What self-custody means here
Your wallet’s private keys and recovery material are generated and processed on your phone. Rowix, the publisher, does not hold a recovery account or a copy of your keys, and it does not approve, delay or block your transfers. The practical consequences cut both ways:
- There is no publisher account to be locked out of, and no publisher step between you and a payment you have approved on your device.
- The publisher cannot recover missing keys, reset a forgotten wallet or backup password, or reverse a payment once it is on the blockchain.
Self-custody is not a promise about the wider system. Token issuers can restrict particular tokens; the issuers of USDC and USDT, for example, can freeze balances at specific addresses. Network providers and the networks themselves have their own rules and may impose their own restrictions. Holding your own keys removes the publisher from the path; it does not remove everyone.
Self-custody is a responsibility as much as a freedom. The rest of this page is about carrying it well.
How a payment is approved
- You enter the payment. Amount and recipient, typed, pasted or scanned from a QR code. The camera frames stay on your device.
- You review everything on one screen. The full recipient address, the network, the amount and the network fee. On Ethereum and Solana the fee shown is a maximum; on Solana, any token-account creation cost is listed separately.
- Your device checks it is you. The phone’s screen lock, passcode or biometrics gate the approval. The app receives only the result of that check, never a biometric template.
- The transaction is signed locally and broadcast. The signed transaction is saved first so that a failed broadcast can be retried without creating a second payment.
Device authentication
On Android 1.1.0, a device screen lock is required before sending, before unlocking additional networks and before exporting a backup. Device authentication is an approval gate; it does not replace the password of an encrypted wallet. The wallet password and the password you choose for an exported backup are separate, and the app cannot reset either of them.
On iOS 1.0.1, which is awaiting App Store review, a device passcode is required to use the wallet. The wallet locks when it goes to the background, and passcode or biometrics protect unlocking, payment approval and access to the recovery phrase.
Where recovery material lives
Android
Wallet keys and seed material are kept in the app’s private storage, and Android’s automatic app backup is disabled so that wallet data is not silently copied to a cloud account. The backup you make yourself is an encrypted file, protected by a password you choose, saved through Android’s document picker to a location you select. That location may be a cloud-backed storage provider, which would receive the encrypted file and its metadata.
iOS
Recovery material is stored in the device’s Keychain with access restricted to when the device is unlocked. These Keychain items do not synchronise to iCloud and do not migrate through device backups, so a new iPhone needs the recovery words, not a restore from backup. Keychain items can remain after the app is deleted; this version has no wallet-delete action.
Pending and broadcast payments
Signed payments are saved before they are broadcast. If a broadcast fails, or you are not sure whether it went through, retrying resends the same signed transaction. Once a transaction has been broadcast, closing the app, locking the phone or going offline cannot cancel it. Treat the review screen as the point of no return, because on a public blockchain it is.
What the network sees
A wallet has to talk to the network it uses, and those connections are not anonymous.
- Bitcoin. On Android the app connects to Bitcoin peers to sync and broadcast. Peers can see your connection address and may infer wallet activity from what you request. On iOS, Bitcoin data and broadcasts go through mempool.space over HTTPS.
- Ethereum and Solana. Balance queries, fee simulations and broadcasts go to an RPC provider over HTTPS. Queries can include your public addresses and, before a broadcast, the amounts you are preparing to send.
- Prices. Exchange rates are fetched from a public Coinbase endpoint. The request includes no addresses, balances or history.
- Everything on-chain is public and permanent. Signed transactions disclose their contents to everyone.
Put plainly: network providers can receive your public addresses, balances, recipients, amounts and signed transactions, together with your IP address and request timing, and some queries reveal a planned transfer before it is broadcast. These flows are how a wallet works and are entirely separate from the optional analytics described on the privacy page; turning analytics off does not change what a network provider sees.
Private keys, seed material and wallet passwords are not sent to network or market-data providers. The full list of providers, what each receives and how long they may keep it is in the Android privacy policy and the iOS privacy section.
Honest limits
- The app has not been independently security-audited.
- Local signing, device protection and platform storage safeguards help protect your information. They do not guarantee security or anonymity on every device, and a compromised phone can compromise any wallet running on it.
- The app includes no advertising SDK, and Android 1.1.0 has no optional first-party analytics event stream. Optional, consent-based analytics arrive in iOS 1.0.1 and Android 1.2.0; they are off until you turn them on and exclude seeds, keys, addresses, balances, amounts and transaction identifiers. None of this changes what network providers receive in the course of ordinary wallet use. See privacy.
- No security claim on this page is a guarantee. If you find a problem, we want to hear about it.
This website
SatKeep.com is a static website. It has no login, no wallet-connect, no import or “verify your wallet” form, and it never asks for a recovery phrase, private key or password. Our own page code uses system fonts and does not embed advertising or visitor-analytics tools. Hosting infrastructure may process request metadata and use security cookies or checks to protect the service; see website privacy. If a page claiming to be SatKeep asks you to enter wallet secrets, it is not this website.
Good habits
- Make your backup before you receive anything of value, and test that you can open it. On Android, store the encrypted file somewhere you will still have in five years, and keep the backup password somewhere separate.
- Write recovery words on paper or metal, never in a photo, a note-taking app or a cloud document.
- Send a small test amount first when paying a new address or using a new network.
- Read the review screen slowly. Compare the full recipient address with the one you were given, not just the first and last characters, and confirm the network name.
- Keep your phone updated and its screen lock on. The wallet is only as safe as the device it runs on.
- Be suspicious of anyone who contacts you about your wallet. The publisher does not reach out to users asking for information.
Reporting a problem
Found a bug or a security concern? Write to info@rowix.com with the app version, your operating-system version and what you observed. Never include recovery words, private keys, passwords or unencrypted wallet files; a report never needs them.