Privacy Policy

Privy is the public name of the Service at privy.ac. The person or organization responsible for the personal data described here (the controller) and its contact address will be identified in this policy once confirmed. Until then, send privacy questions and requests to support@privy.ac.

Privy does not ask for your name, email address, phone number or identity documents. We collect:

• your connected wallet address;
• sign-in challenges and session records;
• the trading wallets created for you, including their encrypted private keys;
• trade requests, deposits, swaps, sells, refunds, payouts and their on-chain signatures;
• points, trading volume and your saved slippage preference;
• API keys you create (stored as hashes) and their usage;
• technical data such as hashed IP addresses for rate limiting, and server logs.

A wallet address is not a name, but it can identify you, especially when linked to other information. We treat it as personal data.

When you sign in, we store your connected wallet address as your account. Every trading wallet, trade, payout and point is linked to it. A shortened form of your account ID (first and last four characters) appears on the public points leaderboard if you rank in it.

To sign in, we issue a one-time challenge that your wallet signs. We store the challenge so it cannot be reused, then create a session that lasts up to 12 hours. The session is held in a secure, HTTP-only cookie named privy_session. Signing out ends it.

For every trade we record the token, amounts, fees, slippage tolerance, quotes, status changes, the wallets involved, transaction signatures and USD values at execution. We need this to execute trades, process refunds and payouts, show your activity, calculate points and meet our record-keeping obligations.

Privy generates a private key for each trading wallet and stores it encrypted in our database. Our servers decrypt it when they need to sign an authorized transaction, such as a swap, sell, refund or payout.

This means Privy can access and use your trading-wallet keys. We restrict this to authorized server-side signing and protect the keys as described in the security section, but you should understand that trading wallets are platform-managed.

Our hosting provider records standard request logs, which can include IP address, browser type and the pages or endpoints requested. Our own application logs record trade and system events for troubleshooting. For rate limiting we store a one-way hash of your IP address, never the address itself. In production we use Vercel Web Analytics, which counts page views in aggregate without cookies.

If you create API keys, we store a key name, scopes, a short visible prefix, a secure hash of the key, creation and last-used times, and request counts. We show the full key only once and cannot recover it. Revoked keys stop working immediately.

• to authenticate you and keep your session secure;
• to create trading wallets and execute, settle, refund and pay out trades you authorize;
• to show your activity, holdings and points;
• to operate the developer API, including authentication and rate limits;
• to detect fraud, abuse and security incidents;
• to comply with legal obligations and enforce our Terms.

Where data-protection laws such as the GDPR or UK GDPR apply, we rely on:

• Contract, to provide the Service you ask for, including sign-in, trading, refunds and payouts;
• Legitimate interests, to secure the Service, prevent abuse, rate-limit the API and understand aggregate usage;
• Legal obligation, where we must keep records or respond to lawful requests.

We share data only with providers that help us run the Service:

• Supabase: database and backend storage for all account, wallet and trade records.
• Vercel: website hosting, serverless functions, request logs and cookieless Web Analytics.
• Jupiter: token search, prices, quotes and swap transactions. Jupiter receives token addresses, amounts and trading-wallet addresses.
• Helius: Solana RPC infrastructure that submits and reads transactions on Solana. It receives wallet addresses, balance and transaction lookups, signed transactions, and our servers' IP addresses.

We do not sell your personal data or share it for advertising.

Solana is a public blockchain. Your deposits, refunds and payouts, and every swap and sell made by your trading wallets, are permanently visible to anyone. Separate trading wallets make some links less obvious, but on-chain analysis can still connect them to your connected wallet, for example through funding and payout transactions. We cannot delete or change on-chain data.

• Sign-in challenges expire within minutes and sessions after 12 hours.
• Account, trading-wallet and trade records are kept while your account is active and afterwards for as long as needed to settle open positions, resolve disputes and meet record-keeping obligations.
• Trading-wallet keys are kept while the wallet may hold funds or tokens.
• Rate-limit counters cover short time windows.
• Hosting logs are kept according to our hosting provider’s retention settings.

Trading-wallet keys are encrypted at rest with a key held separately from the database. Database access is restricted to our servers. Sessions use secure, HTTP-only cookies, API keys are stored only as hashes, and every trade is checked server-side. No system is perfectly secure, and we cannot guarantee that data will never be accessed without authorization.

Our providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses offered by those providers.

Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict its processing, and to receive it in a portable format. You may also complain to your local data-protection authority.

To make a request, email support@privy.ac or message @PrivyAC on X. Because we identify accounts by wallet, we may ask you to sign a message with your connected wallet to verify the request. We cannot delete on-chain data, and we may keep records we are legally required to retain.

We use one session cookie and a small amount of browser storage for your wallet choice and slippage setting. See the Cookie Policy for details.

We will update this policy when our practices change and revise the date at the top. Material changes will be announced on the website.

Privacy questions and requests: support@privy.ac. You can also message @PrivyAC on X. See also our Contact page.