Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how RUNNR Labs LLC, a Delaware limited liability company ("RUNNR," "we," "us," or "our"), collects, uses, and protects personal data when you visit our website at RUNNR.trade or use our trading terminal and social trading services (collectively, the "Services").

Your use of the Services is subject to this Privacy Policy and our Terms of Service. By accessing or using the Services, you acknowledge that you have read and understood how we collect, use, and disclose your personal data as described here.

2. Our Approach to Data Protection

We are committed to protecting your privacy and to handling personal data responsibly. Depending on where you are located, your data may be subject to additional protections under applicable law, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), other U.S. state privacy laws, and, where applicable, the EU/UK General Data Protection Regulation ("GDPR"). Section 8 below describes region-specific rights in more detail.

3. Personal Data We Collect

We collect personal data to provide and improve the Services, maintain security, and comply with legal obligations. We aim to collect only what is necessary for these purposes.

Data Provided via Privy.io

To use the Services, you create a non-custodial digital wallet and authenticate through our third-party partner, Privy.io. During this process, you may provide authentication information, such as an email address or social login identifier, directly to Privy. We do not collect or store this authentication information ourselves. Privy provides us with your public wallet address and a unique user identifier, which we use to associate you with your activity on the platform. We never receive, access, or store your private keys, passwords, or wallet recovery phrases.

Data We Collect Automatically

When you use the Services, we automatically collect technical information such as your IP address, browser type, operating system, and device identifiers, along with usage data such as features used, traders followed, and timestamps of activity. This supports security, platform performance, and analytics.

Data From Public Blockchains

Our Services interact with the Solana blockchain. Your public wallet address and associated transaction history are recorded on the blockchain and are inherently public. Our Services may retrieve and display this public data as part of the social trading experience.

Social Trading Data

If you use the Services' social features, your trading activity and performance metrics, linked to your chosen username, may be visible to other users who follow you. This sharing is fundamental to the social trading experience and occurs based on your use of the feature.

4. How We Use Your Data

We use personal data to: (i) provide, operate, and maintain the Services, including the trading terminal and social trading features; (ii) verify your identity and screen for prohibited use where required; (iii) maintain the security and integrity of the platform and prevent fraud; (iv) analyze and improve the Services; and (v) comply with our legal obligations.

5. How and Why We Share Your Data

We do not sell your personal data. We share data only in the following circumstances:

• Service providers. We engage third-party companies to perform specialized functions on our behalf, including Privy.io (non-custodial wallet infrastructure and authentication) and Cloudflare, Inc. (website security, performance, and content delivery). These providers are contractually limited in how they may use your data.

• Other users you're followed by. As described above, if you use the Services' social features, your trading activity and performance metrics are visible to users who follow you.

• Legal and regulatory disclosures. We may disclose personal data if required by law, regulation, legal process, or a valid request from a governmental authority.

• Business transfers. If we are involved in a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity, subject to the commitments in this Policy.

6. Data Security and Retention

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal data from unauthorized access, use, alteration, or destruction, including encryption of data in transit and access controls within our organization.

We retain personal data only as long as necessary for the purposes described in this Policy. Account-related data is generally retained while your account is active and for a reasonable period afterward to meet legal, accounting, or regulatory obligations. Technical logs, such as IP addresses, are generally retained for a shorter period for security and fraud-prevention purposes. Transaction data recorded on the Solana blockchain is public, permanent, and immutable, and is not subject to our control or retention policies.

7. International Data Transfers

We are based in the United States, and our service providers, including Privy.io and Cloudflare, are also based in the United States. If you access the Services from outside the United States, your personal data will be transferred to, stored, and processed in the United States, which may have different data protection laws than your home jurisdiction. By using the Services, you understand that your data will be processed as described in this Policy.

8. Your Privacy Rights

U.S. State Privacy Rights

If you are a resident of California or another U.S. state with a comprehensive privacy law, you may have the right to: request access to the personal data we hold about you; request correction of inaccurate data; request deletion of your data; and opt out of the sale or sharing of your data or its use for targeted advertising. We do not sell personal data. To exercise these rights, contact us using the information in Section 12. We will not discriminate against you for exercising your privacy rights.

European and UK Privacy Rights

If you are located in the European Economic Area or the United Kingdom, you may have additional rights under the GDPR, including the right to access, rectify, or erase your data; restrict or object to certain processing; receive a copy of your data in a portable format; and lodge a complaint with your local data protection authority. Where we rely on your consent to process data (for example, for certain cookies), you may withdraw that consent at any time.

Response Timeframe and Right to Appeal

We will respond to a privacy rights request without undue delay, and in any event within 45 days of receipt; this period may be extended once by an additional 45 days where reasonably necessary, in which case we will notify you of the extension and the reason for it. If we decline to act on your request, we will explain why, and you may appeal that decision by replying to our response. We will inform you of the outcome of an appeal within 60 days. If your appeal is denied, you may have the right to contact your state Attorney General.

Limitation on Deletion of Blockchain Data

While we can delete personal data from our internal, off-chain systems upon a valid request, we cannot alter or erase data that has been recorded on the public Solana blockchain. This on-chain data is outside our control and is not subject to deletion requests.

9. Cookies and Similar Technologies

We use cookies and similar technologies to operate and improve the Services, remember your preferences, secure your session, and analyze performance. We use both essential cookies, necessary for the Services to function, and optional cookies for analytics. You can control or disable cookies through your browser settings, though this may impair some functionality of the Services.

10. Do-Not-Track Signals

Some browsers and devices include a "Do Not Track" (DNT) feature or setting. Because there is not yet an accepted industry standard for recognizing or responding to DNT signals, we do not currently respond to them. If a standard for online tracking is adopted that we are required to follow, we will describe our practice in a revised version of this Policy.

11. Children's Privacy

The Services are not directed at, and are not intended for use by, individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected such data, we will take steps to delete it as soon as reasonably possible.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or operational reasons. If we make material changes, we will notify you by posting the updated Policy on our website and updating the effective date above. Your continued use of the Services after such changes constitutes acceptance of the updated Policy.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Data Controller: RUNNR Labs LLC

Email: contact@runnr.trade