Privacy Policy

• Wallet and on-chain data — your wallet address on the Polygon network; your on-chain activity relevant to the Service (deposits, trades, payouts, referral payments), which is recorded on a public blockchain we do not control; and an account identifier from Privy that links your login to your wallet.
• Optional profile data — if you add them: an email address, a handle, an avatar image, and a referral code. None are required to sign in.
• Device and diagnostic data — IP address, device and browser type, approximate location (from your IP, to apply geographic restrictions), the features you use, timestamps, and diagnostic, crash, and interaction data used to debug and secure the Service.
• Cookies and similar technologies — see Section 7.

We do not intentionally collect government IDs or sensitive personal data. If we ever add identity verification (KYC), we will update this Policy and tell you what we collect, and why, first.

• Provide the Service — authenticate you, show live prices, quote and settle trades on-chain, and pay referral earnings;
• Keep it safe — detect and prevent fraud, manipulation, and security incidents, and enforce our Terms;
• Apply geographic and eligibility restrictions and comply with law, including sanctions screening and any future KYC or reporting obligations;
• Operate, debug, and improve the Service; and
• Communicate with you about the Service, including support.

Where the GDPR or similar law applies, we rely on: performance of our contract with you, our legitimate interests (security, anti-fraud, and improving the Service), compliance with legal obligations, and your consent where we ask for it.

We use automated checks to apply geographic and eligibility restrictions, screen against sanctions lists, and detect fraud, abuse, and security risks. These checks can lead to decisions that affect you — for example, refusing or restricting your access to the Service, or delaying or withholding a trade, settlement, or payout. Where the law gives you the right, you can ask us to have a person review such a decision — contact us at support@runtil.com.

We do not sell your personal data. We share it only:

• with service providers who help us run the Service — including wallet and authentication, blockchain infrastructure, hosting, storage, and error monitoring — under contracts that limit their use of your data;
• with a third-party payment provider if you buy USDC with a card or pay wallet — it runs its own identity and KYC checks under its own privacy policy, and we do not process your card;
• on the blockchain, which is public by design — we cannot make on-chain data private;
• for legal and safety reasons, when we reasonably believe it is required by law or necessary to protect the Service, our rights, or people’s safety; and
• with a successor in a merger, acquisition, or sale of assets, subject to this Policy.

We keep personal data only as long as we need it for the purposes in this Policy, or as long as the law requires, then delete or anonymize it. On-chain data is permanent and outside our control.

We and our providers may process your data in countries other than yours, using appropriate safeguards where required.

We use cookies and local storage to keep you signed in, remember your preferences, keep the Service secure, and improve it. Some are necessary; others you can control in your browser, and where required we will ask for your consent. This is our cookie notice — there is no separate one.

Depending on where you live, you may have rights to access, correct, delete, or port your data, and to object to or restrict certain processing or withdraw consent. We do not sell your personal data or share it for cross-context behavioral advertising.

To exercise a right, email support@runtil.com. We may first verify your identity, usually by confirming control of your wallet. Note that we cannot alter or erase on-chain records and may not be able to identify you from a wallet address alone. You may also complain to your local data-protection authority.

We use reasonable technical and organizational measures to protect the data we hold, but no system is perfectly secure. Because Runtil is non-custodial, securing your own wallet, recovery method, and devices is the most important protection — see the Terms.

The Service is not for anyone under the age required by our Terms, and in no case under 13 (or the higher minimum age in your jurisdiction). We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

We may update this Policy. We will change the “Last updated” date and, for material changes, give notice through the Service or another reasonable method. Continued use after a change takes effect means you accept it.

Privacy questions or requests: support@runtil.com.

Runtil