Privacy policy
Last updated 13 November 2026
- You sign in with your wallet. We do not ask for your name, email address or card.
- We keep your wallet address, your sign-in sessions and the details of your eSIM order.
- The app has no analytics, no advertising and no tracking. This website sets no cookies.
- What you do on Solana is public and permanent. Nobody, including us, can delete it.
- You can ask us to delete what we hold at any time: support@mobiloot.com.
1. Who we are
Mobiloot is operated by Charlie Newman, an individual based in the United Kingdom ("Mobiloot", "we", "us"). We are the controller of the personal data described here. This policy covers the Mobiloot Android app, the Mobiloot API it talks to, and this website.
Contact: support@mobiloot.com.
2. What we collect, and why
| Data | Why we need it | Legal basis |
|---|---|---|
| Wallet address (your public key) | To sign you in, check that your stake covers a plan, and tie an eSIM to you. | Performing our agreement with you |
| Sign-in records: the message your wallet signed, and a hashed session token | To prove you control the wallet and keep you signed in. Sessions last up to 7 days. | Performing our agreement; our legitimate interest in security |
| eSIM order details: plan, billing period, order status, the SIM's serial number (ICCID) and its activation code | To deliver your eSIM, show it in the app, and suspend or resume the line as your stake changes. | Performing our agreement |
| Line records (real lines only): the provider's reference numbers for your line, its status, and status updates the provider sends us | To manage the line with the mobile network. | Performing our agreement |
| Usage totals (real lines only): how much data, and how many minutes and texts, you have used in the period | To show your usage in the app. We request these from the provider when you look; we do not see who you call or text, or what you browse. | Performing our agreement |
| Technical logs: IP address, time and the request made | To run the service, limit abuse and investigate faults. | Our legitimate interest in a secure, working service |
| Emails you send us | To answer you. | Our legitimate interest in supporting users |
What we do not collect. The app does not collect your name, email address, phone contacts, location, device identifiers or payment card details, and it contains no analytics or advertising software. We never see or store your wallet's private key or seed phrase.
3. Data on the blockchain
Staking, withdrawing and activating a plan are transactions on the Solana blockchain. They are public, they include your wallet address, and they cannot be changed or deleted by anyone. Consider this before you use a wallet that is linked to your identity. While Mobiloot is in preview these transactions are on Solana's devnet, a public test network.
4. Who we share data with
- Shaka (the UK mobile network provider, for real lines only). To create a line we send a reference made from your wallet address and the plan you are on. Shaka and its host network operate the mobile service itself and, as telecoms providers, handle the data that involves (such as call and data-session records) under their own legal obligations and privacy notices.
- Our hosting provider, which runs the Mobiloot API and stores its database and logs on our behalf.
- Solana network operators. The app sends your transactions and balance requests to a Solana RPC service, which can see your IP address and wallet address.
- Your wallet app, which you choose and which has its own privacy policy.
- Authorities or advisers, where the law requires it or to establish or defend legal claims.
We do not sell your data, and we do not share it for advertising.
5. Where your data is processed
Some of our providers process data outside the United Kingdom, including in the United States and the European Economic Area. Where they do, we rely on safeguards recognised under UK data protection law, such as adequacy regulations or the International Data Transfer Agreement.
6. How long we keep it
- Sign-in challenges are deleted shortly after they expire. Sessions expire after 7 days.
- Order and line records are kept while you use Mobiloot and until you ask us to delete them, unless we must keep something longer to meet a legal obligation.
- Technical logs are kept for a short period by our hosting provider and then deleted.
7. Deleting your account and data
You can delete your Mobiloot account and the data linked to it at any time. In the app (version 0.2 and later), open Account and choose Delete my account: your sessions and demo eSIM orders are erased immediately. If you have a real mobile line, it is suspended at once, and we close it and delete the remaining records within 30 days.
You can also email support@mobiloot.com with your wallet address. We will ask you to sign a short message with that wallet, so that nobody else can delete your account, and we will then do the same within 30 days.
We cannot delete transactions from the blockchain (see section 3), and deleting your Mobiloot data does not withdraw your stake. Withdraw your SOL in the app first; it remains yours either way.
8. Your rights
Under UK data protection law you have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form. To use any of these rights, email support@mobiloot.com. We will reply within one month.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
9. This website
This website sets no cookies and uses no analytics. Fonts and images are served from our own domain. The calculator on the home page asks the Mobiloot API for the current price of SOL, which creates the technical logs described in section 2. Our web host also keeps standard access logs.
10. Children
Mobiloot is for adults. You must be 18 or over to use it, and we do not knowingly collect data from anyone younger. If you believe a child has used Mobiloot, contact us and we will delete their data.
11. Security
Connections to the Mobiloot API are encrypted. Session tokens are stored only as hashes. Activation codes are shown only to the signed-in wallet they belong to. No system is perfectly secure, and we will tell you and the regulator about a breach where the law requires it.
12. Changes
We will update this page when the service changes, for example when Mobiloot moves from preview to mainnet, and change the date at the top. If a change is significant we will say so in the app.