Self-custody

Nearly every wallet on the market calls itself self-custodial, including plenty that keep pieces of their users' keys on company servers. The label is cheap, so the better question is the one underneath. Who has to cooperate before you can move or recover your money?

Who holds what

You hold two keys. The spending key exists in your phone's secure storage and nowhere else. The recovery key exists as an encrypted file, in your cloud, your inbox, or wherever you chose to keep it, locked with a password that has never left your phone.

We hold neither, in any form. No copy, no share, no fragment, no escrow, no master key. Our database stores your keys' public addresses, which identify your wallet on the network but can't move anything. If you picked the email backup, our server passed the locked file along to your inbox without being able to open it. The two-key model covers what each key does.

What we cannot do

Your wallet is a contract on Base, and the contract reserves no function for us. Everything below is a property of that public code, not a policy you're asked to trust.

We cannot move or spend your money. No signature we're able to produce will make your account release a cent.

We cannot change or reset your keys. Key changes require your recovery key, which we don't have. The same goes for your PIN, which never leaves your phone.

We cannot freeze, pause, or seize your wallet. The contract has no owner, no admin role, and no switch of any kind reserved for anyone.

We cannot change your wallet's code. Accounts can be upgraded, and each account accepts an upgrade only from its own recovery key.

Money waiting in a payment link follows the same rules. The escrow it sits in has no owner and can do two things, pay whoever holds the link or return the money to the sender. When an expired link comes back to you automatically, that return runs through a public function anyone could call. We simply pay its gas.

What we can do

We run everything around the wallet, and that's a real dependency. The app, the servers that prepare and submit your transactions, the gas sponsorship, the username directory, and the partner connections for deposits and cash-outs all run on our infrastructure.

Those services carry legal obligations, and in rare cases, a court order or sanctions law being the realistic ones, we can be required to cut an account off from them. In practice that means our services stop serving the account: no prepared transactions, no sponsored gas, no partner rails. Even then, your money stays in your wallet and stays movable with your keys, on a network we don't control.

One more party holds a real power here, and it isn't us. Circle, the issuer of USDC, can freeze the USDC at a specific address when a court or law enforcement orders it. What are digital dollars? explains that switch and why the regulated kind of digital dollar carries it.

If MozaikPay disappeared

Custody claims are best tested against the day the company is gone. If we shut down tomorrow, both keys would still be where they've always been, on your phone and in your backup, with no piece of them lost with us. Your account would still be a standard, public smart account on Base, and a competent developer, armed with your recovery key, could rotate in fresh keys and move your funds through public infrastructure, with no MozaikPay server anywhere in the path.

You'd lose the smoothness. The app, the usernames, the sponsored gas, and the partner rails for cashing out would all stop.

What it asks of you

A wallet we can't reach into is also a wallet we can't rescue. We can't reverse a payment you signed, reset a backup password you forgot, or rebuild a backup file you lost. Your side of the arrangement is a short list: keep your PIN to yourself, know where your backup file lives, and remember its password. If any of them is ever in doubt, you can change your PIN or change your recovery key right away.