PRIVACY POLICY

1. WHO WE ARE

This policy explains what taptaptap — the team that builds and operates the taptaptap app and taptaptap.trade — collects when you use the app on the web or on Android, why, and who else sees it.

Questions, or any request about your data: legal@taptaptap.trade.

2. WHAT WE COLLECT

Email address. Signing in means giving your email to one of our authentication providers, Privy or Dynamic (newer accounts use Dynamic), which sends a one-time code and creates an embedded Solana wallet for you. To send you to the provider that holds your account, our server checks your email against a list of keyed hashes of the emails that already have accounts; it keeps only that hash, never the address itself. We see the email linked to your session. You can use Toly mode, the paper-money practice mode, without signing in at all.

Wallet address. Your Solana public key identifies you throughout the app, and is public on the blockchain by design.

Trading activity. Orders, positions, fills, profit and loss, and transaction signatures. All of it is public on Solana whether or not we store it; we read it back from the chain and from Phoenix to draw your profile, your history and the leaderboard.

App state. Your sign-in session, points, check-ins, referral attribution, paper-trading account and leaderboard standing, keyed to your wallet address. If you joined the waitlist, your email and any X handle you gave.

Technical and error data. Device and browser type, IP address, pages viewed and, when something breaks, the error and the state around it. Error reports are configured not to include personal data by default.

Cookies and local storage. A session cookie that keeps you signed in, a referral cookie when you arrive through a referral link, and an invite cookie only if the app is ever gated by invitation again. Your settings, market choice, paper account while signed out, and the on-device activity history are kept in your browser's local storage and never leave your device. None of this is used for advertising.

3. WHAT WE DO NOT DO

We do not run advertising trackers, build advertising profiles, or sell or rent your personal data to anyone.

We do not hold your private key, so we cannot access your funds, and we will never ask for your key or a seed phrase. Anyone who does is not us.

We do not ask for government identity documents. If you buy USDC with a card, the payment provider may ask for identity checks under its own terms; that data goes to the provider, not to us.

4. WHY WE USE IT

To sign you in; to build, check and submit the transactions you ask for, and sponsor their fees; to show your balances, positions and history; to run points, referrals and the leaderboard; to fix faults; to protect the service against abuse; and to meet legal obligations.

We rely on performing our agreement with you for the service itself, on our legitimate interest in keeping it secure and working for the rest, and on your consent where the law requires it.

5. WHO ELSE SEES IT

Privy and Dynamic (sign-in and the embedded wallet: your email and wallet address). Vercel (hosting and aggregate analytics). Solana RPC providers such as Helius (chain reads and broadcasting: your wallet address, requests and IP address). Phoenix (the exchange: your wallet address and trading). Sentry (error monitoring). Upstash (our database). Cloudflare (DNS and email).

Only when you use them: Jupiter, for the one-time USDC to SOL setup conversion (your wallet address), and Stripe or MoonPay, through Privy, for card purchases of USDC.

Each is an independent company with its own privacy policy and retention, and some process data outside your country.

Anything that reaches the Solana blockchain — your address, your trades, your transfers — is public and permanent. No one, including us, can delete or change it.

6. HOW LONG WE KEEP IT

Sign-in sessions last at most 30 days. Points, referral and leaderboard records are kept for as long as the programme they belong to runs. Error reports are deleted on our error-monitoring provider's retention schedule, currently no more than 90 days. Analytics are kept in aggregate. Waitlist entries are kept until the waitlist closes or you ask us to delete yours.

7. YOUR RIGHTS

Depending on where you live you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to complain to your data protection authority. Write to legal@taptaptap.trade and we will answer within 30 days. To confirm that a request comes from the holder of a wallet, we may ask you to sign a message with it.

Two limits are worth stating up front: we cannot delete anything from the Solana blockchain, and deleting the records we hold may reset your points, referrals and history.

8. SECURITY, CHILDREN AND CHANGES

We rely on the security controls of the providers above, encrypt data in transit, and limit who can reach production systems. No system is perfectly secure; if a breach affects your personal data we will tell you without undue delay.

The app is not for anyone under 18. If we learn that we hold data about a child we will delete it.

We may update this policy. The effective date at the top of this page is the version in force.