Privacy Policy

1. Who we are

This policy explains how [NFA legal entity name] (“NFA”, “we”) handles personal data when you use nfa.fun, our apps and related services (the “Service”). We are the controller of that data. Our address is [registered address]. You can reach us about privacy at privacy@nfa.fun.

Our EU representative: [EU representative, if appointed]. Our UK representative: [UK representative, if appointed].

This policy is a notice, not a contract. Our Terms of Service govern your use of the Service.

2. What we collect

You give us

• Account details: the email address and name from the sign-in method you use (Google, passkey, X), your handle, display name, bio and profile images.
• Linked accounts: if you connect X, your X id, username, name, profile picture and banner.
• Content: posts, theses, calls, messages, group chats, reactions, gift notes, reports and support conversations.
• Voice: your voice while you speak in a voice room. It is streamed to the other participants in real time and is not recorded by us.
• Choices: settings, watchlists, saved filters, notification preferences, and your agreement to our Terms.
• Waitlist and invites: your place, the invite or referral code you used, and the X follow check if you take that step.

Collected when you use the Service

• Wallets and transactions: the addresses of your nfa wallets, their balances, the trades, transfers, deposits, withdrawals, gifts and orders you make through nfa, and the fees and rewards they generate.
• Device and usage: IP address, browser and device type, operating system, language, pages and features used, timestamps, crash and error data, and push notification tokens.
• Presence: which coin or page you have open, if Online now is turned on and your visibility setting allows it.
• Approximate location: the country or region your IP address suggests, to decide which features are available where. We do not collect precise GPS location.
• Agreement records: when you agree to our Terms, we record the version, time, IP address, browser and app surface, as evidence of the agreement.

From others

• Privy (our authentication and wallet provider) tells us who you are when you sign in and which wallets belong to you.
• Public blockchains and data providers tell us what your wallets hold and do.
• X and social sources provide public posts and profiles shown on coin pages.
• Other users may mention you, message you, gift to you or report you.

We do not ask for government ID today. If we later offer a product that requires identity checks (such as a card), the provider of that product collects and handles it under its own policy, and we will tell you before you start.

3. How we use it, and why

Where we rely on legitimate interests, we have weighed them against your rights. You can object (Section 11). Giving us account details is needed to use the Service; most other things are optional.

4. Public by design

nfa is a social trading app. Unless you change your settings, your handle, display name, profile images, bio, trades, positions, profit and loss, NFTs, wallet addresses, posts, calls and who you follow are public, both in the app and on the web, and may be indexed by search engines and shown on share cards.

Blockchains are public and permanent. Transactions from your wallet, and its balances, can be seen by anyone who knows the address, whatever your nfa settings say. Once your address is linked to your profile, others can connect the two. Neither we nor anyone else can change or delete data recorded on a blockchain.

In Settings you can hide your trades and PnL, NFTs, wallet addresses and milestones from others, and choose who sees what you have open (everyone, people you follow, or no one).

5. Who we share it with

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only as follows:

• Service providers who process it for us under contract (the table below).
• Other users and the public, as described in Section 4, and the people you message, gift to or talk with.
• Blockchains and protocols: when you trade, your wallet address and the transaction go to the networks and protocols that carry it out (for example Relay, Jupiter, Uniswap, OpenSea, Hyperliquid, Morpho).
• Legal and safety: to comply with law, legal process or a valid government request, to enforce our Terms, or to protect anyone's rights, safety or property.
• Business transfers: in a merger, acquisition or sale of assets, subject to this policy.

6. Automated systems and AI

We use automated systems, some based on machine learning, to rank trending tokens, flag risky tokens (such as “Rug Risk” and honeypot checks), judge whether public posts are promotional or spam, sort message requests, and detect abuse of rewards and the waitlist. They work on market data and public content. We do not send your private messages or account details to third-party AI models. None of these systems makes a decision about you that has legal or similarly significant effects without a person able to review it; if you think one has affected you unfairly, contact us and a person will look at it.

7. Cookies and local storage

We use a small number of cookies and browser storage items. We do not use advertising or cross-site tracking cookies.

We honour Global Privacy Control signals. Because we do not sell or share personal data, there is nothing for GPC to opt you out of today; if that changes, a GPC signal will be treated as an opt-out.

8. International transfers

We and our providers operate mainly in the United States. If you use the Service from elsewhere, your data is transferred to and processed in the United States and other countries whose laws may differ from yours. Where the law requires, we use safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-US Data Privacy Framework.

9. How long we keep it

We may keep data longer if the law requires it, or to resolve a dispute or enforce our Terms.

10. Security

We protect data with access controls, encryption in transit, and by keeping private keys out of our hands (Privy secures your wallet keys). No system is perfectly secure. If we learn of a breach that affects you, we will tell you and the authorities as the law requires.

11. Your choices and rights

Everyone can:

• change their profile and privacy settings in Settings;
• turn off product news emails (every email has an unsubscribe link) and push notifications;
• export their wallet's private key;
• ask for a copy of their data, a correction, or deletion of their account, at privacy@nfa.fun.

UK, EEA and Switzerland

You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time. You can complain to your data protection authority (in the UK, the ICO).

California and other US states

If you live in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon or another state with a privacy law, you may have the right to know what we collect and how we use it, to get a copy, to correct it, to delete it, and to opt out of the sale or sharing of personal data or its use for targeted advertising or significant profiling. We do not sell or share personal data, and we do not use sensitive personal data to infer things about you. We will not treat you differently for using your rights. The categories we collect are listed in Section 2 (identifiers, account and contact details, commercial and transaction information, internet activity, approximate location, audio while in voice rooms, and content), the purposes in Section 3, the recipients in Section 5 and the retention in Section 9.

To use a right, email privacy@nfa.fun from the address on your account or from the app. We will verify the request, may ask an authorised agent for proof, and will answer within 45 days (or the time your law sets). If we refuse, you can appeal by replying to our answer; if the appeal is refused, you can contact your state attorney general.

12. Deleting your account

You can ask us to delete your account by emailing support@nfa.fun (an in-app option in Settings is coming). Before you do, move your assets out or export your private key: once the account is gone you will no longer be able to reach your wallet through nfa.

Deleting your account removes your profile, handle, settings, content and messages from the Service, and we delete the related personal data within 30 days, except records we must keep (Section 9). Your wallet and its history remain on the blockchain. Other people keep copies of messages you sent them in their own conversations unless you deleted them first.

13. Children

The Service is only for people 18 and over. We do not knowingly collect data from anyone under 18. If we learn that we have, we will close the account and delete the data. If you believe a child is using nfa, tell us at privacy@nfa.fun.

14. Changes to this policy

We will update this policy as the Service changes. The “Last updated” date shows the current version. If we make a material change, we will tell you in the app (and by email where we can) before it takes effect.

15. Contact

[NFA legal entity name], [registered address].
Privacy: privacy@nfa.fun · Support: support@nfa.fun