B28 is a non-custodial wallet. Your keys are created on your own phone and stored there, in the device's secure hardware behind your biometrics. We never hold them, never see them, and never have access to your funds. That is a genuine shift in power: no one can freeze your account, no one can move your money without you, and no one can lock you out. It also means the responsibility to protect one short list of words sits with you. This page explains both sides honestly.
What a private key and recovery phrase are
Behind every crypto address is a private key, a secret number that proves ownership and authorises spending. To make that key easier to back up, it is represented as a recovery phrase, a list of 12 or 24 ordinary words in a fixed order. That phrase is your wallet. Anyone who has it can recreate your wallet on any device and take everything you hold. Anyone who does not have it cannot.
Your funds themselves do not live inside the app or on your phone. They live on the blockchain. Your recovery phrase is simply the key that controls them. This distinction matters, and it is why losing a phone is survivable while losing a phrase is not. We cover that in Lost or stolen phone.
How B28 stores your keys
When you create a wallet, B28 generates your recovery phrase on your device and stores it in the phone's secure hardware, the same protected area that guards your fingerprint and face data, locked behind your biometrics or device PIN. The phrase does not travel to our servers, because we do not run a server that holds it. You can export your recovery phrase at any time to write it down or move to another wallet. It is yours, fully, always.
The trade-off of true self-custody is simple and we will not soften it: if you lose your recovery phrase, no one can recover it for you, including us. There is no reset link and no support override. This is the cost of an account that no one else can seize. Treat your phrase accordingly.
The rules that keep you safe
- Never share your recovery phrase with anyone. Not support, not a friend, not a website, not a wallet-checker.
- B28 will never ask you for it. Any message, app, or person asking for your phrase is trying to steal from you. Full stop.
- Never type it into a website or chat. You type it only into your own wallet, and only to restore it on a device you control.
- Never store it as a photo, screenshot, email, or note in the cloud. Anything synced online can be stolen if that account is breached.
Most losses are not clever hacks. They are people being talked into revealing their phrase. See Scams & fraud for the exact tricks used.
How to back up safely
A good backup is offline, durable, and in your control. A few minutes now prevents a permanent loss later.
- Write it on paper, by hand, in the exact order shown, and double-check every word.
- Store it somewhere private and safe from fire, water, and prying eyes, such as a locked drawer or a home safe.
- Consider a second copy in a separate location, so one accident does not wipe out your only backup.
- For larger amounts, consider a steel backup plate that survives fire and flooding better than paper.
- Keep it offline. The whole point is that a phrase no computer has ever seen cannot be stolen by one.
What this gives you
Self-custody means your money answers to you alone. It cannot be frozen, censored, or borrowed against your will, and it does not depend on us staying in business. In exchange, you protect one short phrase the way you would protect the deed to your home. Do that, and you have something most banking can never offer: an account that is genuinely yours.
To go deeper on the model, read What non-custodial really means. To prepare for the worst case, read Lost or stolen phone.