Privacy

Box is built so that there is as little to protect as possible.

On your phone only

Look up balances and history for some networks, answer, and forget the request. They keep no wallet addresses and no IP addresses, only counts of how many lookups were made each day.
For passkey backups: your passkey’s public key and the locked copy of your secret phrase. The key that opens it is made by your passkey on your phone and never reaches Box.

Google Drive, only if you turn on Google backup: the same locked copy goes to a private folder in your own Drive that only Box can see. Google can’t open it (see Your Google account).
Public network nodes, to read balances and send transactions.
CoinGecko, for prices.
WalletConnect, when you connect to an app.

Only if you choose Google backup (“Continue with Google”). Box asks for two things: your Google account’s email address, and access to its own private app folder in your Google Drive. It can’t see, open or change any other file in your Drive.
Box uses them only to save, update and read your locked backup file, and to show which account holds it.
The email address stays on your phone. Google’s access pass is held in memory for one save or restore, then dropped. Nothing from your Google account goes to Box’s servers, and nothing is shared, sold or used for ads.
To delete it, turn off Google backup in Box (Settings → Backups), which removes the file from your Drive, or remove Box’s access at myaccount.google.com/permissions.
Box’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.