Privacy Policy

1.Key definitions

To make this Policy easier to follow, the following terms have the meanings set out below.

Personal data / personal information

Any information relating to an identified or identifiable natural person, such as an email address, an account identifier, an IP address, a device token, or a blockchain wallet address that can be linked to a person (see Section 6).

Processing

Any operation performed on personal data, including collection, storage, use, disclosure, transfer, and deletion.

Controller

The party that determines the purposes and means of processing. For the Services, the controller is Trader Wallet sp. z o.o.

Processor / sub-processor

A third party that processes personal data on our behalf or as part of delivering a feature you use (for example, our hosting and authentication providers).

Recovery phrase

The 12- or 24-word BIP39 mnemonic that deterministically generates all of your private keys. It is the master secret to your wallet.

Private key

The secret cryptographic key that authorizes transactions from a blockchain address, derived from your recovery phrase on your device.

Self-custodial (non-custodial)

A design in which you alone hold your keys and control your funds, and the provider has no access to, or control over, your assets.

On-device

Data stored and processed only on your phone, within the App's protected storage, and not uploaded to us.

Public profile

The optional trader profile that you switch on in the App. It is stored in our database under your Ethereum-format wallet address and is readable by other signed-in users of the App. Turning it on is what starts the processing described in Sections 8 to 12.

Post

An entry in the trade feed. There are two kinds. An automatic post is generated by our backend from one of your closed Hyperliquid trades once your public profile is on; you do not write it. A written post is one you create yourself: you pick one of your own closed trades and add text of your own. Both kinds take their figures from the exchange record of the trade.

Handle

The globally unique username you claim when your profile becomes public. It is stored in a public lookup table that maps the handle to your wallet address.

Sub-processor / third-party provider

An external company whose service is used to deliver a feature (for example, authentication, hosting, or AI).

2.Who we are & scope

The controller responsible for your personal data is Trader Wallet sp. z o.o., a limited-liability company registered in Poland (KRS 0001218226) with its registered office at ul. Złota 2/19, 15-016 Białystok, Poland. As we are established in the European Union, we are not required to appoint an Article 27 GDPR representative; for all privacy matters you may contact us directly using the details in Section 39.

This Policy applies to all users of the Services worldwide, on both iOS and Android, and to visitors of the Site. It covers all processing carried out by the App, the Site, and our backend, as well as the limited data shared with the third-party providers and blockchain networks needed to deliver the features you use. It does not apply to third-party websites, wallets, protocols, or services that we do not operate, which are governed by their own privacy policies (see Section 34).

Where the App hosts content published by users, we act as the provider of a hosting service within the meaning of Regulation (EU) 2022/2065 (the Digital Services Act). The obligations that follow from that role, including our point of contact, our notice-and-action mechanism, and the reasons we give for moderation decisions, are set out in our Terms of Service.

3.Our privacy principles

We designed the Services around a small set of principles, consistent with the data-protection concepts of privacy by design and by default:

• Self-custody first. Your keys and recovery phrase never leave your device. We cannot see them, move your funds, or restore them.
• Data minimization. We collect only what a feature genuinely needs, and many core features work with no personal data at all (for example, Guest mode).
• Publication is a switch, never a default. The wallet is private unless you turn the public profile on yourself. Nothing about your trading is published while that switch is off.
• No surveillance business model. We do not sell personal data, do not run advertising, and do not embed third-party advertising or analytics trackers.
• Transparency. We tell you plainly which providers receive which data and why, and we keep this Policy current as the App evolves.
• Your control. Because much of your data lives on your device, you can disable features, sign out, clear data, or uninstall at any time. What you have published can be taken down through the deletion function described in Section 29.

4.What we never collect or access

Because Trader Wallet is self-custodial, the most sensitive information stays on your device. The following is never transmitted to us, our backend, or any third party, in any form:

• Your private keys for any blockchain network.
• Your wallet password, action password, PIN, and any biometric data used to unlock the App.
• The password you choose for an encrypted backup, and any key derived from it.
• The keys of your Lightning wallet (Section 7.20), which the Breez SDK derives on your device from your recovery phrase.

Your recovery phrase (seed phrase / mnemonic) also stays on your device and is never sent to us in readable form. There is one exception, and it happens only if you choose it: if you create an encrypted cloud backup, an encrypted copy of your recovery phrase is stored on our backend. Section 4.1 describes exactly what that is and what we can and cannot do with it.

These are generated on your device and stored encrypted in the platform secure store (Android Keystore or iOS Keychain). We cannot read them, cannot move your funds, and cannot recover them if you lose them. We also do not collect government identification documents, and we do not perform identity verification ("KYC"). We do not collect biometric identifiers: biometric unlock is handled entirely by your device operating system and is never shared with us. We do not process payment-card or bank-account details; any in-app service fees are collected on-chain in cryptocurrency at the moment of a transaction, as described in our Terms of Service.

Publishing a public profile requires you to sign a one-time challenge message with your private key so that we can prove the address belongs to you. The signature is verified on our backend and the key itself never leaves your device; we store only the resulting binding between your address and your account identifier.

4.1 Encrypted cloud backup of your recovery phrase (optional)

If you create a wallet by signing in with Apple or Google, or if you turn the backup feature on later, the App offers to store an encrypted copy of your recovery phrase on our backend so that you can restore your wallet on a new device. This is optional. If you do not use it, nothing about your recovery phrase ever leaves your device.

When you do use it, this is exactly what happens and exactly what we hold:

• You choose a backup password. It never leaves your device, and neither does any key derived from it. We do not store it and do not store a hash of it. The only thing that could confirm a guess at it is the encrypted material itself, and each guess costs a full run of the slow key derivation described below.
• Your recovery phrase is encrypted on your device with AES-256-GCM. The key that encrypts it is itself wrapped with a key derived from your backup password using Argon2id.
• Only the resulting ciphertext is uploaded, stored under your account identifier. Inside it are the recovery phrases of every wallet in the App at the moment the copy was made or last updated, including wallets you imported, each labelled with its address so that the App can tell them apart on restore.
• The stored record deliberately contains nothing that links it to a wallet: no address, no hash of an address, no list of networks, no handle.

We cannot read it, and neither can our hosting provider. Decryption is possible only on a device where your backup password is entered. If you forget that password, the backup cannot be opened by anyone, including us: there is no recovery path and no override.

The backup is tied to the account you signed in with. If you delete your account, the backup is deleted with it and cannot be recovered. Before deleting an account the App requires you to open and save your recovery phrase, precisely so that deleting an account cannot cost you access to your funds. See Section 29.

5.Data stored on your device

To function, the App generates and caches certain data locally, inside the App's isolated storage. This data is not uploaded to us:

• Public wallet addresses and public keys derived from your recovery phrase for each supported network.
• Cached blockchain data such as balances, transaction history, token metadata, and staking or lending positions, retrieved from public blockchains to make the App fast and usable offline.
• Market data such as prices, charts, and token icons, retrieved from public price providers and cached to reduce network requests.
• Your preferences and settings, such as theme, language, selected networks, token visibility, the NFTs you pin, and similar choices you make in the App.
• Your address book: the contacts you save, each with a name, optional notes, one or more addresses on the networks you choose and an optional label for each, and the folders you sort them into. The book is kept on the device, separately for each wallet, and, unlike the rest of this list, it is also kept on our server for that wallet, so that the web terminal and the Telegram bot show the same book (Section 7.15); if you turn on Save to cloud, a further encrypted copy that we cannot read is kept as Section 7.11 describes. It is not part of the encrypted backup of your recovery phrase (Section 4.1). When the App shows the last transaction between you and a contact, it reads your own transaction history, exactly as it does for the History screen, and the contact’s address is not sent anywhere for that. Adding a contact from another trader’s public profile copies the addresses that person has already published.
• Profile details you have entered but not yet published, such as a display name, a status emoji, a short biography, spoken languages, and social links. While your public profile is off, these are held only on your device; turning the profile on sends them to our backend and makes them visible to others.
• The handles you have sent to (Section 8, “Sending to a handle”): up to 500 per wallet, kept so that the App can tell you when you send to a handle for the first time.
• A local marker of your acceptance of the publishing rules, kept so that the acceptance screen is not shown to you twice. The authoritative record of that acceptance is stored on our servers (Section 12).
• Session data that keeps you signed in if you use an account.
• Your Lightning wallet (Section 7.20): the state of the wallet and its payment history kept by the Breez SDK in the App’s own storage, one folder per wallet, and the last balance, Lightning address and payment list the App showed, kept so that they appear at once the next time.

Removing every wallet from the App (“log out of all wallets”) erases the keys, the caches and the security settings, but keeps on the device the things you set up about yourself rather than about a wallet: language, theme, the address book (kept per wallet, and shown again when that wallet is added back), the in-app browser bookmarks and the record of your acceptance of these documents. Uninstalling the App, clearing its data in your device settings, or performing a factory reset permanently deletes this local data. It does not delete anything you have already published: published data lives in our database and is removed only through the deletion function described in Section 29. If you have not backed up your recovery phrase beforehand, you will also lose access to your funds.

6.Wallet addresses are personal data

We treat blockchain wallet addresses processed through the public-profile and social features as personal data within the meaning of Article 4(1) GDPR, and we say so plainly rather than relying on the argument that an address is "just a number". This position follows the approach of the European Data Protection Board in its Guidelines 02/2025 on the processing of personal data through blockchain technologies: a public key or account address is personal data where the person behind it can be identified by means reasonably likely to be used.

In our case that linkability is not hypothetical, it is built into the product. Your public profile is stored in our database under your Ethereum-format address as the record key, and attached to that key are a unique handle, an optional display name, a biography, a status emoji, spoken languages, social links, an avatar, a league, a clan membership, and your complete published trading record. Anyone who knows the handle knows the address, and anyone who knows the address can read the profile. Where you additionally choose to publish your Bitcoin, Tron, Solana or TON addresses or your Lightning address (Section 7.20), those become linked to the same identity too.

Your profile record also carries an account identifier that ties the address to the account your installation of the App uses. Because that record is readable by other signed-in users of the App, two public addresses carrying the same identifier can be recognised as belonging to the same person. If you maintain more than one public profile and do not want them to be connectable, be aware of this before publishing a second one. We are documenting this openly rather than describing an ideal state; see also Section 28 for the controls available to you.

The consequence of treating addresses as personal data is that the rights in Section 30 apply to them: you can ask us what we hold under an address, ask us to correct it, and ask us to erase it. What we cannot do is erase anything from the blockchain itself, for the reasons in Section 24.

7.Personal data we process

The features in this section are optional. If you choose to use them, the personal data described is processed by us and/or by the service providers listed in Section 22. Each subsection states what data is involved, why, and where it goes. The social features are large enough to warrant their own sections and are described in Sections 8 to 12.

7.1 Account and sign-in

You can use the wallet in Guest mode without an account. If you sign in, we use Firebase Authentication (Google) to authenticate you. Depending on the sign-in method, we process your email address (email sign-in), your Google or Apple account identifier and any display name you provide (social sign-in), and a Firebase user ID that identifies your account within our systems. Some features use an anonymous account tied to the installation rather than to an email address. We use this only to authenticate you and to associate optional features (such as saved AI chat history, or ownership of a published address) with your account. Signing in is not required to hold, send, receive, swap, or trade assets.

When the App first creates the record that holds your assistant allowance, and when you redeem a code on the code screen, it computes a device fingerprint: a one-way hash of a few fixed properties of the device (on Android the build identifier, build fingerprint and hardware name; on iOS the vendor identifier and the model) that contains none of them in readable form. It is stored with your account record and in a separate index, and it is used for one purpose only: to refuse a one-per-device benefit to a device that has already received it. It is not an advertising identifier and is not shared with anyone. Section 29A says what happens to it when you delete your account.

Separately, when you open the partner screen, create a partner code or apply one, the App sends a device identifier hash: a one-way hash of the identifier your operating system gives this device for our App (the Android ID on Android, the vendor identifier on iOS), which contains that identifier in no readable form. We store it with the wallet address that sent it and use it for one purpose only: to refuse a partner code applied from the same device as the code’s owner (Section 38). It is not an advertising identifier, is not shared with anyone, and is erased with your account (Section 29A).

7.2 Grünwald assistant

If you use the in-app AI assistant ("Grünwald"), the messages you send, and any voice input or images you submit for analysis, are transmitted through our backend to our AI provider, Anthropic, which generates the responses. When a question needs a web search and Anthropic’s search does not answer, our backend may send that question, with the recent turns of the conversation, to OpenAI, which then answers it. The chart analysis you can ask for on a trading screen sends the recent candles of that market, which are public market data and not yours. When you ask the assistant about your own portfolio, your transactions or your Hyperliquid trades, the App attaches the data the question is about to that message: your current balances with their value in US dollars, your most recent transactions (date, amount, token, network, the other address, the hash) or your most recent fills on the exchange. That data reaches the AI provider together with your message and is handled like the message itself. The file export of your transactions (CSV, Excel, PDF, Word, JSON, text) is built by our backend from the rows the App sends it and does not go to the AI provider. Voice input is converted to text using your device's speech-recognition capability while you are actively using that feature.

Your conversations are stored on our servers. Every conversation is kept on your device and mirrored to our database under the identifier of your installation, whether you registered an account or not, so that the history follows a signed-in account to another device and survives reinstalling for a registered account. You can delete any conversation, or all of them, from the App, and account deletion removes them (Section 29A). If you never registered, the mirror is reachable only by the anonymous identifier of that installation, which does not survive reinstalling.

Memory on the Max tier. If your account holds the Max tier, our backend keeps a short written memory about you, at most 1500 characters, which the model itself rewrites every few turns from the conversation you are having: the kind of facts you have told the assistant, so that it does not ask again next time. It is stored with your account record, is used only inside the assistant’s instructions, is not read by us for any other purpose and is not used to decide anything about you or your access; it is deleted with your account, and we erase it earlier on request by e-mail to contact@traderwallet.app; the App has no button of its own for that. It exists only for the Max tier.

7.3 Push notifications

If you enable notifications, we use Firebase Cloud Messaging and the Apple Push Notification service, which involves a device push token, to deliver alerts such as price, transaction, trading, and social notifications. Section 11 describes how push tokens are stored and how long they are kept.

Price and transaction alerts store your wallet addresses. To tell you that a price was reached or that a transaction touched a wallet, our servers have to know which wallets to watch. When you save the notification settings, the App writes a record on our servers, keyed by your push token, that holds the token, which kinds of alert you turned on, the price alerts you set, and the public addresses (Bitcoin, Ethereum-format, Solana and Tron) of every wallet you have enabled for alerts. This happens whether or not you have a public profile. A scheduled job, run for us on GitHub Actions every thirty minutes, reads those records, asks our backend and the Hyperliquid exchange for the latest activity of each address, and sends the notifications. The record is replaced each time you save the settings, is removed when you delete your account (Section 29A), and can be removed on request.

7.4 On-chain features: swaps, bridges, staking, lending, vaults, and trading

When you use in-app token swaps, cross-chain bridges, staking, lending, deposits into and withdrawals from Hyperliquid vaults, perpetual-futures trading, prediction markets, or tokenized-asset features, the relevant public wallet address, token pair, network, and amount are sent to the third-party providers that source quotes and route or execute those actions (for example 0x, Jupiter, LI.FI, and Hyperliquid; on TON: Tonstakers for liquid staking, STON.fi Omniston for swaps inside TON Relay for bridges from TON to other networks, for swaps and bridges from Tron, for routes between EVM networks that LI.FI does not offer, and, together with LI.FI, for a deposit to your Hyperliquid account paid in another coin, where the provider receives your address, the coin and amount, your Hyperliquid address as the recipient and your own address for a refund; and on BNB Smart Chain: Lista for liquid staking of BNB, whose current rate the App reads from Lista’s public interface at api.lista.org, with DefiLlama’s public yield data as a fallback) and to blockchain RPC providers. As with any internet request, these providers can also observe your IP address and the addresses you query. We charge on-chain service fees for some of these features, as detailed in our Terms of Service. On Hyperliquid the fee we charge is recorded by the exchange itself and is publicly visible in its record of your fills, next to the exchange’s own fees. Your private keys are never shared; transactions are signed on your device. On TON, the optional comment you type into the comment field of a transfer is part of the transaction and is written into the public blockchain together with it, where anyone can read it. Sending one token to several saved contacts in a row (“Send to many” in the address book) sends one separate transaction per contact, each signed on your device; the recipients’ addresses go to the network, not to us.

Live prices of prediction markets. While a prediction market, its order sheet or its order book is on the screen, the App keeps one WebSocket connection to Hyperliquid’s public market data (api.hyperliquid.xyz) and pauses it when the App is in the background. The exchange sees your IP address and the markets the App subscribes to, as with any other request to it; nothing about your wallet is sent over that connection.

7.5 Backend and technical data

Our backend runs on Vercel. When your device contacts our backend (to fetch prices, obtain a swap quote, proxy a blockchain RPC request, reach the AI assistant, or perform any social action), standard technical data is processed as part of the internet request, including your IP address, request timestamps, the endpoint called, and a user-agent string describing your app version and device type. We keep operational logs to the minimum needed for security, abuse prevention, and reliability, and we do not use them to build advertising or behavioral profiles.

7.6 Support and correspondence

If you email us or otherwise contact us, including to report content, to ask why a moderation decision was taken, or to contest one, we process your contact details and the content of your message to respond and to keep a reasonable record of the request. A suggestion or a bug report written inside the App is described in Section 7.13.

7.7 WalletConnect

The App can connect to third-party websites and applications using the WalletConnect protocol. When you scan a connection code or open a connection link, the App opens an encrypted WebSocket session with a WalletConnect relay operated by WalletConnect, Inc. (relay.walletconnect.org, with relay.walletconnect.com as a fallback). The relay carries the messages between your device and the connected site.

Approving a connection discloses to the connected site the wallet addresses and networks you select in the approval screen, and nothing else. On TON the approval may also carry your wallet’s public key and, if the site asks for it, a signed proof that you control the address; the App shows that request before you approve. Each subsequent request from that site, to sign a message or a transaction, is shown to you and is sent onward only if you approve it. Signing happens on your device; your recovery phrase and private keys are not transmitted to the relay, to us, or to the site.

The relay operator can observe the technical metadata of the session, including your IP address, the timing and size of messages, and the identifier of the session. Message contents are end-to-end encrypted between your device and the connected site, so the relay cannot read them. We do not receive the contents of these sessions and do not store a record of the sites you connect to.

What a connected site does with your address is governed by that site's own privacy policy, not by ours. You can end a session at any time from the connections screen in the App; ending it stops further requests from reaching you.

7.8 Signing in with Apple or Google, and the optional encrypted copy of your recovery phrase

The App can create a wallet for you without showing you a recovery phrase to write down. If you choose that route, you sign in with Apple or Google, set a separate backup password, and the App stores an encrypted copy of your recovery phrase on our backend so that you can restore the wallet on another device.

The encryption happens on your device before anything is sent. A key is derived from your backup password using Argon2id; that key wraps a randomly generated data key; the data key encrypts the recovery phrase. Only the wrapped key, the encrypted phrase, the key-derivation parameters, and the creation and update timestamps are stored. Your backup password is never transmitted to us in any form: not the password and not a hash of it. The encrypted material itself is the only thing that could confirm a guess, and every guess costs a full run of the slow key derivation. We cannot decrypt the stored copy, and neither can Google, whose Firestore service holds it. If you forget the backup password, the copy cannot be recovered by anyone, including us.

The stored record contains nothing that identifies the wallet: no address, no hash of an address, no list of networks, no handle. It is stored under your account identifier and can only be read by a device signed in to that account.

This feature is optional and applies only to accounts signed in with Apple or Google. A Guest account does not store a copy, because a Guest identifier does not survive reinstalling the App and a copy stored under it could never be restored. The backup screen in Settings lets you create the copy, add wallets to it and change its password; it does not offer a way to delete the copy on its own. The copy is deleted when you delete your account, and on request by e-mail.

7.9 Web terminal

We operate a web trading terminal at traderwallet.app, our primary domain, which is also reachable at trader-wallet.com. The terminal does not hold keys. You connect a wallet to it over WalletConnect, exactly as you would connect any other site, and Section 7.7 describes what that involves. Requests to sign are approved in your wallet, on your device.

As with the App backend, standard technical data is processed when your browser contacts the terminal and the services behind it, including your IP address, request timestamps, and a user-agent string.

The terminal also carries the social features of Sections 8 to 12: you can read, follow, like, comment, vote in polls, report and block, join or leave clans and communities, and answer duels there. To act for your address, the terminal asks your wallet to sign a one-time code, which expires after 10 minutes and is deleted when used; our backend then keeps, under that address, the anonymous identifiers of up to ten browsers that proved it, with the time of the last proof. These browser proofs are erased when you press Forget in that browser, when you delete your public profile (Section 29) and when you delete your account (Section 29A). Editing the profile and pictures, creating clans, communities, duels and clan wars, and deleting the profile or the account stay in the App.

The session key the terminal creates in your browser. Hyperliquid signs trading actions with a domain that no wallet can display meaningfully, so the exchange's own interface and every web terminal, including ours, trade with a separate key called an agent. When you activate trading in the terminal, your browser generates that key, you approve it once with a signature from your wallet, and since 22 September 2026 the key is kept only in the memory of that browser tab, not in any browser storage, and the exchange accepts it for 24 hours. Three things follow, and each of them is a deliberate limit rather than a side effect. The key never reaches us or any server: it is created in your browser and stays there. It dies with the tab, and reloading the page ends it too, so a shared or public computer keeps nothing after you leave; the terminal also has a button to forget it at once. And it cannot move money: transfers between your spot and perpetual balances, deposits, and withdrawals are signed by your wallet, and the terminal refuses to sign them with the agent key even if asked to. If your browser blocks site storage, for example in a private window with storage disabled, the terminal says so and trading stays unavailable rather than failing silently.

Checking your fee discount on the web. A trading league or a partner code lowers the service fee we charge on Hyperliquid (Section 9.7 of the Terms). The terminal only knows the address your wallet names, and a named address proves nothing, so it pays the full rate until you ask it to check: our backend issues a one-time code, your wallet signs it, and our backend verifies that the signature comes from that address. It then answers with two facts it already holds: the league of that address and the date of the partner code it is bound to, if any. The one-time code is deleted when it is used; nothing else is written, and the check does not publish, bind or register anything.

What the terminal keeps in your browser. Theme, language, the connection to your wallet, and trading preferences you choose there (market-order slippage, whether to confirm each order, and whether sizes are shown in coins or in US dollars) are kept in your browser’s local storage and never sent to us. The CSV export of your trade, funding and order history is built in your browser from the lists already on the screen and saved by your browser; it is not sent to us.

7.10 Regional availability check

Before the App opens perpetual futures, prediction markets or Hyperliquid vaults, it asks an internet geolocation service which country and region your network address belongs to, because the Hyperliquid exchange does not serve users in some countries and regions. The App tries a short list of such services in turn and stops at the first that answers: the services behind the ip_country_lookup library (iplocation.net, icanhazip), ipapi.co, ipinfo.io, a Cloudflare trace endpoint, and ipwhois.app. Each of them sees your IP address, which is what the lookup is; all of them are reached over TLS. What comes back is a country code, a country name and a region name, which the App keeps on your device for 24 hours so that it does not ask again on every screen. Nothing is sent to us. Where the answer names a restricted country or region, those screens show that access is restricted; where no service answers, they open. The list of restricted places follows the exchange’s own terms. Section 22 lists these services.

7.11 Cloud copy of your token list (optional)

On the address book screen you may turn on Save token list to cloud for the wallet you are using. It is off by default and applies to that wallet only. When it is on, the App keeps an encrypted copy of the list of tokens you have turned on for that wallet and their order, and another phone that holds the same wallet and turns the same switch on receives them.

Contacts and folders are no longer part of this copy. Earlier versions of the App used the same switch to copy the contacts and folders of your address book as well. They now live in the one address book of Section 7.15. Once the App has checked that every contact of the old copy is in that book, it rewrites the cloud copy without contacts and folders; until then, it only reads contacts from the old copy and adds any that are missing, so nothing is lost on the way.

The copy is encrypted on your device before it is sent. The key is not stored anywhere: the App derives it again on each device from a signature that the wallet itself makes over a fixed text, and encrypts with AES-256-GCM. Our database holds, under the wallet’s address, only the ciphertext, its size, a format number and the time of the last change. No token list, and no name or address from an older copy, is readable by us, by Google, whose Firestore service holds it, or by anyone else. Only the device that has proved it controls that address, by the same signed code the public profile uses, can read or change the copy.

Turning the switch off deletes the cloud copy. Deleting your account deletes it too. What stays on your device is unchanged by either. Independently of this switch, your contacts and folders are also kept on our server as Section 7.15 describes; that copy is encrypted with a key we hold, not with a key derived from your wallet, and turning this switch off does not delete it.

7.12 News

The news screen and the news cards on the home screen show headlines from the public news feeds (RSS and Atom) of named publishers. Our backend reads those feeds and passes on the title, a short excerpt, the time, the publisher and a link; your device does not contact the feeds. The picture of a story is loaded by your device directly from the publisher, which, as with any picture on the internet, sees your IP address. Opening a story opens the publisher’s own page, governed by its own privacy policy.

A like or a comment on a story is stored and shown exactly as on any other wall in Section 9, under your handle, and counts are public. News is third-party content, and Section 33A of the Terms says what that means.

7.13 Suggestions and bug reports

In Settings, Suggest a feature and Report a bug let you write us a message inside the App instead of by email. When you press Send, our backend stores the text you wrote, whether it is a suggestion or a bug report, the time, and the identifier of your App account (for an anonymous installation, its anonymous identifier), and marks the message as new until we have read it.

A bug report also carries the App version and build number, the platform (Android or iOS) with its operating-system version, and the language of the App, so that we can reproduce the fault; the screen says this under the text field before you send. A suggestion carries only the text. Neither carries your wallet addresses, balances, transactions or anything else from your wallets, and we do not add them.

You can also send a suggestion or a bug report in the Telegram bot with /idea and /bug; such a message carries the text, the language of the bot and the identifier of your Telegram account in our records, is marked as sent from Telegram, and is treated exactly as described here. To prevent abuse, one account can send at most five messages a day and one every thirty seconds; for that we keep, per account, the number of messages sent that day and the time of the last one.

These messages are not published. Only we read them; they are stored in our database on Google Cloud Firestore (Section 22) and are not shared with anyone else. We use them, on the basis of our legitimate interest in fixing faults and improving the App (Article 6(1)(f) GDPR), to decide what to build and what to repair. Please do not write your recovery phrase, private keys or other secrets into a message: nobody from Trader Wallet will ever ask for them.

A message and the counter are kept as long as other correspondence (Section 26) and are erased when you delete your account (Section 29A). You can also ask us to erase them.

7.14 The Trader Wallet Telegram bot

We operate a bot in Telegram, @TraderWalletAppbot. It is another way to use the same Services: you can connect your own wallet to it, trade on Hyperliquid, read your balances, send and swap with your wallet’s approval, use the social features and ask the Grünwald assistant. You can use the bot without the App. The bot is non-custodial. It never holds your recovery phrase or your wallet keys and never asks for them; no command, button or message of the bot accepts them. Anything that moves funds from your wallet is signed in your wallet.

What Telegram gives us, and what you send. When you write to the bot, Telegram delivers to our backend your Telegram user identifier, your first name, your username if you have one, the language of your Telegram app, and the message, command or button you sent. We keep, in a record tied to your Telegram identifier: that name, username and language, the language you choose in the bot, the wallets you connect (their addresses and the name of the wallet app), the one you use now, your notification switches, your price alerts, a partner code you entered before connecting a wallet, and, after a payment, the identifier and end date of your subscription. The text of an ordinary message is not stored: a question to Grünwald is processed as described below, and a command is carried out and forgotten. A comment you write on a trade is published like a comment written in the App (Section 9).

Connecting a wallet. To connect a wallet the bot gives you a link to our sign page at traderwallet.app/tg/. The link carries a one-time request that expires after 15 minutes and is deleted as soon as it is used. The page shows what is being signed, connects to your wallet (inside the wallet’s own browser, over WalletConnect as described in Section 7.7, or over TON Connect through the bridge of your TON wallet) and returns only the signature or the transaction identifier to our backend. Our backend checks every result itself: that a signature comes from the address, and that a transaction exists on the network and matches the request in recipient, amount and contract. To prove that an EVM address is yours you sign a short message; if no installation of the App has claimed that address yet, our backend records the proof exactly as it does for the App (Section 8), and otherwise it records only the link between the address and your Telegram identifier. For a TON address we read the wallet’s public key from the network to check the proof. When your wallet session also discloses addresses on other networks, the bot keeps them to show balances and to let you receive and send; every transfer from them is signed by that wallet again. Before a transaction the bot built is sent to the network, our backend checks the signed transaction against what you confirmed, and it sends nothing that differs.

Linking the App. The Telegram tile in the App’s settings asks our backend for a one-time code valid for 10 minutes and opens the bot with it. The code tells the bot which address the App installation controls, and it also carries the public addresses of the same wallet on Bitcoin, Solana, Tron and TON, so that the bot can show those balances and let you receive and send on those networks; we keep the link between the address, your Telegram identifier and that installation’s account identifier, so that the bot can send you your notifications, the App can show that Telegram is connected, and a Grünwald plan belongs to one profile. Disconnecting in the App or in the bot removes the link on both sides.

The Hyperliquid trading key. Hyperliquid lets an account authorize a separate key, called an agent, to place orders. If you turn on one-tap trading, our backend creates such a key for you and your wallet signs, once, the approval that authorizes it for 90 days; in the same step it may ask you to approve the maximum service fee described in Section 9.2 of the Terms. The trading key is the only secret our servers hold for you, and it is not a key to your wallet. It can place and cancel orders, set leverage, run TWAP orders, and move funds between your Hyperliquid account and a Hyperliquid vault; Hyperliquid does not let it withdraw, transfer to anyone, or approve anything, and the bot sends those actions to your wallet instead. It is stored only encrypted (AES-256-GCM, with a key held in our hosting environment and the ciphertext bound to your address), and it is decrypted in memory only to sign an order you confirmed with a button in the chat, or to move a trailing stop you set and confirmed: for that the bot keeps, until you turn it off or the position closes, the market, the side, the distance you chose, the best price reached and the current stop order, and it replaces the stop order as the price moves in your favour. You can turn it off with /trade, and it is deleted when you disconnect the wallet or use /deletedata; you can also revoke it on Hyperliquid from your wallet at any time. Please protect your Telegram account (for example with two-step verification): whoever controls it can trade with this key, although they cannot withdraw your funds.

Notifications. To tell you when a trader you follow opens or closes a position, and to send you your own fills, liquidation warnings and price alerts, our backend reads public Hyperliquid data about those accounts and prices on a schedule and sends you messages through Telegram. You choose which kinds you receive with /notify. If you block the bot, we record that and stop writing to you.

Who receives messages about your trades. If your profile is public, you choose who receives a Telegram message when you open or close a position: the people who follow you (the default, as before), the people who joined Trader Wallet with your partner code (Section 38) and use the bot, or both. You set this on the Telegram screen in the App’s settings, with /alerts in the bot, or on your own profile on the web terminal, and you can change it at any time; the App tells you how many people the messages reach, counted at most a few minutes earlier. To send them, our backend keeps, next to the list of the people who follow you, the list of the people linked to your partner code who use the bot. A message names you by your public @handle and shows the market, the direction, the leverage, the size in dollars, the entry price and a price chart, which your public profile already shows; it never contains your balance or anything that could move your funds. A person who receives such messages stops them with /notify or by blocking the bot.

Grünwald in Telegram. Questions you ask the assistant in the bot are processed as in Section 7.2: the text is sent to our model provider to produce an answer. To let you continue a conversation, the last few turns are kept in the working memory of our server for up to 30 minutes and are not written to our database. Your daily allowance is counted per Telegram account until you connect a wallet, and then per profile.

The address book. The bot shows and edits the one address book of Section 7.15, the same book the App and the web terminal show. The separate address book the bot kept before 25 September 2026 has been merged into it.

Other things you do in the bot. In demo mode the bot uses the demo account of Section 37, the same one the App uses for your address. A note you add to one of your own trades and a message you write in an asset discussion are published exactly as when you write them in the App (Section 9). A photo you send to set your profile picture or banner is delivered to our backend by Telegram; our backend reduces it in memory to the size given in Section 9A and stores only that reduced copy; the photo as Telegram delivered it is not stored. A trade history file you ask for is built from your public Hyperliquid records at that moment, sent to you in the chat and not kept by us. Searching for traders, /discover (the list of public profiles of Section 8) and reporting or blocking one use the public profile data and the moderation records of Sections 8, 12 and 22 in the same way as the App.

Sending to a Telegram contact, and being found. In /send you can pick the recipient from your Telegram contacts. Telegram then gives our backend that person’s Telegram user identifier and, if they have them, their first name and username; your contact list itself is never sent to us. The bot sends to that person only if they have connected a wallet to the bot and have themselves turned on /findme, which is off by default: then the bot shows you their name and a short form of their wallet address and prepares the transfer to that address, which you confirm in your wallet. If they have not, the bot says that they are not on Trader Wallet yet and offers an invitation link you can share; it gives that same answer whether or not they use the bot, so it does not reveal whether they do. We keep the /findme switch in the record tied to your Telegram identifier. The identifier of the person you picked is not stored; their name and address become part of the transfer request you confirm, which expires after 15 minutes like any other request.

Payments in Telegram Stars. Grünwald plans can be bought in the bot with Telegram Stars. The payment is processed by Telegram; we do not see any card or bank data. We receive and keep the payment identifier, the amount in Stars, the plan, the renewal flags and the end date, and we record the plan on your profile (and, until you connect a wallet, on your Telegram identifier), so that it works in the bot, the App and the web terminal. Renewal can be cancelled in the bot with /plans; questions about a payment or a refund go through /paysupport.

Groups. The bot can be added to a group. It keeps Telegram’s privacy mode on, so it receives only commands addressed to it, messages that mention it and replies to its own messages, not the rest of the conversation; where a group makes the bot an administrator, Telegram delivers it every message of that group, and the bot looks at them only for a mention of @grunwald or of the bot and keeps none of them. A message that mentions @grunwald is answered as Section 7.22 describes. If a clan leader links a group to a clan, we keep the group’s identifier, the clan and who linked it, until the link is removed or the bot leaves the group.

Legal bases and your control. We process this data to provide the bot you asked to use (Article 6(1)(b) GDPR) and, for rate limits and abuse prevention, on the basis of our legitimate interest in keeping the service available (Article 6(1)(f) GDPR). You can disconnect a wallet with /disconnect and delete everything the bot keeps about you with /deletedata; payment records are kept as Section 26 describes. Telegram processes your messages under its own privacy policy.

7.15 Your address book on our server

What it is. Your address book is one book for your wallet, shared by the App, the web terminal and the Telegram bot: a contact you add, change or delete in one place appears the same way in the others. It holds what you put in it: contact names, notes, addresses with their networks and optional labels, the folders you sort contacts into, and, for a contact added from a public profile, the link to that profile. So that a deletion made in one place is not undone by another, a deleted contact or folder leaves a marker holding only its internal identifier and the time of the deletion, which is forgotten after 90 days.

Where and how it is kept. The book is kept in our database on Google Cloud Firestore (Section 22), under your wallet’s address, in a record that no App or browser can read directly: only our backend reads and writes it. It is encrypted at rest with AES-256-GCM, with a key held in our hosting environment and derived only for address books, and the ciphertext is bound to your address. This is not end-to-end encryption: our backend can decrypt the book, and it does so to show you your book in the App, the web terminal and the bot, and to let you send to a contact by name there. We do not use it for anything else, and we do not share it.

Who can open it. Only you: the App, the web terminal or the bot asking for a book must prove, in the same way as for your public profile (Section 8) or by a wallet connected to the bot (Section 7.14), that it controls that address.

How it came to be. Before 25 September 2026 the App kept the book only on your device and, if you turned it on, in the encrypted cloud copy of Section 7.11, and the bot kept a separate book. The first time a version of the App released after that date synchronises your wallet, the book on your device, the cloud copy (which your device decrypts) and the bot’s book are merged into this one book; a contact that appears in more than one of them with the same address or name is merged rather than duplicated. Older versions of the App do not synchronise and keep their book only on the device.

Deleting it. You can delete any contact or folder at any time. The whole book is deleted when you delete your account (Section 29A); for a wallet that is known only to the bot, /deletedata deletes it. The copy the App keeps on your device stays until you remove it or the App.

Faces of public profiles. When an address in your book belongs to a public profile (Section 8), the book shows that profile’s avatar instead of a generated pattern, in the App and on the web terminal. For that, the App reads the public profile records of those addresses directly, and on the web terminal our backend reads them and returns the avatars with your book. These are public records; nothing new is stored, and a profile that is not public is not shown.

Legal basis. We keep the book to provide the address book you use in the App, the web terminal and the bot (Article 6(1)(b) GDPR).

7.16 Display balance (only for addresses we enable)

For a small number of addresses that we enable ourselves (not anyone who enters a code), the referral screen offers a display balance: figures typed on the phone that replace the total and the 24-hour change shown on the balance card of that phone. To decide whether to show this option, the App sends your wallet address to our backend, which answers only whether the address is on our list; nothing else is sent and nothing is written. The figures you type stay on your device only: they are not sent to us, to other people or to any public surface, they change nothing in your wallet, your transactions or your public statistics, and a reset returns the card to the real balance. Section 26 of the Terms says how the option may and may not be used.

7.17 The addresses of your wallet

A Trader Wallet wallet has one EVM address (the same on every EVM network) and its own addresses on Solana, TON, Tron and Bitcoin. When you open the App, and each time you switch to another wallet, the App sends our backend the public addresses of the wallet you are using: Solana, TON (the current W5 address and the older v4R2 address of the same key), Tron and Bitcoin, together with its EVM address. Nothing secret is sent: no recovery phrase, no private key, no balance. We keep them so that, when you write to us about a transfer that did not arrive, we can find it on the right network. They are stored per App installation (the anonymous or signed-in account identifier of Section 7.1) under the EVM address, and the entry made by the installation that owns the verified public profile of that address is marked as such. Addresses of wallets you do not open on that device are not sent. The entries are erased when you delete your account (Section 29A).

7.18 Scam checks and the blockchain lookup

Grünwald can check an incoming transaction (“Check with Grünwald” in the details of a transaction), a token, an address or a website, and can look up an address or a transaction hash you paste into the chat. For this, our backend sends only the item being checked (the network and the transaction hash, the token contract, the address or the site’s domain) to public security and blockchain sources: GoPlus Security, DexScreener, Blockscout explorers, public blockchain nodes and the public registration records of domains (RDAP), listed in Section 22. Your own address is sent only when it is the item you asked to check or the recipient of the transaction being checked. The verdict is computed by our code from what those sources return; a source that does not answer is reported as “not checked”, never as safe. We keep the result of a check for seven days, keyed by the item checked and not by you, so that the same check is not repeated; a check counts towards a limit of 20 checks in 10 minutes per installation. These checks never sign or send anything.

7.19 GIFs in chats (KLIPY)

When you search for a GIF in a chat, the App sends your search words to our backend, and our backend asks KLIPY (Section 22) for matching GIFs with the strictest content rating. KLIPY receives the search words, the page requested and an anonymous identifier that our backend derives from your installation’s account identifier with a one-way function; it receives neither that identifier itself nor your wallet address, and our key for KLIPY never reaches your device. KLIPY’s advertisements are not shown. Our backend keeps the results of trending GIFs and of frequent searches for up to 24 hours, without anything that identifies you. The GIFs themselves are loaded by your device from KLIPY’s servers, which then see your IP address. A GIF you send is stored in the message as KLIPY’s web address.

7.20 Bitcoin Lightning

What it is. Next to your regular Bitcoin address, the App holds a Lightning wallet with its own balance in satoshis. It is built with the Breez SDK (Breez SDK Spark), a library from Breez that runs inside the App on your device on the Spark network. Its keys are derived on your device from the same recovery phrase, at the path m/8797555'/<account number>' that Breez uses, one Lightning wallet for each account of a phrase. The App hands the recovery phrase to the library inside the App only; it is not sent to us, to Breez or to anybody else, and our backend never sees your Lightning keys. Because the wallet is derived from the phrase, the same phrase can open the same Lightning wallet in another application built on the Breez SDK.

Who takes part in a payment. Lightning and Spark payments are carried by independent parties, not by us. The Spark operators (Lightspark and other independent operators) co-sign the transfers of your Lightning wallet, and the Spark Service Provider sends and receives Lightning payments for it and performs the moves between Spark and the Bitcoin blockchain. To do that they receive the public identity key of your Lightning wallet, the amounts, the invoices you pay or create and their destinations, the Bitcoin addresses involved in a move, and your device’s IP address. A Lightning payment also passes through the Lightning nodes on its route, which see the amount, and an invoice tells its payer the amount and the description written into it. So that the code is ready at once, the App makes one invoice without an amount in advance when you open Receive for Bitcoin or the Bitcoin Lightning token, and makes a new one before it expires; it reaches the Spark Service Provider like any invoice you create, and it is shown on one screen only. Breez receives the key that identifies our App to its services (our backend gives that key to the App; it says nothing about you), the requests the SDK makes to Breez’s services and your IP address. Each of them processes this under its own privacy policy (Section 22).

Moving between Bitcoin and Lightning. “Move to Lightning” sends bitcoin from your regular Bitcoin address to a deposit address of your Lightning wallet in an ordinary Bitcoin transaction, and “Move to Bitcoin” asks the Spark Service Provider to pay your Lightning balance out to your regular Bitcoin address. Both leave records on the public Bitcoin blockchain that link those two addresses (Section 24).

Your Lightning address. Once the App’s domain is set up for it, each Lightning wallet gets a Lightning address of the form name@traderwallet.app, which anyone can use to pay you. The App picks the name itself: your public handle if your public profile is on, otherwise a random neutral name made of a word, an animal and three digits that says nothing about you; you can change it, and a new name replaces the old one. The address is registered with the Lightning address server operated by Breez, which keeps the name, the identity key of your Lightning wallet and the description “Pay to name@traderwallet.app”, and which creates invoices for you when somebody pays the address, even while your phone is off; the payment is credited when the App next connects. A wallet that pays your address asks traderwallet.app for it; our backend passes those requests to the Breez server unchanged, together with the IP address of the payer, as the Breez guide for its own domains requires, and keeps nothing of them beyond the operational logs of Section 7.5. The requests with which the App registers or changes your address reach the Breez server the same way, with your device’s IP address.

The register of names. So that two wallets cannot take the same name and nobody takes a closed one (for example the names of our official accounts), our backend keeps, for each name in use, one record in our database on Google Cloud Firestore: the name, the identity key of the Lightning wallet that owns it, the time it was taken, the identifier of the App account that holds it now (for an anonymous installation, its anonymous identifier, Section 7.1) and, once the name has moved between accounts, the time of the move and the time written in the signed request that moved it. We keep the account identifier only so that deleting your account deletes your names from the register (Section 29A). The record holds no handle other than the name itself, no EVM address and no balance, and no App or browser can read it directly. Every request to take, give up or move a name is signed on your device with the identity key of your Lightning wallet, and our backend accepts it only with that signature and within ten minutes of the time written in it. When you open the same Lightning wallet under another App account, for example on a new phone, the App proves in this way that it is the same wallet, and the name moves to that account; no other wallet can move it, and an older signed request cannot move it back. When a wallet moves to a new name, the record of its old name is deleted if the account holds it, and when the Breez server refuses a name that was just taken, the App asks our backend to delete that record, which it does only for the same account. So that a signed request cannot be used twice, our backend keeps a one-way hash of each request it accepted, which contains no account identifier and no name in readable form, for twenty minutes. Our domain passes to the Breez server a request to register a name, or to move one, only from the Lightning wallet our register gave that name to.

Who sees the address. A Lightning address is meant to be given out, and whoever has it can find that it exists by asking for it. It is shown in the App on the receive screen. It appears on your public profile only if your profile is public and you have switched on publishing your Lightning address, in the same way and with the same switch as your other addresses (Section 8); a profile that is not public publishes nothing.

Legal basis. We provide the Lightning wallet and its address to perform the service you use (Article 6(1)(b) GDPR) and keep the register of names on the basis of our legitimate interest in unique, non-misleading names (Article 6(1)(f) GDPR). We charge no fee of our own on Lightning; the network fees are described in Section 4B of the Terms.

7.21 Paying the network fee in a token

On some networks the App lets you pay the network fee of a transfer, a swap, a bridge or a deposit to Hyperliquid in a token you hold instead of the network’s own coin, and on Bitcoin it lets you choose the speed. The choice is shown before you confirm, and the coin of the network remains available. For the token options, the App sends what the provider needs through our backend, which checks each answer of the provider (recipient, amount, fee ceiling) before the App signs anything and forwards the signed result; the keys stay on your device and every signature is made there.

• TON (USDT and other jettons the provider accepts): our backend asks TonAPI (Ton Console) to estimate and relay the transfer. TonAPI receives your wallet address and public key, the token, the recipient, the amount, the comment and the signed message.
• Tron (USDT): our backend asks Transatron to build the payment of the fee and the transfer and to broadcast them. Transatron receives your Tron address, the recipient, the amount and the signed transactions.
• Solana (USDT): our backend asks Candide (its hosted Kora service) to price, co-sign as fee payer and send the transaction. Candide receives the whole transaction: your address, the recipient, the amounts, the payment of the fee and, where it applies, our part of the fee as a separate transfer to our own address (Section 9.8 of the Terms).
• EVM networks (USDC on Ethereum, Base, Arbitrum One, Optimism, Polygon and Unichain): the fee is paid in USDC through Circle’s Paymaster contract, and our backend sends the operation to the bundler of Pimlico. Pimlico receives the operation: your address, what it calls (for example the transfer, the swap or the deposit and its recipient and amount) and your signatures. The first time on a network the App also signs, after you agree on a separate screen, an EIP-7702 authorization that lets your address run a fixed, audited account contract (Simple7702Account); that authorization is recorded on the public blockchain for that network and remains there until you replace it. Circle does not receive anything from us: its contract reads only what is on the blockchain.
• EVM networks, USDT (Ethereum, BNB Chain, Arbitrum One, Optimism, Base, Polygon, Linea and Gnosis): for a transfer of a token, including a transfer to several contacts, the fee can be paid in USDT through the ERC-20 Paymaster of Pimlico. Our backend asks Pimlico for the exchange rate and for the paymaster’s signature on the operation and sends the operation to Pimlico’s bundler; Pimlico receives the operation as described above, and the same EIP-7702 authorization is used. The operation itself permits Pimlico’s paymaster contract to take USDT up to the fee you were shown, and that permission is recorded on the public blockchain.
• In the Telegram bot (Section 7.14): for a transfer of USDT on Tron or Solana in /send or /sendmany you can choose to pay the fee in USDT. Our backend then builds the transactions through Transatron or Candide as described above and checks them, and the sign page shows the fee before your wallet signs; those providers receive the same data as for the App.
• Bitcoin: to offer Slow, Normal and Fast, the App reads the current fee rates from mempool.space and blockstream.info, and the unspent outputs of your Bitcoin address from the same services, which therefore see that address and your IP address.

These providers see the IP address of our backend, not yours. Our backend does not store the operations it forwards; it keeps, in its memory only, a count of requests per installation to limit abuse, and, in our database, one counter per day of the units we use at Pimlico, which contains nothing about you. Section 22 lists the providers.

7.22 Grünwald in chats (@grunwald)

If you tag @grunwald in a public chat or comment, in the App, on the web terminal or in the Telegram bot, our backend sends the text of that message, without the tag, to our AI provider together with public market data from Hyperliquid, and publishes the answer as a reply to your message from the official account @grunwald, starting with your handle. Nothing else is sent: not your wallet, balances, positions, conversations or memory, and not anybody else’s. The answer is public like any message in that chat (Section 9), counts towards your daily Grünwald allowance, and is deleted, reported and moderated like other messages. Use the Grünwald tab, not a public chat, for questions about yourself.

8.The public trader profile

The public profile is off by default. Nothing described in this section or in Sections 9 to 12 happens until you turn it on in Settings, claim a handle, and sign the ownership challenge with your wallet. Turning it on is the act by which you make the information below public; turning it off again stops your profile and your published trades from being shown, and Section 29 describes how to erase them entirely.

When your profile is public, our backend reads your trading record from Hyperliquid and stores a copy of it in our database, where it is readable by any signed-in user of the App. What becomes readable is:

• your Ethereum-format wallet address, which is the key of the record and is always visible while the profile is public, and your handle, which is stored in a public lookup table so that handles are unique across the App;
• the profile details you entered: display name, biography, status emoji, spoken languages, social links (which may include an e-mail address and a website you add), and avatar. An avatar is a preset, or a colour and an emoji you choose, or a photograph you upload; where you upload one, what is stored on your profile record is the web address of that image, and the image itself is stored as described in Section 9A;
• your aggregate trading statistics: traded volume in US dollars, realized and unrealized profit and loss, win rate, return on investment, number of trades, trader points, league, season score, and peak account balance, both all-time and broken down over the last 1, 7, 30, and 90 days and over the current season;
• your individual trades: we mirror your most recent executions, currently up to 200 of them, with the instrument, direction, execution price, size, timestamp, realized profit and loss, fee, transaction hash, order identifier, and trade identifier;
• your open positions: instrument, side, size, entry price, leverage, unrealized profit and loss, and margin used, refreshed periodically;
• your open orders: instrument, side, limit price, size, type, and time;
• your follower and following lists, your clan membership, and any league rewards credited to you.

Your addresses on Bitcoin, Tron, Solana and TON, and your Lightning address (Section 7.20), are published only if you switch that on separately, network by network. Your Ethereum-format address is your public identity on the leaderboard either way and cannot be hidden while the profile is public.

Discover and search. While your profile is public it is listed in Discover, a list of public profiles in the App, in the Telegram bot and on the web terminal, and it can be found by handle or display name in the App’s search, which looks at people, clans and communities together. Discover shows your handle, display name, avatar, league, number of trades, number of followers and the verified mark if you have one. On the web terminal this list is shown without any sign-in at all, to anybody who opens the page; it carries the same public fields and nothing more. The App keeps your recent searches on your device only. A profile that is not public is not listed, not found, and not shown in other people’s follower or following lists.

The verified mark. A blue check next to a name means that we have confirmed the account belongs to the partner or person it names. Only we grant it, there is no way to apply for it in the App, and it is not an endorsement of anyone’s trading. It is stored on your profile record and in a public list of verified profiles that the App reads to draw the mark, and it is removed from both when your profile is deleted.

Our official accounts. Two public profiles belong to us: @grunwald, the assistant’s page, and @traderwallet, which publishes our announcements and which you may follow like any trader. Both carry the verified mark. Their names and close look-alikes, and a few other names such as support or admin, are closed: nobody else can claim them as a handle or as the name of a Lightning address.

Sending to a handle. In the App, and in the Telegram bot’s /send, /sendmany and NFT sending, anybody may type @ and a handle instead of an address. Our backend receives the letters typed and answers with up to five public profiles whose handle begins with them (handle, display name, avatar, league and verified mark). The address it gives for a network is only the one the owner published on the profile for that network, or, if the sender’s own address book (Section 7.15) has a contact for that handle, the address of that contact. A profile that is not public, is suspended or is a demo profile is answered exactly like a handle that does not exist. We store nothing about the search or the transfer; the App keeps on your device the list of handles you have sent to (Section 5), so that it can tell you when you send to a handle for the first time.

Please consider carefully what this means before you switch it on. Publishing your trading record links a permanent, publicly readable blockchain address to a name, a biography, and a complete record of how much you trade, how often you win, and how much you have made or lost. That combination is far more identifying than any of its parts. Section 24 explains why the on-chain half of it can never be undone.

9.The trade feed, comments & likes

Automatic posts are created without you. While your profile is public, our backend periodically examines your closed trades and turns them into posts in the trade feed without any further action on your part. A post carries your handle, display name, avatar, and league; the instrument, direction, execution price, size, notional value, realized profit and loss, fee, and timestamp of the trade; the transaction hash, order identifier and trade identifier of that trade; and a snapshot of the market at the moment the position closed, stored as candle data so that the App can draw the chart. Settlements of prediction markets are not treated as trades and do not become posts.

A post is visible to every signed-in user of the App, not only to your followers. The feed screen shows the traders you follow, but a post can also be reached from your profile or from a direct link, and the underlying access rule is "any signed-in user, provided the post is not hidden". Treat everything in a post as public.

A written post is one you compose yourself. If your profile is public, the App lets you pick one of your own closed trades, write text about it, and publish it. What is stored is the text you wrote, the same author details a comment carries (handle, display name, avatar, league), and the figures of the trade you picked. The figures are read by our backend from the exchange record of that trade and never from anything you type, so a written post cannot state a result that did not happen. A written post is visible to every signed-in user on the same terms as an automatic one, can be liked and commented on in the same way, and is deleted by the same profile-deletion and account-deletion functions. Publishing one does not remove or alter the automatic post about the same trade.

Under each post, other users may leave comments and likes, and you may do the same under theirs. A comment stores its text together with your handle, display name, avatar, and league, and is visible to every signed-in user. Replies are supported one level deep. The list of people who liked a post or a comment is readable by any signed-in user. Your own likes are additionally recorded in a private per-user document so the App can show you what you have already liked without re-reading every post; that document is readable only by you.

A comment can also be attached to an asset instead of to a post. Every tradable thing in the App (a token, a perpetual futures market, a spot pair, a Hyperliquid vault, a staking or lending market, and a prediction market) carries a public comment wall. What is stored is identical to a comment under a post: the text, your handle, display name, avatar and league, and the moment it was written, plus an identifier of the asset the wall belongs to. It is readable by every signed-in user who opens that asset. Reading a wall requires only that you are signed in; writing on one requires a public profile, which means an asset comment always carries a name you chose to publish. Replies go one level deep, likes work the same way, and the same private per-user document records which ones you liked.

Comment walls are not limited to tradable things. The same comment mechanism, storing exactly the same data, is attached to seventeen kinds of place in the App. Besides the seven kinds of asset named above, a wall exists on a clan, on a community, on a trader’s profile, on a duel, on a clan war, on a league, on a season, on each of the two leaderboards, the all-time one and the seasonal one, and on each news story (Section 7.12). Three of these carry an extra rule. A clan’s wall is the clan’s chat: its leader can restrict writing to members of that clan, and when they do, everyone can still read it. A community’s wall is the community’s chat: its owner can restrict writing to the owner alone, may delete any message in it and may remove a member, and everyone can always read it. A trader’s profile wall belongs to that trader, who can switch comments on their own profile off; the owner of a wall can always write on it. Everything else is the same everywhere: the text, your handle, display name, avatar and league, the moment it was written, and an identifier of the place the wall belongs to, readable by every signed-in user who opens it.

A comment wall is public, not private. It is not a direct-message feature and there is no way to send a message to one person through it. Nothing you write there is confidential, and it can be read by anyone with the App, including people you have not met and search engines if we ever publish the walls on the Site. We recommend that you write nothing on one that you would not put on a public forum.

Two limits shape what is stored. Comments are capped at 500 characters and at 100 per 24 hours per address, counted across posts and asset walls together on a rolling window rather than a calendar day; a clan leader or officer may additionally set a minimum interval between messages in their own clan’s chat, which applies to that chat only. A written post is capped at 5000 characters, at 10 written posts per day per address, and at one written post per trade. And links are not published: a comment that contains a web address is refused and not stored at all, and the App says so; a web address in a display name, a biography, a clan or community name or description, or in the text of a written post is stripped out before the text is written to our database, because links in a crypto application are the primary vector for fraud. The App tells you when your text was changed by this filter. The stripped text, not the text you typed, is what is stored and shown.

You may follow other public traders and be followed by them. Follower and following lists are visible on public profiles. When a message mentions another person’s handle with @, the App checks whether that handle exists by reading the public register of handles (the same one that makes handles unique) and, if it does, shows the tag as a link to that profile; nothing is sent to the person tagged and nothing new is stored. You may block another user, which removes them from your view of search results and lists; blocking is described further in Section 28 and in our Terms of Service.

Attachments to messages. A message in any chat (comments under a post or an asset, clan and community chats) may carry attachments next to its text: up to two photos, two trade cards, one GIF and one poll (Section 9B) in one message. It stays one message: it is stored as one record, and reporting, blocking and deleting act on the whole message with all its attachments. A trade card shows one of your own trades on Hyperliquid: you choose which, and our backend reads its side, leverage, entry and exit prices, result and the price chart around it from Hyperliquid’s public record of your address, so the numbers cannot be typed in; it is public like the message and shows the result of that trade to everybody who sees the chat. If you choose to attach your chart drawings, the lines you drew on that market’s chart in the App are stored with the message as shapes in price and time. A GIF is described in Section 7.19 and a photo in Section 9A. Any user can report the pictures of a message (its GIF and photos) from the message’s menu; they are then hidden for that user at once, and the report goes to the moderation queue of Section 12.

Popular chats. To show the most active chats, our backend counts the messages of each chat per hour, without recording who wrote them, and keeps those counts for seven days; the list shows each chat’s name, the number of its messages and the time of the last one, and for a chat under a post, the author’s public @handle.

9A.Photographs you upload

You may upload a photograph and use it as your profile picture; if you lead a clan, or are an officer whose leader has allowed it, as your clan’s emblem; and if you own a community, as that community’s picture. Everything in this section applies to all three in the same way. This is optional. If you upload nothing, your avatar remains a preset, a colour with an emoji, or the pattern generated from your address, exactly as before, and nothing in this section applies to you.

The banner. On a public profile you may also upload a banner, a wide picture shown at the top of your profile. Everything in this section applies to it as to a profile picture, with one difference in size: a banner is reduced to 960×320 pixels. It is reported through the same menu and the same queue, and a report that is upheld deletes it.

What leaves your device. You choose one image from your photo library and crop it yourself in the App. The App then reduces it to 256×256 pixels (a banner to 960×320) on your device and uploads only that reduced copy. In the Telegram bot you send the photo in the chat instead; our backend reduces it the same way and stores only the reduced copy (Section 7.14). The original photograph is never uploaded, and no other image in your library is read.

Where it is stored. The reduced image is stored in an object-storage bucket operated by Cloudflare (Cloudflare R2), listed in Section 22. It is served to other users from our own domain, cdn.traderwallet.app. Your public profile record in our database stores only the web address of that image, not the image itself.

Who can see it. The image is public in the same sense as the rest of a public profile: anybody who can see your profile, your posts, your comments or your clan can see it, and it is reachable by its web address by anybody who has that address. It is not access-controlled, and we recommend that you upload nothing you would not put on a public forum. A clan emblem is public in the same way.

How often it may change. You may obtain at most three uploads in any 24 hours for the address you are using, and the App as a whole has a daily ceiling on uploads. These limits exist to bound our storage costs and to make organised abuse expensive; the App says plainly when one has stopped an upload.

Moderation. An uploaded image is user content and is covered by the community rules in our Terms of Service exactly as a comment is. It can be reported by any user who sees it. Where a report is upheld, or where enough reports accumulate, the image is deleted from storage and your avatar returns to the preset you had before. We do not review images before they appear, and we do not run automated image scanning.

Deletion. Removing the photograph in the App deletes the file from storage, not merely the reference to it. The same deletion happens when you delete your public profile (Section 29), when you delete your account (Section 29A), when a clan is disbanded or a community is deleted, and when a report against the image is upheld. Deletion from our storage does not reach copies that other people have already saved or that intermediate caches may hold for a limited time.

Photos in messages. You may also attach a photo from your photo library to a message in a chat. The App reduces it on your device to at most 1280 pixels on its longer side and compresses it, and uploads it only when you send the message. It is stored in the same Cloudflare R2 storage and served from the same domain; the message stores only its web address. You may send at most 20 photos in any 24 hours. A photo is public like the message that carries it, can be reported like any image in this section, and is deleted from storage when the message is deleted (by you or by a moderator), when you delete your public profile (Section 29) and when you delete your account (Section 29A).

9B.Polls & quizzes

A message in a chat can carry a poll or a quiz, a poll with one right answer chosen by its author. You can create one, vote in one, take your vote back in an ordinary poll while it is open and, as its author, close it. Polls work in every chat of the App, on the web terminal, and on the asset walls of the Telegram bot, where you can vote and take a vote back but cannot create a poll.

What is stored. The message stores the question, the options and the settings (anonymous or public, one or several answers, quiz, closing time), visible to everybody who can read that chat. A separate record on our backend, which no device reads directly, stores the number of votes for each option, the number of people who voted, the right answer and the author’s explanation of a quiz, and one entry for each voter: the wallet address that voted, the options chosen and the time. Each address votes once; voting again replaces the earlier choice.

Who sees what. Before you vote you see the question, the options and the total number of votes, and nothing else; if the author turned off Show vote count, the App shows no number of votes, in total or for an option, before or after voting, and our backend does not give the numbers out; in a public poll the list of who voted for an option can still be opened after you vote or once the poll has closed; the percentages and, in a quiz, the right answer are shown after you vote or once the poll has closed. In a public poll your entry also keeps your address, handle, display name, picture and league as they were on your profile when you voted, and anybody in that chat who has voted, and everybody once the poll has closed, can see which option you chose. In an anonymous poll, which is the default, nobody can see who voted for what, not even the author of the poll, and our backend never gives it out. The card says which kind a poll is above its question.

No prizes. A quiz is a question with a right answer, not a contest: there is nothing to win, and a poll is not a giveaway (Section 10).

How long it is kept. A poll stays as long as its message. When the message is deleted, its poll is hidden with it: nobody can open it, its results or its voters any more, and voting in it is refused. Your votes are erased, and the totals of each poll are counted again without them, when you delete your account (Section 29A) or your public profile (Section 29). Deleting your public profile also deletes the polls you started, with their votes, as it deletes your messages; deleting your account keeps them in the anonymised chat, without your address as their author. Messages of the Telegram bot and older versions of the App that cannot show a poll show the line “Poll: … Update Trader Wallet to vote.” instead.

10.Clans, duels & clan wars

The App contains competitive features that publish additional information about you.

A clan is a group of public traders. Its name, emblem, biography, social links, leader, member count, aggregate statistics, and score are readable by any signed-in user, as is its member roster and its history. Your membership of a clan is shown on your profile. Clan invitations and join requests are readable only by the people they concern.

A community is a group without statistics. Its name, description, picture, owner, member count and member list are readable by any signed-in user, and the list of communities you belong to is stored on your public profile record, readable by any signed-in user. Joining requires a public profile and no invitation, and is recorded the moment you join; leaving, or being removed by the owner, deletes your membership record. A community publishes nothing about your trading.

A duel is a head-to-head contest between two public traders over a chosen instrument pool and period. Its record stores both participants' addresses, the pool, the window, the resulting statistics for each side, and the outcome. A duel record is readable by its two participants; the outcome is reflected in the trader points shown on your public profile.

A clan war is the same contest between two clans. The record stores the two clans, the rosters frozen at the moment the war started, the window, the per-side statistics, and the outcome, and is readable by any signed-in user.

Every signed-in user of the App can also see a list of the clan wars going on now, in real or in demo mode: the names of the two clans and the emblem of the first one, the pool, the time left and each side’s current result. The list carries no members, addresses or account identifiers.

Results of duels and wars are delivered to the participants through the in-app inbox described in Section 11, and points awarded from them are written to the public profiles of the people who took part.

A giveaway (Section 20A of the Terms of Service) is a prize draw that the leader of a clan or the owner of a community runs for its members. Giveaways run only on the web terminal of the Site and in our Telegram bot; the mobile App for iOS and Android does not offer them, and taking part is free. The records of giveaways that already exist stay on our backend as this section describes, wherever they were run. Our backend keeps a record of it that the members of that clan or community, its host and its winners can read: the title; the prize as the host described it (a coin, an amount and a network; we never hold it); the number of winners; where the participants come from and the conditions; the address, handle and profile picture of the host; and, once the list is fixed, the address of every participant and the handle of each participant whose profile is public at that moment, the hash of the list, the drand round and its published value, the addresses and handles of the winners, who pressed Spin and when, and, if the host marks a prize as sent, the transaction hash and its network. Everybody who can read the record also sees the addresses the host left out of the list or added to it by hand, and the address of every participant in the fixed list, including a participant whose profile is not public (without a handle): that is what lets anybody check the draw. To build the list and check the conditions, our backend reads data we already hold for the leaderboard and the profiles: membership of the clan or community and the date you joined it, followers, comments under the host’s post, your league, your number of trades and trading volume for the period, whether your profile is public, the date your address was first bound to the App (or, failing that, the date your profile was created), and earlier giveaways you won in the same clan or community. To draw, our backend reads the public value of a round from drand relays (the League of Entropy and Cloudflare); the request carries a round number and nothing about you. If you win, you receive an entry in your inbox (Section 11), and the host can ask our backend for your address on the network of the prize. The answer comes only from the addresses you chose to publish on your profile (Section 8), and is empty if you published none for that network; on EVM networks it is your Ethereum-format address, which is the key of your profile.

Giveaway records are not deleted: not when a giveaway is cancelled, and not when a participant, a winner or the host deletes their public profile or account. A giveaway exists so that everybody who was promised a fair draw can check it afterwards, and that check depends on the record staying exactly as it was fixed; we rely on our legitimate interest, and that of the members, in a draw that can be verified (Article 6(1)(f) GDPR). The record holds nothing beyond what is listed above. The check depends on the addresses and not on the handles, so if you ask us we will remove your handle and profile picture from giveaway records, and your address will stay.

11.Notifications, inbox & push tokens

Social activity that concerns you produces an entry in an in-app inbox held on our servers under your address. Inbox entries cover likes and comments on your trades, replies to your comments, clan invitations and requests, duel challenges, acceptances, declines and results, clan-war challenges and results, every moderation decision about your content or your right to publish (Section 12), and, if you own a community, a notice that it has been reported. An entry records the type of event, the address and handle of the person who caused it, the post or contest it refers to, whether you have read it, and when it was created. The inbox is readable only by you.

If you have enabled notifications, the same events may also produce a push notification. To route it, we store your device push token in a separate record keyed by your address, together with the platform, your language, and the timestamp of registration. We keep at most five device tokens per address, newest first, and the oldest is dropped when a sixth device registers. A token is also stored in a reverse lookup so that a device which changes wallet stops receiving notifications for the previous one, and a token that the messaging provider reports as dead is removed. Neither record is readable by any user, including you; both are written and read only by our backend. You can turn notifications off at any time in your device settings or in the App's notification preferences, which stops the sending, and you can ask us to delete the stored tokens under Section 30. The separate record that price and transaction alerts keep, with your push token and the addresses of the wallets you enabled for them, is described in Section 7.3.

To show a dot on the Social tab and on the inbox when something new arrived, the App asks our backend, at most once a minute while it is open and when a notification arrives, how many of your inbox entries are unread; the backend answers with that number only.

12.Reports, moderation & consent records

Any signed-in user can report a post, a comment under a post, or a comment on an asset wall. All three go into one moderation queue and are decided by the same process; there is no second queue that nobody reads. A report stores the reason chosen from a fixed list (spam, abuse or harassment, fraud or scam, sexual content, violence, or something else), any free-text detail you add, the address of the person reporting, the address of the person reported, the identifiers of the reported content, and, for a reported comment, a copy of its text. Reports are readable only by us and are used solely to moderate content. One report per person per item is counted, and a single address may file at most 20 reports in a day.

A post or comment that accumulates reports from 8 different accounts is hidden automatically, pending review by a person. Hiding is a precaution and is not a finding against the author. An uploaded picture that reaches the same count is deleted rather than hidden, and a community is never hidden automatically: its owner is told that it was reported, and only a person can remove it. Every automatic hiding, removal, restoration, suspension and reinstatement writes an entry into the inbox of the person concerned (Section 11), saying what was done, whether a person or an automatic count did it, and the reporter’s category where there was one. When we review a report we may dismiss it, which restores the content and clears its report count; remove the content; or remove the content and suspend the author's right to publish. A suspension is recorded on the author's profile with its timestamp, hides that author's existing posts and their comments on asset walls, and prevents them from publishing, commenting, following, renaming themselves, or reporting others; it does not prevent them from reading. Section 18 explains how this interacts with your rights over automated decisions, and our Terms of Service explain how to obtain the reasons for a decision and how to contest it.

Before you can publish a comment, you must accept the publishing rules shown in the App. We record that acceptance on our servers, under your address, as a timestamp and a version number of the rules text. We keep this record because two application stores and the Digital Services Act require us to be able to show that the person who published content had agreed to rules prohibiting offensive content and abusive behaviour. Only the first acceptance is stored, so the recorded date remains the true one. This record is deleted when you delete your public profile.

13.Categories of personal data

The table below summarizes the categories of personal data we may process, whether we collect them, and why. We do not sell or share any of these categories for cross-context behavioral advertising, and we do not process special categories of personal data.

14.Sources of personal data

We obtain personal data from the following sources:

• Directly from you, when you sign in, use the AI assistant, enable notifications, publish a profile, write a comment, write a post about your own trade, follow someone, join a clan, file a report, or contact us;
• Automatically from your device, when it communicates with our backend or with blockchains and providers (for example your IP address);
• From public blockchains and trading venues, principally Hyperliquid, from which our backend reads the trading record of an address you have published and from which your posts and statistics are derived;
• From service providers and from other users, for example an account identifier returned by Google or Apple when you choose social sign-in, or a report filed about your content by another user; and
• From Google Play, on Android, once after installation: if you installed the App from a partner link, Google Play hands the App the partner code that was in that link (the Play Install Referrer), which the App offers to you the same way as a code you typed. The App reads it once and nothing else comes with it.

15.How we use personal data

We use personal data only for the following purposes:

• to provide, operate, and maintain the Services and the specific features you choose to use;
• to authenticate you and secure your account if you sign in, and to prove that a published address belongs to you;
• to generate AI-assistant responses when you use that feature;
• to publish the public profile, trading statistics, posts, comments, likes, followers, clans, duels, and wars that you have chosen to take part in;
• to deliver in-app inbox entries and the push notifications you opt into;
• to obtain quotes and execute the on-chain actions you initiate;
• to moderate published content, act on reports, enforce our Terms of Service, and protect the Services and users against fraud, abuse, spam, and security threats;
• to keep a record that you accepted the publishing rules before publishing;
• to diagnose problems, maintain reliability, and improve the Services;
• to respond to your requests and communications, including requests for the reasons behind a moderation decision; and
• to comply with applicable legal obligations, including those under the Digital Services Act, and to establish, exercise, or defend legal claims.

16.Legal bases for processing (GDPR)

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. Where we rely on consent, you can withdraw it at any time (for example by signing out, disabling a feature, turning off the public profile, or deleting it); withdrawal does not affect processing that took place before it, and it cannot reach data that has already been recorded on a public blockchain.

17.Marketing communications

We do not run advertising and we do not sell your data to marketers. We may send you service-related (transactional) messages that are necessary to operate the Services, such as security notices, moderation decisions, or important changes to these documents. If we ever offer an optional newsletter or promotional messages, they will be strictly opt-in and you will be able to unsubscribe at any time. We do not need your consent to send essential service messages, but we will not use your contact details for marketing without a lawful basis.

18.Automated processing & profiling

We do not build marketing or behavioral profiles, and we do not carry out automated decision-making that produces legal effects concerning you within the meaning of Article 22 GDPR. The AI assistant generates responses automatically, but it does not make decisions about you or your access to the Services; it is an informational tool only. The written memory it keeps on the Max tier (Section 7.2) is used only to answer you and is not used to decide anything.

Two forms of automated processing do affect what is shown, and we describe them rather than leave them implicit. First, your published statistics, trader points, league, and season score are computed automatically from your trading record; they determine your position on the leaderboard and in the league structure, and they are visible to others. Second, content that is reported by 8 different accounts is hidden automatically, without a person having looked at it first, as described in Section 12. Automatic hiding is temporary and precautionary, is reversible, and is followed by human review; a suspension of the right to publish is never automatic and is always applied by a person. Our Terms of Service set out how to obtain the reasons for either measure and how to contest it, and you may in any case ask us to review a decision by writing to contact@traderwallet.app.

19.Cookies, storage & website technologies

Mobile App. The App does not use advertising or tracking cookies. It uses on-device storage (such as secure storage, local databases, and app preferences) purely to make the App function, keep you signed in, and cache data. This storage is local to your device.

Website. The Site is primarily an informational landing page. It may use strictly necessary local storage to function and, if you sign in on the web, to keep your session. The Site does not use advertising cookies or third-party analytics or advertising trackers. The Site currently loads web fonts from Google's font service; when your browser requests those fonts, your IP address is shared with Google as part of that request. We may in future self-host fonts to remove this dependency. We do not use cookies to track you across other websites.

Do Not Track. Because we do not track users across sites, we do not respond to browser "Do Not Track" signals in a special way; our default behavior is not to track you.

20.What we do not do

To be unambiguous about our practices, we do not:

• sell, rent, or trade your personal data to anyone;
• share personal data for cross-context behavioral advertising;
• use third-party advertising SDKs or display ads in the App;
• use advertising identifiers (Google Advertising ID / IDFA) or engage in cross-app tracking;
• use third-party product-analytics platforms to profile your behavior;
• publish anything about your trading unless you have turned the public profile on yourself;
• allow image uploads anywhere other than the profile picture, the banner, the clan emblem, the community picture and the photos attached to chat messages described in Section 9A. A display name, a biography and the text of a comment or a post are text only;
• collect your precise location, contacts, messages, or call logs;
• read your photo library. The App opens the system photo picker in four places only, and in each of them you choose the image yourself: the camera view that scans a QR code, the picker that sets a background for your balance card, the picker that sets your profile picture, your banner, your clan’s emblem or your community’s picture, and the picker that attaches a photo to a chat message. A background image you choose is copied into the App's own storage on your device, is used only to draw that card, and is never uploaded to us or to anyone else. A profile picture, banner, clan emblem, community picture or message photo is uploaded, because other users have to be able to see it, and Section 9A says exactly what happens to it;
• require identity verification (KYC) to use the wallet; or
• have any ability to access your recovery phrase, private keys, or funds.

21.Device permissions

The App requests only the permissions needed for specific features. You can grant or revoke optional permissions at any time in your device settings.

22.Third parties & sub-processors

We share the limited data described in this Policy only with the providers needed to deliver the features you use, and only to the extent necessary. Each provider operates under its own privacy policy and its own security and retention practices, which we do not control. This list may change as the App evolves; we keep it current and update the effective date when we make material changes.

Other users of the App are not sub-processors: what you publish is disclosed to them because you chose to publish it, and once it has been seen, copied, or screenshotted by another person we cannot retrieve it.

We may also disclose personal data where required to comply with a valid legal obligation, including an order from a national authority under Article 10 of the Digital Services Act, to protect our rights or the safety of users, or in connection with a corporate transaction (such as a merger or asset transfer), in which case we will require the recipient to honor this Policy.

23.Aggregated & anonymized data

We may create aggregated or anonymized data that does not identify you (for example, the total number of installations or the number of transactions of a given type). Once data is truly anonymized, it is no longer personal data, and we may use and disclose it for any lawful purpose, including operating and improving the Services.

24.Blockchain transparency

When you send, receive, swap, bridge, stake, lend, or trade on public blockchains, your wallet addresses, transaction amounts, timestamps, and counterpart addresses become part of a permanent, public ledger that anyone can view using a blockchain explorer. This information cannot be deleted, altered, or hidden, and it is outside our control. On TON this includes the comment you may type on a transfer, which is written into the transaction itself. On an EVM network where you pay fees in USDC, the authorization of Section 7.21 is public too: anyone can see that your address runs the account contract it names. Lightning and Spark payments are not written to the Bitcoin blockchain one by one, but they are known to the parties that carry them (Section 7.20), and moves between your Lightning wallet and your Bitcoin address are written to it. This is a fundamental property of public blockchains, not a feature of Trader Wallet.

Cryptocurrency addresses are pseudonymous, not anonymous. Your legal identity is not published on-chain, but if an address is ever linked to you, your associated on-chain activity can be traced back to you. Publishing a public profile in this App is precisely such a link: it ties your handle, your name, and your biography to an address whose entire history is permanently readable by anyone, and the posts in the feed carry the transaction hashes that make each trade findable on-chain. Deleting your profile removes our copy; it does not and cannot remove the underlying chain records or any copy a third party has already taken. Consider this before you publish, and consider using a separate address for anything you do not want associated with your public identity.

25.International data transfers

Some of our providers process data outside your country, including in the United States. Where personal data of users in the European Economic Area, the United Kingdom, or Switzerland is transferred internationally, that transfer is protected by an appropriate safeguard, such as the European Commission's Standard Contractual Clauses adopted by the relevant provider, or is necessary to perform the service you requested under Article 49(1)(b) GDPR. You may contact us for more information about the safeguards that apply. Content you publish is, by its nature, readable by users of the App anywhere in the world.

26.Data retention

We keep personal data only for as long as needed for the purpose it was collected, then delete it or anonymize it. Specific retention criteria are set out below.

Where we are required to retain certain data to comply with a legal obligation or to establish, exercise, or defend legal claims, we will retain it for the period required for that purpose.

27.Security & data breaches

We take reasonable and appropriate technical and organizational measures to protect personal data, including:

• storing sensitive on-device data (including your recovery phrase and private keys) encrypted in the platform secure store, using AES-256 via Android Keystore or iOS Keychain and hardware-backed protection where the device supports it;
• encrypting network communications with HTTPS / TLS;
• loading private keys into memory only briefly to sign a transaction, then clearing them;
• using established, audited cryptographic libraries rather than custom cryptography;
• enforcing database access rules that make published data readable while keeping private records (your blocks, your like memo, your inbox, your push tokens, the address-to-account bindings, and the moderation queue) closed to all clients, and that make every write to published data pass through our backend rather than through a device; and
• limiting backend logging and access.

No method of transmission or storage is perfectly secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and affected users where required by law, and we will take steps to mitigate the breach. You play an essential role in security: keep your device updated and protected, use a strong device lock, never share your recovery phrase, be alert to phishing, and avoid using the App on a jailbroken or rooted device.

28.Your choices & controls

You have direct, practical control over most processing:

• Use Guest mode to avoid providing any account data;
• Leave the public profile off, which is its default state, so that nothing about your trading is published;
• Turn the public profile off at any time, which stops your profile and your published trades from being shown to others;
• Choose which wallet addresses to publish, network by network and including your Lightning address, or publish none beyond the Ethereum-format address that identifies the profile;
• Turn off likes or comments on your trades, which applies to your existing posts as well as to future ones;
• Hide an individual published trade, which removes it from the feed permanently and does not bring it back later;
• Delete a comment you wrote, whether it sits under a post or on an asset wall;
• Block another user, which removes them from your view of lists and search, and unblock them later from the blocked-users screen;
• Report content you believe breaks the rules or the law;
• Delete your public profile entirely, as described in Section 29;
• Sign out to end account-based processing;
• Disable notifications in your device settings, or switch off individual categories of social notification in the App;
• Avoid or stop using the AI assistant, and delete your AI chat history at any time;
• Revoke camera or microphone permissions in your device settings; and
• Clear app data or uninstall to remove local data.

29.Deleting your public profile

The App contains a deletion function that erases the public footprint of an address. It is intended to give effect to your right to erasure under Article 17 GDPR for the data you have published, and it runs in stages because there may be thousands of documents to remove.

Deletion removes: your posts, together with the comments and likes underneath them; every comment you wrote under other people's posts, with their comment counts corrected; every like you gave anywhere, with the counts corrected; the photos attached to your messages and to the comments under your posts, deleted from storage; the browser proofs of your address for the web terminal (Section 7.9); your mirrored trades, positions, and orders; your follower and following lists; your blocked-users list; the private records of what you liked and of your acceptance of the publishing rules; your rate-limit counters; your profile document itself; your claim on your handle, which becomes available to others again; and the binding between your address and your account. Your pending and active duels are voided rather than awarded to your opponent, you are removed from your clan (with leadership handed on, or the clan dissolved if you were its last member), and you are struck from the frozen rosters of any active clan war.

Deletion also removes your votes in polls, with the totals of each poll counted again without them, and the polls you started, with their votes (Section 9B).

Deletion is irreversible, and it costs you your trader points and your league standing for good. The App says so before you confirm.

29A. Deleting your account, and what it does not yet remove

Deleting your account is a different action from deleting your public profile. Section 29 describes profile deletion. This subsection describes account deletion, and states plainly what it does and does not do today.

Account deletion re-authenticates you, erases the data held under your account identifier and under your wallet addresses, revokes our access token where the sign-in provider requires it, deletes the authentication record held by Firebase Authentication, and returns the App to a Guest session. Your wallet is unaffected: keys live on your device and are not part of the account.

The following are erased:

• the addresses of your wallet kept for support (Section 7.17), and your installation’s entries under addresses you do not own;
• the photos attached to your messages (Section 9A), deleted from storage and removed from the messages, which are otherwise anonymised as before;
• your AI assistant chat history and the usage counters attached to it;
• your subscription record, including any promotional grants;
• the accrual records under your partner codes and any payout requests. The code documents themselves are not deleted but anonymised: your address is removed from them and they are closed to new users, while the code, its creation date and its counters stay, because the fee reduction of everyone who joined with your code is computed from that creation date and deleting it would silently take their reduction away;
• your public trader profile, if you turned one on, including your handle, which is released, your published executions, positions and orders, your posts, likes, follows, notification inbox and block list. You no longer need to delete the profile separately first;
• your demo trading account and its trade history;
• your stored push notification tokens, and the price alerts registered for the device from which you delete the account (alerts registered from another device are tied to that device’s push token and are erased when that device deletes the account or removes the alerts);
• the suggestions and bug reports you sent from Settings, and the counter that limits them (Section 7.13);
• the encrypted cloud copy of your address book and enabled tokens described in Section 7.11;
• your address book on our server described in Section 7.15;
• your profile banner, together with your profile picture (Section 9A);
• your votes in polls, with the totals of each poll counted again without them; the polls you started stay in the anonymised chat without your address as their author (Section 9B);
• the names of your Lightning addresses in our register of names (Section 7.20), deleted at once;
• the browser proofs of your addresses for the web terminal (Section 7.9);
• the encrypted copy of your recovery phrase described in Section 7.8. This is erased last, after everything else, so that an interrupted deletion never leaves you without it.

Three things are treated differently, and we say so plainly. Comments you left on other people’s posts and on every other wall (assets, clans, communities, profiles, duels, wars, leagues, seasons, leaderboards and news stories, Section 9) are anonymised rather than deleted: everything identifying you is removed and the comment is marked as written by a deleted account, so that other people’s conversations do not fall apart around it. The device fingerprint recorded to limit abuse of one-per-device offers is retained, but your account identifier is erased from it, leaving an anonymous marker that no longer points at you or at any person. The device identifier hash of Section 7.1, kept for the partner programme, is erased.

The third is a record that one-time rewards have already been given to a wallet address. When a reward that can be claimed only once is granted, for example the month of Grünwald Max that comes with joining through a partner code, we write the address and the name of the reward into a register, and that register survives account deletion. Everything else that could show the reward had been given is erased along with the account, so without this register the same wallet could delete its account and claim the same one-time reward again, without limit. The register holds a wallet address and a list of reward names. It holds no account identifier, no handle, no name, no amount, and nothing that describes what you did in the App, and we use it for nothing except refusing a second grant of the same reward.

Your Lightning wallet and the Breez server. The Lightning wallet lives in your recovery phrase and not in the account, so account deletion does not touch it, and our register of names keeps none of the names held under the account (Section 7.20). The registration of your Lightning address at the Lightning address server of Breez is different: Breez removes it only on a request signed with the key of your Lightning wallet, and account deletion does not remove it, so the address keeps working for your Lightning wallet. Breez keeps a name that is given up, or replaced by a new one, reserved for the Lightning wallet that held it, so it cannot pass to another person and payments sent to your old address cannot reach anybody else. If you want a name of yours released in our register at any other time, choose another one in the App or write to us, and we will delete the record.

Giveaways. The records of giveaways you hosted, took part in or won stay as they were fixed, for the reason given in Section 10, and account deletion does not erase them. Ask us and we will remove your handle and profile picture from them; your address stays, because checking the draw depends on it.

An unfinished duel is voided and no points are awarded to either side. If you were the only leader of a clan, leadership passes to the longest-standing remaining member; if you were its last member, the clan is dissolved.

Earlier versions of this Policy stated that account deletion did not erase this data, and at the time that was accurate. It changed in the version of the App released with this Policy update, and this section changed with it. If you deleted an account before that release and want the older records erased, email contact@traderwallet.app and we will erase them by hand.

A standalone page describing how to delete your account, including how to do it if you no longer have the App installed, is published at traderwallet.app/delete-account.

30.Your rights (GDPR)

If the GDPR applies to you, you have the right to:

• access the personal data we hold about you, and obtain a copy of it;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten"), subject to legal limits;
• restrict or object to certain processing, including processing based on our legitimate interests;
• data portability, to receive your data in a structured, commonly used, machine-readable format; and
• withdraw consent at any time where processing is based on consent, including the consent you gave by publishing a profile.

Many of these you can exercise yourself in the App, using the controls in Section 28 and the deletion function in Section 29, which is usually faster than writing to us. For anything else, email contact@traderwallet.app. To protect your data, we may need to verify your identity before acting on a request, for example by confirming control of the email address associated with your account or by asking you to sign a challenge message with the wallet address the request concerns. We will respond within the timeframes required by law (generally within one month, extendable for complex requests). Exercising your rights is free unless a request is manifestly unfounded or excessive.

Two limits are worth stating plainly. We cannot erase or rectify data recorded on a public blockchain, for the reasons in Section 24. And where content you published has already been seen or copied by other users, erasure from our database cannot reach those copies.

You also have the right to lodge a complaint with your local data-protection authority; in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw.

31.California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended, gives you rights over your personal information. This section serves as our notice at collection and describes those rights.

Categories collected. As set out in Section 13, we may collect identifiers, wallet addresses, profile information, trading and financial activity, user content, social-graph and moderation data, internet/network activity, coarse location inferred from IP, and audio (voice input). We do not collect sensitive personal information as defined by the CPRA.

No sale or sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months. Accordingly, no "Do Not Sell or Share My Personal Information" action is necessary. Information you publish through the public profile and the feed is disclosed to other users because you chose to publish it, not because we sold it.

Purposes and disclosures. We use personal information for the business purposes in Section 15, and disclose it only to the service providers in Section 22, who are contractually limited to processing it on our behalf.

Your rights. You have the right to know, access, correct, and delete your personal information, and to not receive discriminatory treatment for exercising these rights. We do not offer financial incentives in exchange for personal information. To exercise your rights, email contact@traderwallet.app; you may use an authorized agent, and we may verify your identity and the agent's authority.

32.Other US state privacy rights

If you are a resident of another US state with a comprehensive consumer-privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, or others as they come into effect), you may have rights similar to those described above, including the rights to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, sale, or certain profiling. We do not engage in targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects, so those opt-outs do not apply. To exercise applicable rights, contact us at contact@traderwallet.app. Where a law provides an appeal process for a declined request, we will honor it.

33.Other jurisdictions

Data-protection laws in other jurisdictions may grant you additional or similar rights, for example Brazil's LGPD, Canada's PIPEDA, the UK GDPR, Switzerland's FADP, and laws in Australia, Japan, and elsewhere. Regardless of where you live, you may contact us to ask about the personal data we hold and to exercise any rights available to you under your local law, and we will respond in accordance with that law.

34.Third-party links

The Services may contain links to third-party websites, protocols, blockchain explorers, or applications that we do not operate. This Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to read the privacy policy of any third-party service before using it. A comment that contains a link is refused, and a link elsewhere in user-written text is removed before storage (Section 9), so a link that appears to reach you through the App is not something we transmitted.

35.Children's privacy

The Services are not directed to, and are not intended for, anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, or that a public profile belongs to a child, please contact us and we will take appropriate steps to delete it.

36.Changes to this Policy

We may update this Policy as the Services and applicable laws evolve. When we make material changes, we will update the effective date and version at the top and, where appropriate, notify you in the App or on the Site. We encourage you to review this Policy periodically. Your continued use of the Services after changes take effect means you accept the updated Policy.

37.Demo trading mode

The App contains a demo trading mode in which trading is simulated. No order reaches an exchange and no funds move. The demo balance has no monetary value and cannot be bought, exchanged or withdrawn; the legal terms are in Section 44 of our Terms of Service. Demo mode offers no prize, reward or payment of any kind, and there is no contest attached to it.

What we store. A demo account is keyed by your wallet address, the same public identifier used by the public trader profile, and not your Firebase account identifier; opening one requires the same signed proof that the address is yours as publishing a profile does, and the web terminal may be linked to the same demo account with a further signature. Against that address we store the simulated balance, simulated open positions, closed simulated trades, the counters derived from them (number of trades, return, largest drawdown, days active), the points and wins of demo duels and demo clan wars, and the times at which you topped up or reset the account.

Why. To run the simulation, to show you your own results, and to produce the demo standings. The legal basis is performance of a contract (Article 6(1)(b) GDPR) for running the mode you asked for, and our legitimate interest (Article 6(1)(f)) in keeping the standings honest.

What is public. Demo standings show a wallet address, and, where you have a public profile, its handle and avatar, together with the simulated result. Demo results are never mixed into real results. They do not enter the real leaderboard, the leagues, the seasons, real duels and clan wars, real clan metrics or the trade feed, and a demo trade never creates a post. Duels and clan wars can also be played in demo mode: such a contest is marked as demo when it is created, is decided from the demo accounts of its participants, and its points and wins are kept on the demo accounts and in the clan’s demo counts, never in the real ones.

Abuse checks. The App does not currently run any automated check on demo accounts: nothing looks for one person running several accounts or for accounts trading against each other, and nothing is deleted, hidden or blocked on that basis. If we introduce such a check we will describe it here first. Nothing about money depends on demo mode: there is no prize and no payment attached to it.

Retention. Demo data is kept while the demo account exists and is deleted with it. Deleting your public profile does not by itself delete demo data; write to us if you want both removed.

38.Partner referral programme

If you join using a partner code, we store on your wallet address the fact that this code was used and when. The date is kept as a record of when you joined. The partner’s share, and your own first-year fee reduction, decrease with the age of the code and are computed from the date the code was created, which is stored on the code. If you are a partner, we store your code, your wallet address as its owner, the number of users who joined with it, how many joined today, and the amounts accrued, requested and paid, together with the individual accrual records these are built from. Where you created the code yourself, we also store your own cumulative trading volume as it stood at that moment, taken from the same public exchange record that produces your league. That figure is kept as a record of when the code was made and is not used to decide anything.

What a partner can see about each person who joined with their code. The list of referrals in the App shows the partner, for every user who joined with one of their codes:

• the wallet address of that user. The list itself shows a shortened form, and the full address is available on the screen the partner reaches by tapping the entry, where it can be copied, opened in a block explorer, or used to send funds;
• the handle and avatar that user has chosen, where they have chosen one;
• the date on which they joined with the code;
• the cumulative trading volume of that user, in US dollars, and the number of trades behind it, taken from the same public exchange record that produces the leaderboard;
• the amount the partner has earned from that user, and the percentage share currently applied to them.

This applies even if the referred user has no public profile. Turning the public trader profile off keeps a person off the leaderboard and out of the feed; it does not hide them from the partner whose code they used. The partner is the one person, apart from us, who is shown that user’s address, handle, join date and trading volume together in one place.

What a partner is still not shown. A partner does not see a referred user’s e-mail address, device, balances, open positions, open orders, individual trades, profit and loss, assistant conversations, or anything held on that user’s device. A partner cannot message a referred user through the App, and referred users are not shown to one another.

Messages about the partner’s trades. If the partner chooses so (Section 7.14) and you use our Telegram bot, the bot tells you when the partner opens or closes a position. You stop these messages with /notify or by blocking the bot. The partner sees only how many people the messages reach, not who they are.

An earlier version of this Policy said less than this. It said that a partner sees only a shortened address and an amount, and that a partner does not see a referred user’s name or trades. That was accurate when it was written; the App has since added the referral list described above, and this section now states what it actually shows.

The partner’s month of Grünwald Max and self-invitation. A partner receives a month of Grünwald Max once, for the first person who joins with their code. A partner code applied from the partner’s own account or from the partner’s own device is refused: for this we compare the account and the device identifier hash described in Section 7.1. The person who applies a code still receives their own month of Grünwald Max as before.

Sources. Amounts arising from perpetual-futures, spot and prediction-market trading are computed from a record of collected fees published by the exchange, which is keyed by public wallet address; swaps and bridges produce no partner amount. Amounts we have not yet independently verified are marked as such and are not paid out.

Legal basis. Performance of a contract with the partner (Article 6(1)(b) GDPR), and our legitimate interest (Article 6(1)(f)) in attributing fees correctly and in preventing fabricated referrals.

Retention. Accrual and payout records are kept while the partner’s account exists and are erased when the partner deletes their account (Section 29A). Records of amounts actually paid out may also exist in our accounting outside the App, where the law requires us to keep them.

39.How to contact us

For any question or request about this Policy or your personal data, contact the controller:

Trader Wallet sp. z o.o.
ul. Złota 2/19, 15-016 Białystok, Poland
Email: contact@traderwallet.app

The same address is our single point of contact for users, for the authorities of the Member States, for the European Commission, and for the European Board for Digital Services under Articles 11 and 12 of the Digital Services Act. Correspondence may be in English or in Polish. Our Terms of Service describe how to report illegal content and how to contest a moderation decision.

We aim to respond to privacy enquiries within 30 days.