invoice, request, or link reference to a payment. Memos are decrypted in your browser. When a payer settles an invoice, our servers receive the invoice identifier and the amount, not the memo text.
Service providers
We use a small number of providers. We do not sell personal data and we do not share it for advertising.
| Provider | What it processes |
|---|---|
| Privy | Sign-in by email one-time code, Google, or passkey. Receives your email or Google account and issues the session token that Zua verifies. |
| MongoDB Atlas | Database hosting for the account and payment records listed above. |
| Vercel | Hosting for the web app and its API routes, including request logs kept by the platform. |
| ChainSafe lightwalletd proxy | Your browser fetches Zcash compact blocks from this public gRPC-web proxy. It can see your IP address and the blocks you request, as any node you connect to can. It never sees your keys. |
| Resend | Only if email notifications are enabled: receives the recipient address and the message content. |
| Merchant webhooks | Only for developers who register a webhook: checkout events are delivered to the URL that developer controls. |
Some providers process data outside Indonesia. Where the law requires it, we rely on appropriate safeguards for those transfers, and we limit what is sent to what the service needs.
Retention and deletion
Account and payment records are kept while your account exists, so your history and your payers' receipts stay consistent. When you ask us to delete your account, we delete your profile, addresses, invoices, links, requests, claim links, API keys, and webhook settings from the active database, and remove them from backups as those backups rotate.
Signing out ends your session but keeps the encrypted wallet cache on that device so you can unlock again; clearing the site data removes it. Data already written to the Zcash blockchain cannot be deleted by us or by anyone else.
We may keep limited records longer where we must, for example to resolve a dispute, prevent abuse, or meet a legal obligation.
Your rights
Subject to applicable law, including Indonesia's Personal Data Protection Law (Law No. 27 of 2022), you can ask us to:
- confirm what we hold about you and give you a copy;
- correct inaccurate account or profile data;
- delete your account and the records listed above;
- export your payment history, which the app already provides as CSV and as receipt files;
- stop non-essential messages, such as email notifications.
Write to the address in the last section. We may need to verify that the account is yours before acting. Because we do not hold your keys, we cannot act on requests about funds themselves.
Security and limits
Access to the app requires a Privy session. Your wallet requires your PIN or your passkey before keys are derived, and the local cache is encrypted with material derived from it. API keys are stored as hashes, and the API never accepts a key that does not match one on file.
No system is perfect. A compromised device, a malicious browser extension, a shared computer left unlocked, or a weak PIN can defeat these controls. Use a device you trust, keep the browser updated, and prefer a passkey when your provider supports it.
Zua is software, not a bank or a custodian. We do not hold your funds, we cannot freeze them, and we cannot reverse a payment that the network has confirmed.
Changes and contact
We update this policy when the product or the law changes, and we revise the date at the top. Material changes are announced in the app before they take effect.
Questions, requests, or complaints:
Zua Privacy TeamPT Pentahelix Sistem Terpercaya
Jl. Pondok Kopi Raya No. 180, Pondok Kopi, Duren Sawit, East Jakarta, DKI Jakarta 13460, Indonesia
ptpentahelixsistemterpercaya@gmail.com
You may also contact the data protection authority where the law gives you that right.