Runner Terminal — Privacy Policy
This policy says what the Interface collects, why, who else sees it, how long it is kept, and what you can do about it. It is written to be read, not skimmed; it is short because the Interface collects little.
1 · The short version
- We do not ask for your name, address, ID or payment card. There is no KYC.
- You sign in through Privy. Privy holds your login identifier (an email address, phone number or social login, whichever you chose) and the infrastructure for your wallet. We hold a Privy user id and your wallet addresses.
- Everything you trade is on a public blockchain. Your wallet addresses and every transaction they sign are visible to anyone, forever, regardless of this policy.
- We keep the records the Interface needs to work: your trades, positions, exit rules, season results, votes, withdrawals, support tickets, the push token for your phone, and the technical logs any server keeps.
- We do not sell data. We do not run advertising. The app uses Google Firebase Analytics (which screens you open, when you send or exit a trade — tied to a hashed id, never your login or wallet) and Firebase Crashlytics (crash reports). Neither collects your advertising ID; we have switched that off. There is no other tracking SDK.
- You can close your rat from Settings. We stop using your data for anything new; what is on chain stays on chain.
2 · What we collect, and why
| Data | Where it comes from | Why we hold it |
|---|---|---|
| Privy user id and the login method you chose (email, phone, or a social account — the identifier itself is held by Privy, we see what Privy returns) | sign-in | to know which rat is yours |
| Wallet addresses (Solana, and the Robinhood chain if you use it) | Privy creates them; you may add external ones for withdrawals | to show your balance, route your trades, and send withdrawals where you say |
| Session-signer authorisation (that it exists, when granted, when revoked) | you grant it at onboarding | to execute the buys you request and the exits your rules trigger; the key material is Privy's, not ours |
| Trades, positions, fills, exit rules, outcomes, fees paid | your use of the Interface; mirrored from the chain | the core function; your logbook, haul and race screens; season scoring |
| Rat profile: handle, streak, season results, votes, badges | your use | leaderboards and the social features you opt into by using them |
| Saved withdrawal addresses | you enter them | so you do not retype them |
| Support tickets and anything you write in them | you | to answer you |
| Push token for your device, platform and app version | the app registers it after sign-in | to send the notifications you enabled (new runners, fills, exits); a token the push service reports dead is deleted |
| Device and app state needed for the wake feature: whether notifications and full-screen permissions are on | read from your phone's settings, on the phone | to show the "let the rat wake you" sheet; this stays on the phone and is not sent to us |
| Technical logs: IP address, request timestamps, API paths, errors, app version | every server keeps these | security, abuse prevention, rate limiting, debugging |
| Invite and referral codes | you enter or share them | access control during the closed test; referral credit |
We do not collect: contacts, location, photos, biometrics, precise device identifiers beyond the push token, or anything from other apps. Biometric unlock, where you use it, is handled entirely by your phone.
3 · What is public by design
A blockchain is a public ledger. Your wallet address, every token it has held, every swap it has signed, and the fees it paid are public, permanent, and visible to anyone with a block explorer — including the swaps the Interface routed for you. The Interface links your rat handle to your results on leaderboards and public rat pages; it does not publish your wallet address next to your handle, but anyone who already knows your address can see your history on chain. Choose a handle with that in mind.
4 · Who else sees your data
| Service | What they get | Why |
|---|---|---|
| Privy (privy.io) | your login identifier, authentication events, wallet key infrastructure | sign-in and non-custodial wallets; their privacy policy applies to what they hold |
| Google Firebase Cloud Messaging | your push token and the content of each notification we send | delivery of push notifications |
| Google Firebase Analytics and Crashlytics | app usage events (screen opened, trade sent, exit seen) under a hashed user id, app version, device model and OS version, and crash reports | product analytics and crash diagnosis; no advertising ID |
| Blockchain RPC providers (e.g. Helius for Solana) | the transactions we submit and the addresses we query | reading the chain and submitting your transactions |
| Decentralised exchanges, liquidity pools, bridges | the on-chain transaction itself | settlement; they are public protocols, not parties we contract with on your behalf |
| Our hosting providers | the servers and databases that run the Interface | running it |
We share data with no one else, except where the law compels it (a lawful order we are required to obey) or to protect the Interface and its users from fraud, attack or abuse.
5 · How long we keep it
| Data | Retained |
|---|---|
| Trade, position, fill and season records | for as long as your rat exists, then [RETENTION — e.g. 12 months] after closure, then deleted or irreversibly anonymised for aggregate statistics |
| Support tickets | [RETENTION — e.g. 24 months] from the last message |
| Push tokens | until the push service reports the token dead, you sign out of the device, or you close your rat |
| Technical logs | [RETENTION — e.g. 90 days] rolling |
| Wallet addresses and the Privy user id | for the life of the rat; after closure, retained only as needed to honour the retention above |
On-chain data is not ours to delete and will outlive every row above.
6 · Closing your rat, and your rights
You can close your rat from Settings → Account. You must withdraw your funds first; closing never moves or forfeits them. Closing revokes the session signer, disables sign-in, removes you from leaderboards and public rat pages, and starts the retention clocks in §5.
Wherever you are, you can ask us to: tell you what we hold about you; correct it; delete it (subject to §5 and the chain); or stop a particular use. Ask through Settings → Support or support@buttertrade.online. We will answer within 30 days. If you are in a jurisdiction that gives you additional rights (for example the EU/UK GDPR), you have them, including the right to complain to your local data authority.
7 · Security
Signing keys are Privy's responsibility and are never held by us in a form we could use alone. Our servers use encrypted transport, restricted database roles, and per-user row isolation for your trading records. No system is perfectly secure; if we learn of a breach affecting your data we will tell you in the app and by the login method on file as quickly as we reasonably can.
8 · Children
The Interface is for adults. We do not knowingly collect data from anyone under 18; if we learn we have, we will delete it and close the rat.
9 · Things we will tell you before they change
This policy will be updated before any of the following happens, and the in-app policy page will show the change: adding any analytics or crash-reporting SDK beyond the two named in §4; collecting your advertising ID or location; introducing identity verification; sharing data with a new category of recipient; or using data to profile users for anything other than the features described above. As of the effective date, none of these is in place.
10 · Changes and contact
The current policy is always in the app under Settings and at the Interface's website. Questions: Settings → Support, or support@buttertrade.online.