diff --git a/.env.example b/.env.example
index cdd779a..1f2b5ba 100644
--- a/.env.example
+++ b/.env.example
@@ -24,9 +24,19 @@ EXPO_PUBLIC_APP_ENV=development
 # Get a project ID at https://cloud.walletconnect.com
 # EXPO_PUBLIC_WALLET_CONNECT_PROJECT_ID=
 
-# Embedded wallets (Privy, optional)
-# Enable Email and Google login plus Ethereum embedded wallets in the Privy
-# dashboard. Both public values are safe to ship; never put a Privy secret here.
+# ─── Embedded Wallets — Privy (optional) ──────────────────────────────
+# Enables social/email login with automatic wallet creation for non-crypto
+# native users. When both values are set, the onboarding screen shows a
+# "Get started without a wallet" option backed by Privy's MPC embedded wallets.
+#
+# Setup:
+#   1. Create a Privy app at https://dashboard.privy.io
+#   2. Enable "Email" and "Google" login methods
+#   3. Enable "Embedded Wallets → Ethereum" with createOnLogin = users-without-wallets
+#   4. Copy the App ID and Client ID below
+#
+# Both values are public (safe to ship in the app binary). Never put a Privy
+# secret key here. See docs/embedded-wallet-provider.md for the full evaluation.
 # EXPO_PUBLIC_PRIVY_APP_ID=
 # EXPO_PUBLIC_PRIVY_CLIENT_ID=
 
diff --git a/.maestro/08-embedded-wallet-entry.yaml b/.maestro/08-embedded-wallet-entry.yaml
index 9bdb9eb..f7f0069 100644
--- a/.maestro/08-embedded-wallet-entry.yaml
+++ b/.maestro/08-embedded-wallet-entry.yaml
@@ -1,19 +1,67 @@
 appId: xyz.guildpass.mobile
 ---
-# E2E Test: Embedded wallet entry point
+# E2E Test: Embedded wallet onboarding flow
+#
 # Run this flow in a build configured with EXPO_PUBLIC_PRIVY_APP_ID and
 # EXPO_PUBLIC_PRIVY_CLIENT_ID. OTP completion is intentionally not automated:
 # it requires a real email inbox and verifies the provider-hosted flow.
+#
+# CI note: For automated CI runs, use a Privy test-mode app ID that returns
+# deterministic OTP codes, or mock the Privy SDK at the provider level.
 
 - launchApp:
     clearState: true
+
+# ── Onboarding screen renders ─────────────────────────────────────────
 - assertVisible:
     id: "onboarding-screen"
 - assertVisible:
     id: "onboarding-embedded-wallet-button"
+
+# ── Tap into embedded wallet flow ──────────────────────────────────────
 - tapOn:
     id: "onboarding-embedded-wallet-button"
 - assertVisible:
     id: "embedded-wallet-onboarding"
+
+# ── Custody disclosure is visible before sign-in ───────────────────────
+- assertVisible:
+    id: "custody-disclosure"
+- assertVisible:
+    text: "About your embedded wallet"
+
+# ── Expand disclosure and verify detail content ────────────────────────
+- tapOn:
+    id: "custody-disclosure-toggle"
+- assertVisible:
+    id: "custody-disclosure-details"
+- assertVisible:
+    text: "How your keys are secured"
+- assertVisible:
+    text: "Trade-offs vs. self-custody"
+- assertVisible:
+    id: "custody-disclosure-learn-more"
+
+# ── Collapse disclosure ────────────────────────────────────────────────
+- tapOn:
+    id: "custody-disclosure-toggle"
+- assertNotVisible:
+    id: "custody-disclosure-details"
+
+# ── Sign-in UI elements are present ───────────────────────────────────
+- assertVisible:
+    id: "social-google-button"
 - assertVisible:
     id: "embedded-wallet-email-input"
+- assertVisible:
+    id: "embedded-wallet-email-button"
+
+# ── "I have a wallet" back button returns to onboarding choice ─────────
+- assertVisible:
+    id: "embedded-wallet-back-button"
+- tapOn:
+    id: "embedded-wallet-back-button"
+- assertVisible:
+    id: "onboarding-embedded-wallet-button"
+- assertVisible:
+    id: "onboarding-get-started-button"
diff --git a/.maestro/15-embedded-wallet-disconnect.yaml b/.maestro/15-embedded-wallet-disconnect.yaml
new file mode 100644
index 0000000..aaf08bf
--- /dev/null
+++ b/.maestro/15-embedded-wallet-disconnect.yaml
@@ -0,0 +1,32 @@
+appId: xyz.guildpass.mobile
+---
+# E2E Test: Embedded wallet disconnect flow
+#
+# Verifies that an embedded-wallet connection displays the correct connection
+# label on the profile screen and that disconnect returns the user to onboarding.
+#
+# Prerequisites: This flow assumes the app is already connected with an embedded
+# wallet. In CI, seed the wallet store directly via Maestro's runScript or use a
+# Privy test-mode build that auto-completes login.
+#
+# NOTE: Full Privy SDK logout verification cannot be done in E2E without mocking
+# the provider. This test verifies the UI contract: disconnect clears the wallet
+# state and navigates back to onboarding.
+
+# ── Verify embedded wallet is shown on profile ─────────────────────────
+- assertVisible:
+    id: "profile-screen"
+- assertVisible:
+    id: "profile-connected"
+- assertVisible:
+    text: "Embedded Wallet"
+- assertVisible:
+    id: "connected-wallet-address"
+
+# ── Disconnect ─────────────────────────────────────────────────────────
+- tapOn:
+    id: "wallet-disconnect-button"
+
+# ── Verify return to wallet connect form ───────────────────────────────
+- assertVisible:
+    id: "wallet-connect-form"
diff --git a/README.md b/README.md
index 6f7fbe1..f3b8094 100644
--- a/README.md
+++ b/README.md
@@ -87,6 +87,7 @@ The application is built on a robust, feature-driven foundation designed for lon
 | `app/`                   | Expo Router file-based pages and layouts     |
 | `app/access-scanner.tsx` | QR code scanner screen using expo-camera     |
 | `src/features/access/`   | Access check hooks and QR payload validation |
+| `src/features/wallet/`   | Wallet connectors, embedded wallet (Privy), stores |
 | `src/`                   | Feature modules, hooks, stores, and services |
 | `docs/`                  | Architecture and integration guides          |
 | `tests/`                 | Vitest unit tests                            |
@@ -252,7 +253,7 @@ Deep links work when the app is cold-started (not already running). The app will
 ## 🗺️ Roadmap
 
 - [ ] **Native Wallet Integration**: Support for WalletConnect, MetaMask, and Coinbase Wallet.
-- [ ] **Smart Onboarding**: Social login and embedded wallets for non-crypto native users.
+- [x] **Smart Onboarding**: Social login and embedded wallets for non-crypto native users.
 - [x] **Push Notifications**: Real-time alerts for role updates and access grants.
 - [x] **QR Access Verification**: Scan GuildPass QR codes to verify token-gated resource access from the mobile app.
 - [ ] **Offline Resilience**: Advanced caching layer for viewing memberships without connectivity.
diff --git a/docs/architecture.md b/docs/architecture.md
index c213802..9a8d5f0 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -65,6 +65,29 @@ declared in `src/lib/`, so the fan-out is readable, ordered, and awaitable in on
 Adding a cross-feature transition means adding it to one of these modules, not importing
 another feature's store into a hook or component.
 
+### Wallet providers
+
+Three wallet paths are supported, all converging through the `WalletConnector` interface
+into `useWalletStore`:
+
+| Path | Provider | Connection kind | How it works |
+|---|---|---|---|
+| **Manual entry** | None | `manual` | User pastes an EVM address; `createManualConnector` wraps it |
+| **WalletConnect** | WalletConnect v2 | `walletconnect` | WC modal → EIP-1193 → `createWalletConnectConnector` |
+| **Embedded wallet** | Privy (`@privy-io/expo`) | `embedded` | Email OTP or Google OAuth → Privy provisions MPC wallet → `createEmbeddedConnector` wraps the address |
+
+**Key design principle:** Privy is only the provisioning layer. Once the embedded wallet
+address enters `useWalletStore`, every downstream flow (memberships, guilds, access checks,
+sync, attestations) sees a standard EVM address. No screen or hook needs to know the wallet
+was provisioned by Privy.
+
+The embedded path is feature-flagged via `EXPO_PUBLIC_PRIVY_APP_ID` and
+`EXPO_PUBLIC_PRIVY_CLIENT_ID` environment variables. When both are set,
+`isEmbeddedWalletEnabled` is `true` and the onboarding screen offers the social/email option.
+
+See `docs/embedded-wallet-provider.md` for the provider evaluation, security model, and
+custody trade-off documentation.
+
 ### Selectors
 
 Subscribe with a selector, never by calling the store hook bare. `useWalletStore()`
diff --git a/docs/embedded-wallet-provider.md b/docs/embedded-wallet-provider.md
new file mode 100644
index 0000000..b1cb52a
--- /dev/null
+++ b/docs/embedded-wallet-provider.md
@@ -0,0 +1,131 @@
+# Embedded Wallet Provider Evaluation
+
+> **Decision:** Privy (`@privy-io/expo`)  
+> **Date:** 2026-07-27  
+> **Status:** Adopted — integrated into `src/features/wallet/`
+
+## Evaluation Criteria
+
+| Criterion | Weight | Notes |
+|---|---|---|
+| React Native / Expo SDK maturity | Critical | Must have first-party Expo support; no bare-RN-only workarounds |
+| Social login providers | High | Email + Google required; Apple required for App Store |
+| Wallet provisioning model | High | Automatic on first login; no user ceremony |
+| Custody / key security model | High | Must NOT be fully custodial; MPC or TEE preferred |
+| Chain support | Medium | All EVM chains (GuildPass is EVM-only) |
+| Cost at launch scale | Medium | Free tier or low-cost for <1000 MAU |
+| Wallet export | Medium | Users should be able to extract their key if desired |
+
+---
+
+## Providers Evaluated
+
+### Privy ✅ (Selected)
+
+| Criterion | Assessment |
+|---|---|
+| **SDK** | `@privy-io/expo` — first-party, actively maintained, Expo-native. Already in `package.json` |
+| **Social login** | Email OTP, Google, Apple, Twitter, Discord, GitHub, Farcaster |
+| **Wallet provisioning** | `createOnLogin: "users-without-wallets"` — zero-ceremony Ethereum wallet creation |
+| **Custody model** | **MPC 2-of-3 key splitting**: device share (Secure Enclave), Privy infra share (HSM-backed), recovery share (encrypted to user's auth factor). No single party ever holds the full private key |
+| **Chain support** | All EVM chains |
+| **Cost** | Free: 1,000 MAU. Growth plan: usage-based pricing |
+| **Wallet export** | Supported — users can extract their full private key through the SDK |
+| **Recovery** | Re-authenticate with same email/social account on any device |
+
+**Why Privy:**
+1. Only provider with a first-party, production-ready Expo SDK (`@privy-io/expo`)
+2. MPC key model is the gold standard for embedded wallets — no seed phrase, no full custodial risk
+3. `createOnLogin` config eliminates all wallet ceremony
+4. Already integrated and partially wired in the codebase
+5. Auth-factor-based recovery means users can't lose access by losing a device
+
+### Web3Auth ❌
+
+| Criterion | Assessment |
+|---|---|
+| **SDK** | `@web3auth/react-native-sdk` — available but heavier; requires additional native module configuration that conflicts with Expo managed workflow |
+| **Social login** | Broad provider support |
+| **Custody model** | Threshold key splitting (similar to MPC) |
+| **Why not** | Heavier SDK footprint, more complex configuration, less Expo-native than Privy. Would require `expo prebuild` for native module linking |
+
+### Magic (now Magic.link) ❌
+
+| Criterion | Assessment |
+|---|---|
+| **SDK** | `@magic-sdk/react-native` — deprecated React Native SDK, limited maintenance |
+| **Why not** | Deprecated RN SDK with no Expo-specific support. Would require significant custom bridging |
+
+### Turnkey ❌
+
+| Criterion | Assessment |
+|---|---|
+| **SDK** | Lower-level API; no React Native SDK. Requires building custom auth + wallet UI |
+| **Why not** | Too low-level for a mobile app. Would require building the entire auth flow, wallet UI, and key management from scratch |
+
+### Particle Network ❌
+
+| Criterion | Assessment |
+|---|---|
+| **SDK** | `@particle-network/rn-auth` — available but less mature Expo support |
+| **Why not** | Less mature Expo support compared to Privy. Smaller developer community |
+
+---
+
+## Security Model
+
+### What Privy Protects Against
+
+- **Seed phrase loss/theft**: No seed phrase exists. Key shares are distributed across device, Privy infrastructure, and an auth-factor-encrypted recovery share.
+- **Device loss**: User re-authenticates with their email/social account on a new device to reconstruct their key.
+- **Single point of compromise**: MPC ensures no single party (not Privy, not the device) ever holds the full private key.
+
+### What Privy Does NOT Protect Against
+
+- **Privy infrastructure compromise**: If Privy's HSM-backed infrastructure is breached AND the attacker obtains the device share, the key could be reconstructed. This is a fundamental trust trade-off of any embedded wallet provider.
+- **Social account takeover + device theft**: An attacker who compromises both the user's auth factor (email/Google account) AND their device could potentially reconstruct the key.
+- **Nation-state actors**: Out of scope, consistent with the project's [threat model](./threat-model.md).
+
+### Alignment with GuildPass Threat Model
+
+The existing [threat model](./threat-model.md) already documents "Future: embedded private keys" as a **Critical** asset with planned storage in `expo-secure-store` / Secure Enclave. Privy's device share leverages exactly this: the device key share is stored in the platform's hardware-backed secure enclave (iOS Keychain / Android Keystore), aligned with the existing security architecture.
+
+---
+
+## Integration Architecture
+
+```
+┌─────────────────────────────────────────────────────┐
+│                 Onboarding Screen                    │
+│  ┌─────────────────────────────────────────────────┐│
+│  │  CustodyDisclosure (trade-off explanation)      ││
+│  │  Email OTP / Google OAuth sign-in               ││
+│  └─────────────────────────────────────────────────┘│
+│                        │                             │
+│                        ▼                             │
+│  ┌─────────────────────────────────────────────────┐│
+│  │  Privy SDK (useLoginWithEmail / useLoginWithOAuth)│
+│  │  → auto-creates embedded Ethereum wallet        ││
+│  │  → returns EVM address                          ││
+│  └─────────────────────────────────────────────────┘│
+│                        │                             │
+│                        ▼                             │
+│  ┌─────────────────────────────────────────────────┐│
+│  │  createEmbeddedConnector(address)               ││
+│  │  → same WalletConnector interface as manual/WC  ││
+│  └─────────────────────────────────────────────────┘│
+│                        │                             │
+│                        ▼                             │
+│  ┌─────────────────────────────────────────────────┐│
+│  │  useWalletStore                                 ││
+│  │  walletAddress = "0x...", connectionKind = "embedded" │
+│  └─────────────────────────────────────────────────┘│
+│                        │                             │
+│                        ▼                             │
+│  All downstream flows (memberships, guilds, access   │
+│  checks, sync, attestations) see a standard EVM      │
+│  address — completely provider-agnostic.             │
+└─────────────────────────────────────────────────────┘
+```
+
+Key design principle: **Privy is only the provisioning layer.** Once the embedded wallet address enters `useWalletStore`, every downstream flow treats it identically to a manually-entered or WalletConnect address. No screen, hook, or service needs to know the wallet was provisioned by Privy.
diff --git a/src/features/wallet/CustodyDisclosure.tsx b/src/features/wallet/CustodyDisclosure.tsx
new file mode 100644
index 0000000..4ee6b9a
--- /dev/null
+++ b/src/features/wallet/CustodyDisclosure.tsx
@@ -0,0 +1,102 @@
+import React, { useState } from "react";
+import { View, Text, TouchableOpacity, Linking } from "react-native";
+
+const PRIVY_SECURITY_URL = "https://docs.privy.io/guide/security";
+
+/**
+ * Custody disclosure shown during embedded-wallet onboarding.
+ *
+ * Renders a summary line that is always visible, with a collapsible detail
+ * section the user can expand. This satisfies the acceptance criterion of
+ * "clear, honest in-app explanation" without forcing a blocking modal that
+ * would hurt conversion.
+ */
+export function CustodyDisclosure({ testID = "custody-disclosure" }: { testID?: string }) {
+  const [expanded, setExpanded] = useState(false);
+
+  return (
+    <View
+      testID={testID}
+      className="bg-indigo-50 dark:bg-indigo-950/40 border border-indigo-200 dark:border-indigo-800 rounded-2xl p-4 mb-4"
+    >
+      {/* ── Always-visible summary ─────────────────────────────────── */}
+      <TouchableOpacity
+        onPress={() => setExpanded((prev) => !prev)}
+        accessibilityRole="button"
+        accessibilityLabel={expanded ? "Collapse wallet details" : "Expand wallet details"}
+        accessibilityState={{ expanded }}
+        testID="custody-disclosure-toggle"
+        activeOpacity={0.7}
+      >
+        <View className="flex-row items-center justify-between">
+          <View className="flex-row items-center flex-1">
+            <Text className="text-lg mr-2">🔐</Text>
+            <Text className="text-sm font-semibold text-indigo-900 dark:text-indigo-200 flex-1">
+              About your embedded wallet
+            </Text>
+          </View>
+          <Text className="text-indigo-500 dark:text-indigo-400 text-xs">
+            {expanded ? "Hide ▲" : "Details ▼"}
+          </Text>
+        </View>
+        <Text className="text-xs text-indigo-700 dark:text-indigo-300 mt-1">
+          A secure wallet will be created for you automatically — no seed phrase needed.
+        </Text>
+      </TouchableOpacity>
+
+      {/* ── Expanded detail section ────────────────────────────────── */}
+      {expanded ? (
+        <View className="mt-3 pt-3 border-t border-indigo-200 dark:border-indigo-800" testID="custody-disclosure-details">
+          <DetailItem
+            emoji="🔑"
+            title="How your keys are secured"
+            body="Your wallet's private key is split using MPC (Multi-Party Computation). No single party — not Privy, not your device — ever holds the full key. Shares are stored in hardware-backed secure enclaves."
+          />
+
+          <DetailItem
+            emoji="🔄"
+            title="Recovery"
+            body="You can recover your wallet by signing in with the same email or social account on any device. No seed phrase to lose or protect."
+          />
+
+          <DetailItem
+            emoji="⚖️"
+            title="Trade-offs vs. self-custody"
+            body="You trust Privy's infrastructure to hold one key share securely. In exchange, you don't need to manage seed phrases or install a separate wallet app. You can export your full private key at any time from your account settings."
+          />
+
+          <DetailItem
+            emoji="🌐"
+            title="Interoperability"
+            body="Your embedded wallet address works exactly like any other Ethereum address. Guilds, memberships, and access checks treat it identically to a self-custodied wallet."
+          />
+
+          <TouchableOpacity
+            onPress={() => Linking.openURL(PRIVY_SECURITY_URL)}
+            accessibilityRole="link"
+            accessibilityLabel="Learn more about Privy security"
+            testID="custody-disclosure-learn-more"
+            className="mt-2"
+          >
+            <Text className="text-indigo-600 dark:text-indigo-400 text-xs font-medium underline">
+              Learn more about Privy's security model →
+            </Text>
+          </TouchableOpacity>
+        </View>
+      ) : null}
+    </View>
+  );
+}
+
+function DetailItem({ emoji, title, body }: { emoji: string; title: string; body: string }) {
+  return (
+    <View className="mb-3">
+      <Text className="text-xs font-semibold text-indigo-800 dark:text-indigo-200">
+        {emoji} {title}
+      </Text>
+      <Text className="text-xs text-indigo-700 dark:text-indigo-300 mt-0.5 leading-4">
+        {body}
+      </Text>
+    </View>
+  );
+}
diff --git a/src/features/wallet/EmbeddedWalletOnboarding.tsx b/src/features/wallet/EmbeddedWalletOnboarding.tsx
index 1c07c4a..52b8474 100644
--- a/src/features/wallet/EmbeddedWalletOnboarding.tsx
+++ b/src/features/wallet/EmbeddedWalletOnboarding.tsx
@@ -7,6 +7,7 @@ import {
   usePrivy,
 } from "@privy-io/expo";
 import { Button } from "../../components/Button";
+import { CustodyDisclosure } from "./CustodyDisclosure";
 import { useWallet } from "./useWallet";
 
 type Props = { onComplete(): void; onBack(): void };
@@ -81,6 +82,7 @@ export function EmbeddedWalletOnboarding({ onComplete, onBack }: Props) {
       <Text className="text-text-muted text-center">
         Sign in with email or Google. A secure wallet will be created for you automatically.
       </Text>
+      <CustodyDisclosure />
       <Button
         title="Continue with Google"
         onPress={loginWithGoogle}
diff --git a/src/features/wallet/EmbeddedWalletProvider.tsx b/src/features/wallet/EmbeddedWalletProvider.tsx
index 1b15fbe..1fb8669 100644
--- a/src/features/wallet/EmbeddedWalletProvider.tsx
+++ b/src/features/wallet/EmbeddedWalletProvider.tsx
@@ -1,10 +1,59 @@
-import React from "react";
-import { PrivyProvider } from "@privy-io/expo";
+import React, { useEffect } from "react";
+import { PrivyProvider, usePrivy, useEmbeddedEthereumWallet } from "@privy-io/expo";
 import { appConfig } from "../../config/appConfig";
+import { setPrivySessionRef } from "./privySession";
+import { useWalletStore } from "./wallet.store";
+import { endWalletSession } from "../../lib/walletLifecycle";
 
 /** Whether this build is configured for social/email embedded-wallet onboarding. */
 export const isEmbeddedWalletEnabled = Boolean(appConfig.privyAppId && appConfig.privyClientId);
 
+/**
+ * Bridges the Privy React-hook state into the imperative `privySession` module
+ * so non-component code (disconnect, reset) can call `privyLogout()`.
+ *
+ * Also acts as a cold-start session guard: if the Zustand wallet store
+ * rehydrates with `connectionKind: "embedded"` but Privy is no longer
+ * authenticated (session expired between launches), the guard forces a
+ * clean disconnect so the user re-onboards rather than operating with a
+ * stale embedded address.
+ */
+function PrivySessionBridge() {
+  const { isReady, authenticated, logout } = usePrivy();
+  const { wallets } = useEmbeddedEthereumWallet();
+
+  // Keep the imperative ref up to date for non-component callers
+  useEffect(() => {
+    if (!isReady) return;
+
+    setPrivySessionRef({
+      logout,
+      isAuthenticated: () => authenticated,
+      getWalletAddress: () => wallets[0]?.address ?? null,
+    });
+
+    return () => {
+      setPrivySessionRef(null);
+    };
+  }, [isReady, authenticated, logout, wallets]);
+
+  // ── Cold-start session guard ──────────────────────────────────────
+  // Runs once Privy reports ready. If the wallet store thinks we're on an
+  // embedded wallet but Privy disagrees, tear down the stale session.
+  useEffect(() => {
+    if (!isReady) return;
+
+    const { connectionKind, isConnected } = useWalletStore.getState();
+    if (connectionKind === "embedded" && isConnected && !authenticated) {
+      // Privy session expired — force clean disconnect
+      useWalletStore.getState().disconnect();
+      void endWalletSession();
+    }
+  }, [isReady, authenticated]);
+
+  return null;
+}
+
 /**
  * Keeps the SDK optional for development builds that do not have Privy keys.
  * In configured builds Privy creates an Ethereum wallet at login; its address
@@ -19,6 +68,7 @@ export function EmbeddedWalletProvider({ children }: { children: React.ReactNode
       clientId={appConfig.privyClientId!}
       config={{ embedded: { ethereum: { createOnLogin: "users-without-wallets" } } }}
     >
+      <PrivySessionBridge />
       {children}
     </PrivyProvider>
   );
diff --git a/src/features/wallet/privySession.ts b/src/features/wallet/privySession.ts
new file mode 100644
index 0000000..8ba786c
--- /dev/null
+++ b/src/features/wallet/privySession.ts
@@ -0,0 +1,58 @@
+/**
+ * Privy session utilities — lazy-imported by `useWallet` and `resetAppState`
+ * so the Privy SDK only enters the module graph when actually configured.
+ *
+ * The Privy Expo SDK exposes its state through React hooks, which cannot be
+ * called outside a component. This module bridges that gap for imperative
+ * call sites (disconnect, reset) by accessing the Privy instance through
+ * a module-level reference set by `EmbeddedWalletProvider`.
+ *
+ * IMPORTANT: This module must NOT be statically imported by `useWallet.ts`
+ * or `walletConnector.service.ts`. Use dynamic `import("./privySession")`
+ * to keep `@privy-io/expo` out of test suites that don't configure it.
+ */
+
+type PrivySessionRef = {
+  logout: () => Promise<void>;
+  isAuthenticated: () => boolean;
+  getWalletAddress: () => string | null;
+};
+
+let _ref: PrivySessionRef | null = null;
+
+/**
+ * Called by `EmbeddedWalletProvider` once the Privy SDK is ready.
+ * This allows imperative code to call logout without a React hook.
+ */
+export function setPrivySessionRef(ref: PrivySessionRef | null): void {
+  _ref = ref;
+}
+
+/**
+ * Ends the Privy session. Safe to call when Privy is not configured or
+ * the user never signed in — returns silently in both cases.
+ */
+export async function privyLogout(): Promise<void> {
+  if (!_ref) return;
+  try {
+    await _ref.logout();
+  } catch {
+    // Already logged out or SDK not initialised — both are acceptable.
+  }
+}
+
+/**
+ * Whether the Privy SDK currently considers the user authenticated.
+ * Returns `false` when Privy is not configured.
+ */
+export function isPrivyAuthenticated(): boolean {
+  return _ref?.isAuthenticated() ?? false;
+}
+
+/**
+ * Returns the embedded wallet address from the Privy SDK, or `null` if
+ * the user is not authenticated or has no embedded wallet.
+ */
+export function getPrivyWalletAddress(): string | null {
+  return _ref?.getWalletAddress() ?? null;
+}
diff --git a/src/features/wallet/useWallet.ts b/src/features/wallet/useWallet.ts
index 57ea2f1..667781a 100644
--- a/src/features/wallet/useWallet.ts
+++ b/src/features/wallet/useWallet.ts
@@ -87,6 +87,16 @@ export const useWallet = (): {
         await wcProvider.disconnect().catch(() => {});
       }
     }
+    // If connected via embedded wallet, end the Privy session so the
+    // provider doesn't think the user is still authenticated on relaunch.
+    if (connectionKind === "embedded") {
+      try {
+        const { privyLogout } = await import("./privySession");
+        await privyLogout();
+      } catch {
+        // Privy not configured or already logged out — acceptable.
+      }
+    }
     // Clear this feature's own state before the cross-feature teardown, so a
     // screen re-rendering mid-disconnect cannot refetch for the outgoing wallet.
     storeDisconnect();
diff --git a/src/lib/resetAppState.ts b/src/lib/resetAppState.ts
index bc44749..918ca08 100644
--- a/src/lib/resetAppState.ts
+++ b/src/lib/resetAppState.ts
@@ -10,6 +10,14 @@ import { clearIssuerKeyCache } from "../features/attestation/issuerKeyRegistry";
 
 export async function resetAppState(): Promise<void> {
   useWalletStore.getState().disconnect();
+  // End the Privy session if the user was on an embedded wallet. Dynamic import
+  // keeps @privy-io/expo out of the module graph when the SDK is not configured.
+  try {
+    const { privyLogout } = await import("../features/wallet/privySession");
+    await privyLogout();
+  } catch {
+    // Privy not configured — acceptable.
+  }
   await useSessionStore.getState().endSession();
   useAccessHistoryStore.getState().clearHistory();
   useSyncStore.getState().clearSyncState();
diff --git a/tests/custodyDisclosure.test.tsx b/tests/custodyDisclosure.test.tsx
new file mode 100644
index 0000000..3a8bacd
--- /dev/null
+++ b/tests/custodyDisclosure.test.tsx
@@ -0,0 +1,148 @@
+/**
+ * Tests for the CustodyDisclosure component.
+ *
+ * Verifies that the custody trade-off information renders correctly,
+ * that the expand/collapse interaction works, and that the learn-more
+ * link points to the right URL.
+ */
+
+import React from "react";
+import TestRenderer, { act, type ReactTestRenderer } from "react-test-renderer";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { CustodyDisclosure } from "../src/features/wallet/CustodyDisclosure";
+
+// Mock Linking.openURL so we can verify the learn-more link
+const mockOpenURL = vi.fn();
+vi.mock("react-native", async () => {
+  const actual = await vi.importActual<typeof import("react-native")>("react-native");
+  return {
+    ...actual,
+    Linking: {
+      ...actual.Linking,
+      openURL: (...args: unknown[]) => mockOpenURL(...args),
+    },
+  };
+});
+
+let renderer: ReactTestRenderer | null = null;
+
+afterEach(() => {
+  act(() => {
+    renderer?.unmount();
+  });
+  renderer = null;
+  mockOpenURL.mockReset();
+});
+
+describe("CustodyDisclosure", () => {
+  it("renders the summary text", () => {
+    act(() => {
+      renderer = TestRenderer.create(<CustodyDisclosure />);
+    });
+
+    const root = renderer!.root;
+    const disclosure = root.findByProps({ testID: "custody-disclosure" });
+    expect(disclosure).toBeTruthy();
+
+    // Summary should always be visible
+    const summaryTexts = root.findAllByType("Text" as any);
+    const hasAboutText = summaryTexts.some(
+      (node) =>
+        typeof node.props.children === "string" &&
+        node.props.children.includes("About your embedded wallet"),
+    );
+    expect(hasAboutText).toBe(true);
+  });
+
+  it("does not show details by default", () => {
+    act(() => {
+      renderer = TestRenderer.create(<CustodyDisclosure />);
+    });
+
+    const root = renderer!.root;
+    const detailNodes = root.findAllByProps({ testID: "custody-disclosure-details" });
+    expect(detailNodes).toHaveLength(0);
+  });
+
+  it("shows details when the toggle is tapped", () => {
+    act(() => {
+      renderer = TestRenderer.create(<CustodyDisclosure />);
+    });
+
+    const root = renderer!.root;
+    const toggle = root.findByProps({ testID: "custody-disclosure-toggle" });
+
+    act(() => {
+      toggle.props.onPress();
+    });
+
+    const details = root.findByProps({ testID: "custody-disclosure-details" });
+    expect(details).toBeTruthy();
+
+    // Check key content sections are present
+    const detailTexts = details.findAllByType("Text" as any);
+    const textContents = detailTexts
+      .map((n) => n.props.children)
+      .flat()
+      .filter((c): c is string => typeof c === "string");
+
+    expect(textContents.some((t) => t.includes("How your keys are secured"))).toBe(true);
+    expect(textContents.some((t) => t.includes("Recovery"))).toBe(true);
+    expect(textContents.some((t) => t.includes("Trade-offs vs. self-custody"))).toBe(true);
+    expect(textContents.some((t) => t.includes("Interoperability"))).toBe(true);
+  });
+
+  it("hides details when the toggle is tapped again", () => {
+    act(() => {
+      renderer = TestRenderer.create(<CustodyDisclosure />);
+    });
+
+    const root = renderer!.root;
+    const toggle = root.findByProps({ testID: "custody-disclosure-toggle" });
+
+    // Expand
+    act(() => {
+      toggle.props.onPress();
+    });
+    expect(root.findAllByProps({ testID: "custody-disclosure-details" })).toHaveLength(1);
+
+    // Collapse
+    act(() => {
+      toggle.props.onPress();
+    });
+    expect(root.findAllByProps({ testID: "custody-disclosure-details" })).toHaveLength(0);
+  });
+
+  it("has a learn-more link with the correct URL", () => {
+    act(() => {
+      renderer = TestRenderer.create(<CustodyDisclosure />);
+    });
+
+    const root = renderer!.root;
+    const toggle = root.findByProps({ testID: "custody-disclosure-toggle" });
+
+    // Expand to reveal the link
+    act(() => {
+      toggle.props.onPress();
+    });
+
+    const learnMore = root.findByProps({ testID: "custody-disclosure-learn-more" });
+    expect(learnMore).toBeTruthy();
+
+    // Simulate press
+    act(() => {
+      learnMore.props.onPress();
+    });
+
+    expect(mockOpenURL).toHaveBeenCalledWith("https://docs.privy.io/guide/security");
+  });
+
+  it("accepts a custom testID", () => {
+    act(() => {
+      renderer = TestRenderer.create(<CustodyDisclosure testID="custom-id" />);
+    });
+
+    const root = renderer!.root;
+    expect(root.findByProps({ testID: "custom-id" })).toBeTruthy();
+  });
+});
diff --git a/tests/embeddedConnector.test.tsx b/tests/embeddedConnector.test.tsx
index b82912e..b4360cb 100644
--- a/tests/embeddedConnector.test.tsx
+++ b/tests/embeddedConnector.test.tsx
@@ -132,3 +132,36 @@ describe("connectEmbeddedWallet", () => {
     expect(viaConnector.connectionKind).toBe(viaEmbeddedHelper.connectionKind);
   });
 });
+
+describe("embedded wallet disconnect", () => {
+  it("calls privyLogout when disconnecting an embedded wallet", async () => {
+    // Set up as if connected via embedded wallet
+    useWalletStore.setState({
+      walletAddress: LOWERCASE_ADDRESS,
+      isConnected: true,
+      connectionKind: "embedded",
+      _hasHydrated: true,
+    });
+
+    // Mock the privySession module that useWallet dynamically imports
+    const mockPrivyLogout = vi.fn().mockResolvedValue(undefined);
+    vi.doMock("../src/features/wallet/privySession", () => ({
+      privyLogout: mockPrivyLogout,
+    }));
+
+    const wallet = mountWallet();
+
+    await act(async () => {
+      await wallet.disconnect();
+    });
+
+    expect(mockPrivyLogout).toHaveBeenCalledOnce();
+
+    const state = useWalletStore.getState();
+    expect(state.walletAddress).toBeNull();
+    expect(state.isConnected).toBe(false);
+    expect(state.connectionKind).toBeNull();
+
+    vi.doUnmock("../src/features/wallet/privySession");
+  });
+});
diff --git a/tests/privySession.test.ts b/tests/privySession.test.ts
new file mode 100644
index 0000000..6c5ad91
--- /dev/null
+++ b/tests/privySession.test.ts
@@ -0,0 +1,111 @@
+/**
+ * Tests for the privySession imperative bridge module.
+ *
+ * The module exposes Privy SDK state for non-component callers (disconnect,
+ * reset). These tests verify the ref-based delegation without pulling in
+ * the actual Privy SDK.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  setPrivySessionRef,
+  privyLogout,
+  isPrivyAuthenticated,
+  getPrivyWalletAddress,
+} from "../src/features/wallet/privySession";
+
+const MOCK_ADDRESS = "0xabc0000000000000000000000000000000000001";
+
+describe("privySession", () => {
+  afterEach(() => {
+    setPrivySessionRef(null);
+  });
+
+  describe("when ref is not set (Privy not configured)", () => {
+    it("privyLogout resolves silently", async () => {
+      await expect(privyLogout()).resolves.toBeUndefined();
+    });
+
+    it("isPrivyAuthenticated returns false", () => {
+      expect(isPrivyAuthenticated()).toBe(false);
+    });
+
+    it("getPrivyWalletAddress returns null", () => {
+      expect(getPrivyWalletAddress()).toBeNull();
+    });
+  });
+
+  describe("when ref is set and user is authenticated", () => {
+    const mockLogout = vi.fn().mockResolvedValue(undefined);
+
+    beforeEach(() => {
+      setPrivySessionRef({
+        logout: mockLogout,
+        isAuthenticated: () => true,
+        getWalletAddress: () => MOCK_ADDRESS,
+      });
+    });
+
+    it("privyLogout calls the ref logout", async () => {
+      await privyLogout();
+      expect(mockLogout).toHaveBeenCalledOnce();
+    });
+
+    it("isPrivyAuthenticated returns true", () => {
+      expect(isPrivyAuthenticated()).toBe(true);
+    });
+
+    it("getPrivyWalletAddress returns the embedded address", () => {
+      expect(getPrivyWalletAddress()).toBe(MOCK_ADDRESS);
+    });
+  });
+
+  describe("when ref is set but user is not authenticated", () => {
+    beforeEach(() => {
+      setPrivySessionRef({
+        logout: vi.fn().mockResolvedValue(undefined),
+        isAuthenticated: () => false,
+        getWalletAddress: () => null,
+      });
+    });
+
+    it("isPrivyAuthenticated returns false", () => {
+      expect(isPrivyAuthenticated()).toBe(false);
+    });
+
+    it("getPrivyWalletAddress returns null", () => {
+      expect(getPrivyWalletAddress()).toBeNull();
+    });
+  });
+
+  describe("when logout throws (already logged out)", () => {
+    beforeEach(() => {
+      setPrivySessionRef({
+        logout: vi.fn().mockRejectedValue(new Error("Already logged out")),
+        isAuthenticated: () => false,
+        getWalletAddress: () => null,
+      });
+    });
+
+    it("privyLogout swallows the error and resolves", async () => {
+      await expect(privyLogout()).resolves.toBeUndefined();
+    });
+  });
+
+  describe("ref lifecycle", () => {
+    it("clearing the ref reverts to safe defaults", () => {
+      setPrivySessionRef({
+        logout: vi.fn(),
+        isAuthenticated: () => true,
+        getWalletAddress: () => MOCK_ADDRESS,
+      });
+
+      expect(isPrivyAuthenticated()).toBe(true);
+
+      setPrivySessionRef(null);
+
+      expect(isPrivyAuthenticated()).toBe(false);
+      expect(getPrivyWalletAddress()).toBeNull();
+    });
+  });
+});