Privacy Policy

1. 1. Who we are
2. 2. On thissofire.com
3. 3. In the ThisSoFire app
4. 4. The public blockchain
5. 5. How we use information
6. 6. Legal bases
7. 7. Who we share it with
8. 8. International transfers
9. 9. How long we keep it
10. 10. Your rights
11. 11. Security
12. 12. Children
13. 13. Changes to this policy
14. 14. Contact

1. Who we are

thissofire.com and the ThisSoFire app (the Services) are operated by Nanolabs sp. z o.o. sp.k. (Nanolabs spółka z ograniczoną odpowiedzialnością spółka komandytowa), a limited partnership with its registered office at ul. Prezydenta Gabriela Narutowicza 40/1, 90-135 Łódź, Poland. It is entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000716046, kept by the District Court for Łódź-Śródmieście in Łódź, XX Commercial Division of the National Court Register. NIP (tax ID) 7831771347, REGON 369346770.

We are responsible for the personal information described in this policy, as its "controller" under the EU General Data Protection Regulation (GDPR). You can reach us at support@thissofire.com.

This policy works together with our Terms of Service.

2. On thissofire.com

The message wall

You can type a short message on the screen for other visitors to see. When you send one, we store:

• the text of the message and the time you sent it;
• an anonymous handle (such as @ember_4f2), made from a random ID that your browser creates and keeps; and
• a salted, one-way hash of your IP address. We never store the address itself. We use the hash only to enforce rate limits and block abuse.

Messages are public. They are deleted within 7 days of being sent.

Your browser's storage

The site keeps two things in your browser's local storage: the random ID behind your handle, and whether you muted the sound. They stay on your device, and you can clear them in your browser settings. The site sets no cookies and runs no advertising scripts.

Analytics

We measure how the site is used with Umami, an analytics tool that runs on our own server. For each visit, Umami records the pages you view, the actions you take (such as slapping a sticker, sending a message or following a link), the site that sent you, your browser, operating system, device type, screen size and language, and your approximate location (country, region and city), which it works out from your IP address. Umami stores no IP address and sets no cookies. It tells visits apart by a one-way hash of your IP address and browser details, and that hash changes every month. On the website, these records are anonymous.

Hosting and fonts

The site is hosted by Cloudflare, which processes your IP address and basic request details (such as your browser type) to deliver the site and protect it from attacks. Our fonts load from Google Fonts, so your browser also sends your IP address to Google when a page loads.

3. In the ThisSoFire app

Information you give us

• Sign-in. You sign in with Apple, Google, email or a passkey through our wallet provider, Privy. We receive a Privy user ID, and, depending on the method you choose, your email address or the identifier of your Apple or Google account.
• Settings and choices, such as your trading mode, preset amounts and slippage settings.
• Content you create, such as PnL cards (the template, background and text you pick, and the figures shown on the card). A card you share is public: anyone with its link can see it, and sites such as X and Telegram fetch it to show a link preview.
• Messages you send us, for example when you contact support.

Information created as you use the app

• Wallet. Your wallet's public address. Privy's infrastructure protects the private key. We never see or store it.
• Activity. Your trades, orders (limit, take-profit and stop-loss), deposits, withdrawals, positions and PnL, including amounts, tokens, prices, fees and transaction signatures.
• Funding orders. For each purchase through MoonPay: the amount, currency, asset, payment method type (Apple Pay, Google Pay or card), fees, status and MoonPay's order ID.
• Referrals and rewards. Your referral code, who referred you, who you referred, and the rewards you earned and claimed.
• Automated-order permission. Whether you granted or revoked the limited signing permission that runs your automated orders.
• Technical data. IP address, device and browser type, and server logs, which we use for security, fraud prevention and debugging.

The app keeps your sign-in session, any referral code you arrived with, and your mode and trade settings in your browser's storage. It runs no advertising scripts.

Analytics

We measure how the app is used with the same Umami analytics as the website: the screens you view, the actions you take, your browser, device type and approximate location. When you are signed in, we link these records to your account by your username, or by your user ID if you have no username. This shows us how each account uses the app.

Information MoonPay collects

When you buy crypto with Apple Pay, Google Pay or a card, you deal directly with MoonPay. MoonPay collects your identity details, ID documents, card details and other payment information, under MoonPay's privacy policy. We don't receive your card details or identity documents. MoonPay sends us the status of your purchase and the details listed under "Funding orders" above.

4. The public blockchain

Solana is a public blockchain. Your wallet address, balances and every transaction you make are visible to anyone, forever. That is how the network works, not something we control. We can't delete or change information on the blockchain.

The app shows public wallet pages (holdings, PnL and recent trades) for any wallet address, including yours. They show only information that is already public on-chain.

5. How we use information

• To provide the Services: create your wallet, show your balances and positions, build and send your transactions, run your automated orders, and credit your purchases.
• To calculate fees, referral rewards and payouts.
• To keep the Services and our users safe: detect and prevent fraud, abuse, spam, attacks and breaches of our terms, and moderate the message wall.
• To meet legal obligations, such as sanctions screening, record keeping and responding to lawful requests.
• To support you and to send you messages about the Services (for example, security notices or changes to our terms).
• To understand and improve the Services, using aggregated or de-identified data where we can.

We don't sell your personal information, and we don't share it for targeted advertising. We don't use it to make automated decisions that have legal or similarly significant effects on you.

6. Legal bases

Under the GDPR, we rely on these legal bases:

• Contract: to provide the Services you asked for (your account, wallet, trades, orders and rewards).
• Legitimate interests: to keep the Services secure, prevent fraud and abuse, moderate content and improve the Services. We balance these interests against your rights.
• Legal obligation: to meet our legal, tax and regulatory duties.
• Consent: where we ask for it. You can withdraw consent at any time.

7. Who we share it with

We share information only as needed to run the Services:

• Privy: sign-in and wallet infrastructure.
• MoonPay: buying crypto with fiat. We pass your wallet address, a customer reference, your IP address (for MoonPay's fraud checks) and the purchase you set up.
• Blockchain and market-data providers: Solana RPC and transaction-sending providers (such as Helius and Jito), swap services (such as Jupiter) and market data (Birdeye). These receive wallet addresses and transaction data to quote, send and confirm your trades.
• Hosting and infrastructure: Cloudflare and our cloud hosting and database providers.
• Google Fonts: the fonts on our website and app pages load from Google, which receives your IP address.
• Authorities, when the law requires it, or when we believe it's needed to protect the rights, property or safety of our users, the public or us.
• A buyer or successor, if we are involved in a merger, acquisition or sale of assets. This policy would continue to protect your information.

Our service providers may use your information only to provide their services to us, except where they act independently (as MoonPay does for its own KYC and payments), in which case their own privacy policy applies.

8. International transfers

We are based in Poland, in the European Union. Some of our providers (such as Privy, MoonPay, Cloudflare and Google) process information in the United States or in other countries outside the European Economic Area. When your information leaves the EEA, we protect the transfer with a safeguard the GDPR recognises: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, where the provider is certified under it) or the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards.

9. How long we keep it

• Message wall: messages and IP hashes are deleted within 7 days.
• Account and activity data: kept while your account is open. After you close your account, we keep transaction, funding and reward records for as long as the law requires or allows for tax, accounting, fraud prevention and legal claims (usually up to 5 years), then delete or anonymise them.
• Server logs: kept for a short time for security and debugging, usually no more than 90 days.

Information on the blockchain can't be deleted by anyone.

10. Your rights

Under the GDPR, you have the right to:

• access the personal information we hold about you and get a copy of it;
• correct information that is inaccurate;
• have your information deleted;
• object to or restrict how we use it;
• receive it in a portable format; and
• withdraw consent where we rely on it.

To use any of these rights, email support@thissofire.com. We may need to confirm it's you, for example by asking you to write from the email you sign in with. We answer within one month. If a request is complex or we receive many, we may extend that by up to two more months, and we'll tell you why. We won't treat you differently for using your rights.

You can complain to our data-protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl), or to the authority in the country where you live or work.

California residents have the rights to know, delete and correct personal information, and to opt out of its sale or sharing. We don't sell or share personal information as the California Consumer Privacy Act defines those terms.

11. Security

We protect information with measures that include encryption in transit, access controls limited to the staff who need access, and hashing instead of storing raw data where we can (as we do with IP addresses on the message wall). Your wallet's private key is protected inside Privy's secure infrastructure and never reaches our servers. No system is perfectly secure, so please keep your sign-in methods and devices secure too.

12. Children

The Services are not for anyone under 18, and we don't knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy. We'll change the "Last updated" date above, and if a change is material, we'll tell you in the app or on this page before it takes effect.

14. Contact