Privacy Policy
What Bloxwap collects, how we use and protect it, and how to manage or delete your data.
Last updated: October 31, 2026
This policy covers Bloxwap, including our websites at bloxwap.com and bloxwap.app, our web, iOS, and Android apps, and our related account, support, and waitlist services (the Services). It explains how we access, collect, use, store, share, and delete personal information, including information received through Sign in with Google.
Effective: October 16, 2026
1. Who we are
Bloxwap, Inc. ("Bloxwap", "we", "us", or "our") is responsible for the personal information we process to provide the Services. For purposes of applicable data-protection laws, Bloxwap, Inc. is the data controller for wallet addresses, Privy login emails, IP addresses, PostHog events, and other personal information described here. PostHog acts as our analytics processor. Contact support@bloxwap.com with privacy questions or requests.
Bloxwap, Inc. is a Delaware corporation. Office address: 2261 Market Street STE 73647, San Francisco, CA 94114, United States. Privacy representative, if required: [EU/UK representative and contact — counsel to confirm].
2. Information we collect
Account and profile information
When you create or use an account through Privy, our authentication and embedded-wallet provider, we process your account identifier, linked wallet addresses, sign-in method, and the email address or profile information supplied by that method. Supported sign-in methods include email, Google, Apple, and X. We also store the username and avatar you choose for your Bloxwap profile.
Google user data
Google sign-in is optional. It lets you create or return to your Bloxwap account without a separate Bloxwap password. The following rules apply specifically to data received from Google and take precedence over the general use and sharing provisions in this policy.
Data we access
Sign-in is handled through Privy using Google's basic identity
permissions: openid, email, and profile. Depending on the
information Google makes available, this provides:
| Information | Purpose |
|---|---|
| Google account identifier | Recognize your linked Google account and return you to the correct Bloxwap account. |
| Email address | Identify your sign-in account and respond to account or support requests. |
| Name, when supplied | Maintain the basic profile associated with your linked sign-in account. |
Privy also records when the linked account was verified. We do not receive your Google password. We do not request access to Gmail, Drive, Calendar, Contacts, or other Google Workspace content.
How we use it
We use Google user data to authenticate you, link your sign-in to your Bloxwap account and embedded wallets, display your account, provide support you request, and protect your account against abuse. Google sign-in does not subscribe you to a marketing list.
We do not sell Google user data, give it to data brokers, use it for advertising or retargeting, use it to determine creditworthiness or for lending, or use it to train generalized AI or machine-learning models. We do not send your Google sign-in profile to analytics or advertising providers (including PostHog), or publish it on a blockchain.
Storage and protection
Privy maintains the linked Google profile as part of your Bloxwap account. The app processes account information to establish your session and display your profile; session and preference data may also be stored on your device. Bloxwap's authenticated services run on Cloudflare and process the account information needed to service your requests.
We use HTTPS/TLS for network connections, verify authentication tokens for protected account operations, and keep server credentials out of the public app. Access to account information is restricted to providing these services, authorized support, security investigations, and legal obligations. See Security for further details.
Sharing and human access
We share Google user data with Privy for authentication and account services and with hosting infrastructure such as Cloudflare as needed to provide those features. We may disclose it when necessary for security or to comply with applicable law. A transfer connected with a merger, acquisition, or sale of assets requires your explicit prior consent for Google user data.
Human access is limited to support you request or authorize, investigating security issues or abuse, and meeting legal obligations. The general provider list below does not authorize sending your Google profile to trading, bridging, advertising, or waitlist providers.
Limited Use. Bloxwap's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Retention, revocation, and deletion
We retain your linked Google profile while it is needed for your Bloxwap account. On successful account deletion, we delete the Privy sign-in user record, including its linked Google profile. Limited security, legal, or accounting records may remain as described in Retention; deleting an account does not promise immediate erasure of every provider backup or archived wallet record.
You can remove Bloxwap's Google authorization in your Google Account connections. Revocation prevents further access under that authorization; it does not automatically delete your Bloxwap account or information already received. Use Profile → Advanced → Delete account, or email support@bloxwap.com to request deletion. See Your rights and account deletion for the steps and wallet safeguards.
Wallet and transaction information
We process connected and embedded wallet addresses, balances, positions, orders, fills, transfers, and network information to display your account and carry out the actions you request. Some of this information is public on Hyperliquid or other blockchains. Wallet addresses can identify you when linked with other information.
Transactions are authorized through your connected wallet, embedded wallet, or approved trading agent. Our services may receive and relay signed actions and transaction payloads to the relevant provider or network. Embedded-wallet creation, signing, and recovery use Privy's wallet infrastructure. Never send us a private key, seed phrase, or Google password in a support message.
Information you submit
- Waitlist: your name, email address, and chosen platform, to confirm your registration and send the launch updates you requested.
- Support: contact details, messages, and attachments you send us, to investigate and answer your request.
- Rewards: wallet and reward records, eligibility declarations, and, if required to verify a prize claim, government-issued ID, proof of address, eligibility declarations, wallet-control evidence, and tax information described in the applicable promotion rules. Additional verification is requested separately from Google sign-in.
- Notifications: if enabled, push subscription or device tokens, associated wallet addresses, and alert preferences, to deliver the notifications you choose.
Device, usage, and security information
Our infrastructure receives request information such as IP address, browser or device details, referrer, and access times. We use it to serve the Services, diagnose failures, prevent abuse, and enforce the jurisdiction restrictions in our Terms of Use. PostHog also processes page views, interaction events, and device information on our websites and in our apps to report usage and provide feature configuration. Trading event payloads are designed to exclude wallet addresses, trade amounts, and sizes. This does not mean every website request or page URL is anonymous.
Turning off optional app analytics stops that usage reporting. The app still contacts our servers and providers for sign-in, wallet operations, feature configuration, and other service functions. Privy also processes authentication and operational telemetry when providing sign-in and wallets.
3. How we use your information
We use personal information to operate your account, display markets and balances, carry out requested trades and transfers, deliver chosen alerts, administer rewards, respond to support, improve the Services, prevent abuse, and meet legal obligations. We send waitlist updates when you register for them. We do not sell personal information. The narrower rules in Google user data govern all information received from Google sign-in.
4. Purposes and legal bases
Where the GDPR or UK GDPR applies, the following bases apply to the information we process. Required account and transaction information is needed to provide the feature you request; without it we may be unable to provide that feature.
| Purpose | Information | Legal basis |
|---|---|---|
| Sign-in, wallet display, requested orders and transfers | Account identifiers, linked email, wallet addresses, transaction data | Contract |
| Service security, fraud prevention, eligibility and abuse checks | IP, device and request logs, wallet activity | Legitimate interests in securing accounts, preventing fraud and reward abuse; legal obligations where applicable |
| Requested support and alerts | Contact details, messages, push tokens and preferences | Contract; legitimate interests in resolving problems |
| Optional analytics and launch communications | PostHog events, device information, waitlist contact details | Consent where required; otherwise legitimate interests in understanding and improving the Services |
| Reward verification, payments and required reporting | Wallet control, ID, address, eligibility and tax records | Contract; applicable legal obligations |
We use IP-based access checks and may use automated activity checks to flag reward abuse or eligibility concerns. Contact support@bloxwap.com to challenge a restriction or request human review.
5. Sharing and disclosure
Providers receive information relevant to the feature you use:
| Provider or recipient | Information and purpose |
|---|---|
| Privy | Account, linked sign-in profile, wallet, and session information for authentication and embedded wallets. |
| Cloudflare | Requests, account operations, stored application records, and security logs for hosting and protection. |
| Hyperliquid, blockchain networks, RPC providers such as Helius, and transfer providers such as Relay, Daimo, and Blink | Wallet addresses, balance queries, and transaction details for trading, transfers, and account display. Blockchain activity may be public. |
| Papertrade, when you use Papertrade markets | Your wallet address, session-key address, and signed trading, withdrawal, and session-key requests, which our servers forward to Papertrade's relayer without your IP address or cookies. Your browser also connects to Papertrade directly for live balance and position updates, so Papertrade receives your IP address and wallet address there. HyperEVM activity is public. |
| WalletConnect and your chosen wallet provider | Connection and transaction requests when you connect an external wallet. |
| PostHog (our analytics processor) | Website and app usage and device information for usage measurement and feature configuration; not your Google sign-in profile. |
| Waitlist (getwaitlist.com) | Registration information when you join the launch waitlist. |
| Google, Apple, and X | Identity information for the sign-in method you choose, through Privy and under that provider’s notice. |
| Identity and sanctions verification providers, if used for a prize | Wallet-control evidence, government ID, address, eligibility and tax information needed for the checks. The provider and any additional collection are identified when requested. |
| Cash App, when you choose it as a Bitcoin source | Your send instruction is handled under Cash App’s terms; the destination route receives the transfer data needed to route funds. |
| Push delivery providers | Device or subscription tokens and notification content when you enable alerts. |
We may also disclose relevant information to meet legal obligations, investigate abuse, or administer a reward verification or payment you request. If a separate identity-verification provider is needed, its collection process will identify the provider and applicable notice. We may transfer business records in a merger or acquisition, subject to applicable law and the specific Google-data restrictions above.
Public information
Blockchain transactions, wallet addresses, and trading history are public and outside our control. We cannot erase or restrict public blockchain data, including after account deletion. Other people can copy it or link it to your identity.
Public leaderboards show trading addresses, rankings, points, and Genesis status. The docs leaderboard uses truncated addresses and address-derived avatars. Other app views may display chosen usernames, avatars, or badges. Do not choose a profile name or image you want to keep private.
6. International transfers
Our providers may process information outside your country. Where applicable law requires safeguards for international transfers, we use an appropriate transfer mechanism.
[Countries of processing, applicable contractual safeguards or adequacy mechanism, and how to obtain a copy — counsel to confirm.] Contact us for information about the safeguards relevant to your data.
7. Retention
Account and linked sign-in profiles remain while your account is active, until successful deletion, subject to required legal or security retention. Successful deletion removes the Privy sign-in record and linked Google profile.
| Records | Retention |
|---|---|
| Account records remaining after deletion | [period and legal/security exceptions — counsel to confirm] |
| PostHog analytics events | [configured event retention — engineering and counsel to confirm] |
| IP, security and operational logs | [period by log system — engineering and counsel to confirm] |
| Waitlist registrations | Until you unsubscribe or the launch purpose ends; [cleanup and backup periods — confirm] |
| Support messages and attachments | [period after request closes — counsel to confirm] |
| Relay withdrawal status records | Cached intent records expire 90 days after the most recent write; this does not set retention for transaction history, logs, or legal records. |
| Expo push receipt tracking records | Pending receipt records have a 24-hour cache expiry; this does not set retention for subscriptions or provider delivery logs. |
| Reward, transaction, KYC, sanctions and tax records | [period after payout or verification, and applicable recordkeeping requirements — counsel to confirm] |
| Provider backups and archived embedded wallets | [provider-specific retention and deletion schedule — confirm with Privy and other providers] |
When a retention purpose ends, we delete or de-identify the information, subject to applicable recordkeeping requirements. Public blockchain records are outside our control and cannot be erased by Bloxwap.
8. Your rights and account deletion
Depending on your location, you may have rights to access, correct, delete, or receive a copy of your data; object to or restrict its processing; withdraw consent; and complain to a data-protection authority. Email support@bloxwap.com to make a request. We may need to verify that the request concerns your account. You can request help even if you cannot sign in.
To delete your account in the web, iOS, or Android app:
- Open Profile → Advanced → Delete account.
- Review the wallet and balance checks. Close open positions, orders, and TWAPs, and finish pending withdrawals. Move your funds out before deleting. If only funds remain and you have exported your keys, the app provides a separate acknowledgement before allowing deletion; it does not bypass unresolved activity or failed checks.
- Confirm deletion. On success, we remove the Privy sign-in user record, linked sign-in profile, username and avatar stored with that record, and the account's registered push subscriptions.
Deletion also covers analytics where our analytics deletion service is available. Before your account is removed, we record that it is being deleted: our servers stop sending analytics about it, remove your wallet addresses from the analytics records they hold, and request that PostHog delete the analytics profile linked to your account and its events. We repeat the request after deletion so that events still in transit are included. We keep your account identifier only as long as needed to complete that request; once PostHog confirms it, we keep only a one-way hash so nothing is sent for the account again. If the service is available but this step cannot be recorded, deletion stops so you can try again. PostHog completes deletions asynchronously, so removal is not immediate. If the service was unavailable when you deleted your account, or you want us to confirm your analytics were deleted, contact support@bloxwap.com. Analytics that was never linked to your account, such as from a browser where you allowed analytics but never signed in, cannot be found for deletion.
Deletion ends your access to embedded wallets through that account. Privy may keep an archived copy of your embedded wallet after deletion. We cannot promise destruction of all wallet records or key material, or that you can recover the wallet. Do not rely on later recovery; securely export your keys or move your funds first. A subsequent sign-in can create a new account rather than restore the deleted one.
Reward and required accounting records may remain, and public blockchain history cannot be deleted. See the account deletion guide for more information. You can separately revoke Google authorization through Google Account connections.
9. Analytics, cookies, and device storage
We use PostHog only for analytics. PostHog receives page views, selected product interactions, and device and request information. Web automatic interaction capture is disabled; page views are sent explicitly. We do not send Google sign-in profiles to PostHog.
Your choice comes first. On bloxwap.com, bloxwap.app, and bloxwap.pro, PostHog does not load and nothing is sent to it until you choose Allow analytics. Each site asks separately and remembers your choice in that browser. In the iOS and Android apps, nothing is sent to PostHog, including the requests that load feature configuration, until you turn on analytics when the app asks or in Settings. If you decline or never answer, our websites work the same. In the apps, some features that depend on remote configuration, including live trading, may be unavailable until you allow analytics. Events from before you allow analytics are not queued and sent later. Once you sign in, analytics from that browser or device is linked to your account.
Turning analytics off. You can change your choice at any time through Analytics preferences on our websites or in the app's Settings. Turning analytics off stops collection on that browser or device and discards events waiting to be sent instead of sending them. It does not delete analytics already sent; to remove those, delete your account (see Your rights and account deletion) or contact us.
Verified outcomes from our servers. When you are signed in and have allowed analytics, our servers may also send PostHog a few verified outcomes for your account: completed or failed deposits, filled trades, and your first filled live trade. These carry the provider or venue, network, timing, and a value range instead of an exact amount, never wallet addresses, deposit addresses, or provider transaction identifiers. Signed-in apps report your analytics choice to our servers, and the most recent choice from any of your devices applies: turning analytics off on one device stops these outcomes until you allow analytics again. Without a recorded choice, nothing is sent. Outcomes from before you allowed analytics, and outcomes still queued when you turn it off, are not sent.
Session recordings and feedback, when enabled. These are off unless we enable them, and only run where you have allowed analytics. On bloxwap.app and bloxwap.pro, we may record a small sample of sessions on selected trading, referral, and leaderboard pages to find where screens fail. Recordings replace all text and form inputs, block sign-in, wallet, balance, deposit, and checkout screens, and exclude console logs and network requests. Recording stops when you turn analytics off or leave those pages. Signing out ends the current recording, so no recording spans two people; while analytics remains allowed, the new signed-out session may be sampled again. Recordings already uploaded are kept for the PostHog retention period in Retention. We may also ask a one-tap question about what got in the way after a sign-in, wallet setup, or deposit step fails or is abandoned; answering is optional and there is no free-text field. Neither feature is offered in the mobile apps or on bloxwap.com.
We use cookies or device storage for sessions, wallet connections, security, preferences, and analytics identifiers. You can manage storage in your browser and optional app reporting through the app's analytics preference. Blocking required storage may prevent sign-in or other features. Device settings control push notifications.
We obtain consent for non-essential tracking where required by law. Withdrawing consent does not prevent requests needed to operate the Services.
California privacy rights (CCPA/CPRA)
The trading Services are unavailable in the United States. California residents may nevertheless visit our websites or join our waitlist. Where the CCPA/CPRA applies, this section describes their rights.
We collect identifiers (account IDs, email, wallet addresses and IP addresses), internet or device activity (page views, events and request logs), commercial information (trades, transfers and reward records), approximate location inferred from IP, and information you submit (support messages, profiles and waitlist details). Prize verification may include sensitive information such as government ID, identity and tax records. Sources are you, your chosen sign-in and wallet providers, our service infrastructure, and public blockchain records.
We use and disclose these categories for the purposes and to the recipients listed in Sections 4 and 5. Section 7 describes retention. We do not sell personal information or share it for cross-context behavioral advertising. We use sensitive information only to provide requested services, verify eligibility, prevent fraud, or meet legal obligations.
You may request to know and access the categories and specific information we hold, correct inaccurate information, or delete it, subject to legal exceptions. You may opt out of sale or sharing and request limits on use or disclosure of sensitive information where applicable. Our current practices do not include sale, sharing for cross-context behavioral advertising, or uses of sensitive information that require a limit option.
Email support@bloxwap.com to exercise a right or ask about it. We verify requests using information appropriate to the account or record involved; never send private keys or passwords. You may use an authorized agent. We may request proof of their authorization and verify your identity directly, subject to applicable law. We will not discriminate against you for exercising privacy rights.
We honor applicable opt-out preference signals where required. [Request response periods, applicable thresholds, and preference-signal implementation — counsel and engineering to confirm.]
10. Children
The Services are intended for adults aged 18 or older. We do not knowingly collect children's personal information. Contact us if you believe a child has provided information so we can investigate and delete it as required by applicable law.
11. Security
We use encrypted network connections, authenticated account endpoints, server-side credential storage, and access controls to protect personal information, including Google user data. Our providers also apply safeguards to the systems they operate. No system guarantees absolute security. Protect your devices, sign-in accounts, and wallet credentials, and contact us if you suspect unauthorized access.
12. Changes to this policy
We may change this policy without prior notice. Changes take effect when posted, and continued use after posting means acceptance of the updated policy, matching the Terms of Use.
We will obtain consent before a new use of personal information where the law requires consent. Before accessing additional Google user data or using existing Google user data for a new purpose, we will explain the change and obtain your consent. Continued use alone is not consent to those new Google-data uses and does not waive your privacy rights.
13. Contact
For privacy questions, access or deletion requests, and complaints, email support@bloxwap.com.