> For the complete documentation index, see [llms.txt](https://docs.creditcoin.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.creditcoin.org/wallet/legal/supplement.md).

# Supplement

PenguinWallet is non-custodial wallet software for iOS and Android and is the rebranded product formerly known as Credit Wallet. It may support wallet creation and recovery, recovery-phrase management, cloud backups such as iCloud or Google Drive, multiple wallets and addresses, balance display, sending and receiving, QR receipt, address book, Creditcoin Native/EVM transfers, EVM-compatible assets, WalletConnect, token swaps, rewards, game access, testnet mode, Firebase Analytics, Firebase Crashlytics, and similar features.

**1. Non-Custodial Wallet Software**

PenguinWallet is non-custodial wallet software. The Company does not hold your private keys, recovery phrase, passkeys, wallet credentials, or assets. If you lose your recovery phrase, private key, passkeys, device, or cloud-backup access, the Company cannot recover your wallet or assets.

**2. Recovery Phrase, Passkeys, Biometrics, and Cloud Backup**

1. You are responsible for securely storing your recovery phrase, private keys, passkeys, device, biometric authentication, PIN, password, cloud account, and backups.
2. Biometric information such as fingerprint or face recognition is usually processed through local device security features, and the Company does not intentionally collect, transmit, or store it. Processing by the device, operating system, or cloud provider is governed by that provider’s policies.
3. If you enable iCloud, Google Drive, or other cloud backup, the backup may rely on third-party services outside the Company’s control. The Company does not guarantee backup availability, security, restoration success, compatibility, or integrity.

**3. Transfers, WalletConnect, dApps, and Swaps**

Before signing a transaction, you must verify the recipient address, network, token contract, amount, gas fees, approval scope, dApp authenticity, and transaction details. WalletConnect and third-party dApps may request signatures or approvals that enable asset transfers or approvals. Malicious dApps, phishing sites, malicious signatures, token approvals, fake tokens, address poisoning, and clipboard attacks can cause permanent loss.

In-app swaps, rewards, games, and ecosystem links may be provided through PenguinSwap, PenguinBase, third-party protocols, or other services and may be subject to additional terms and risks.

**4. Firebase Analytics and Crashlytics**

PenguinWallet may process limited app usage, diagnostic, crash, and performance information through Firebase Analytics and Firebase Crashlytics. The Company does not intentionally record private keys, recovery phrases, passkeys, full wallet credentials, exact transfer amounts, full dApp URLs, or full transaction details in Firebase event parameters, custom keys, or custom logs. Developers must ensure that such information is not included in logs.

**5. Unsupported Assets and Networks; No Deposit Insurance**

Assets sent to unsupported blockchains, networks, or assets may be inaccessible or permanently lost. PenguinWallet and digital assets are not bank deposits and are not insured by the FDIC, SIPC, or any other governmental deposit-insurance scheme.

**6. PenguinWallet Risk Examples**

Seed-phrase phishing, address poisoning, malicious signatures or approvals, SIM swapping, device compromise, cloud-backup compromise, malware, fake customer support, and fake airdrops may occur. Because of the non-custodial structure, the Company cannot freeze, recover, or restore assets.