Privacy Notice

• We collect what we need to run your account, the timeline, Messages, Levels and your portfolio, and no more.
• We do not sell your personal data. Ever.
• Messages are encrypted when stored, but they are not end-to-end encrypted. Our systems check them for scams and abuse, and a person reads a message only when it is reported or held as a likely scam.
• What you ask Ask Decryptr is sent to OpenAI to produce an answer. Your chat history stays on your phone.
• If you link an exchange, we only accept read-only keys, and we keep them in an encrypted vault.
• Ads are only personalised if you agree, and nothing is locked if you decline.
• You can download your data, or delete your account, from the app.

Decryptr Limited (registered office 18B Gregory Street, Nottingham, NG7 2LR, company number 17484593) is the data controller for Decryptr.

For anything about your data, email privacy@decryptr.ai.

Where we rely on legitimate interests, the interest is running a safe, working product, protecting people from fraud, and improving the app. We have weighed it against your rights. You can object at any time: see Your rights. The legal obligation is mainly the Online Safety Act 2023, which requires us to protect users from illegal content, including fraud.

We do not ask for sensitive information such as health, religion or political views. If you choose to write it in a post or message, we treat it with the same care as everything else, and you can delete it.

What we store. When you use Messages (direct messages, group chats, rooms and event rooms), we store what you send: text, photos, posts you share, reactions, and when you sent and read them. Messages are private to the people in the conversation and, for rooms anyone can read, to anyone signed in.

How we protect them. Messages are encrypted in transit and when stored; photos are encrypted on your phone before upload. They are not end-to-end encrypted: our systems can read them, so we can keep you safe.

Automated checks. We check every message and photo automatically, as it is sent, for scams (for example requests for seed phrases, fake support, wallet-drainer links, impersonation) and for illegal or abusive content. A message that is very likely a scam is hidden straight away until a moderator reviews it. Links are checked before they can be opened. These checks use our own rules and OpenAI's moderation service (text and images are sent to OpenAI for this check only; OpenAI does not use them to train its models and does not keep them after the check).

When a person reads your messages. A member of our team reads a message only when someone in the conversation reports it, or when our automated checks hold it as a likely scam. They see that message, any photo in it, and the five messages before it. Every time a moderator opens a conversation or a private photo, it is logged.

How long we keep them. Messages stay until everyone has left the conversation. If you delete your account, your messages stay in other people's conversations as "Deleted account", so reports and evidence of scams survive; your photos are deleted. Copies of messages that were removed, unsent, edited or held are kept for 12 months for moderation and appeals. Notifications about messages are deleted after a day. Event-room chat is deleted 90 days after the event.

Your choices. You choose who can message you, whether people see when you've read their messages, whether notifications show the message, and you can mute, archive, clear or delete any chat, block anyone and report anything.

When you use Ask Decryptr, what you type, any image or document you attach, any voice clip you record, and the recent conversation for context, are sent to OpenAI. OpenAI processes them on our instructions to produce a reply. We ask for your agreement before your first message. Documents are read on your phone and only their text is sent.

OpenAI processes this in the United States. Under our agreement with them, they do not use your prompts to train their models. They may keep API content for up to 30 days to detect abuse, and then delete it.

Your conversation history is kept on your phone, not on our servers. You can start a new chat or clear the history in the app, and deleting the app deletes it. We keep a count of the credits you use, not what you asked.

Please do not type private keys, seed phrases, passwords or other people's personal details into the assistant.

Wallet addresses. A wallet address you add is public blockchain data, but linked to your account it becomes personal data, so we treat it as such. To show its activity we look it up with blockchain data providers (Etherscan, Alchemy, public network nodes, Hyperliquid and Lighter). They receive the address, never your name or email. We never ask for, and can never access, your private keys or seed phrase. To verify a wallet you sign a message; the signature proves control and moves nothing.

Exchange and prop firm keys. You can link an account at a supported exchange (Bybit, OKX, Binance, Bitget, Coinbase) or prop firm with an API key. We only accept keys that the exchange confirms are read-only: they can see balances, positions and trades, and cannot trade or withdraw. The key is stored in an encrypted vault, is only used by our servers, and never comes back to your phone. Our sync service reads your balances, positions and trades so we can show them, and stores what it reads.

Some prop firms confirm accounts for us through a partner connection. When they do, we may compare the email address on the firm's record with the one on your Decryptr account, to check the account is yours.

Unlink an account and we delete the key at once, along with what we read with it. Remove a wallet and we stop reading it. Whether your wallets, trades and results are visible to others is your choice, in Settings.

If you link your X account, X asks you to approve it. We receive your X account id and handle, and store only those. We do not post for you, read your timeline or keep any access to your X account: the access X gives us is used once and cancelled. Your handle shows on your profile; your X account id does not. You can unlink it at any time.

When you post or send a link, we check it against our own rules, public scam lists (from MetaMask, ScamSniffer and others) and, where enabled, Google Web Risk. Google receives the web address only, never who sent it. We keep a record of links that were blocked or held, with the account that tried to share them, for 90 days.

When a post names a token contract, we check it with services such as GoPlus, Honeypot.is, RugCheck and DexScreener. They receive the contract address only, which is not personal data.

Decryptr shows ads through Google AdMob, and ads we sell directly. Where the law requires your consent before anything is stored on or read from your device for advertising (the UK, the EEA and Switzerland), we ask for it before the ad SDK starts, and you can refuse in one tap. On iOS, Apple also asks you separately for permission to track, wherever you are. And everywhere, personalised ads can be switched off at any time in Settings.

If you say no, you still see ads, but they are contextual: no advertising identifier is read, and no profile is built about you for advertising. Nothing in the app is restricted or slowed down because you declined. Google may still use your IP address to estimate your country or city for the ad and to prevent fraud.

If you say yes, Google receives your advertising identifier and ad interaction data, and acts as a controller of that data in its own right. Google's handling of it is described in the Google privacy policy.

For the ads we sell directly, we count views and taps against your account so we can report totals to advertisers. Advertisers never receive your identity.

You can change your mind at any time: Settings → Privacy in the app, and on iOS Settings → Privacy & Security → Tracking.

decryptr.ai is hosted by Vercel. Vercel's analytics count page views and measure speed without cookies. PostHog measures how the site is used; until you accept cookies it runs without them, and it only records sessions if you accept. Cloudflare Turnstile checks that a person, not a bot, is signing up, signing in or resetting a password.

We use these providers. Each processes data only on our instructions, unless the table says it is a controller.

Hetzner runs our servers in its own data centre in Helsinki, Finland. The UK treats the EU as adequate for data protection, and any other transfer outside the UK follows the rules in Where your data goes.

We also share data where the law requires it. That includes a court order, or a report we must make about illegal content, such as child sexual abuse material to the National Crime Agency. We do not sell personal data, and we do not share it with data brokers.

Anything you post publicly (your profile, your posts, your Levels drawings once a round locks, your position on a leaderboard, public rooms) is visible to anyone using Decryptr, and to search engines where the page is public.

Our news service reads public posts from a list of X accounts that post about crypto markets, such as projects, founders and well known traders. We store the post, the handle and the account's public name and picture, use OpenAI to sort what is news, and publish short news items that may quote or link to the post. Our lawful basis is legitimate interests: timely market news. If it is your account and you want us to stop, email privacy@decryptr.ai.

Our main database is in Ireland. Some of our providers process data outside the UK, mainly in the United States. Where they do, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified to it, and otherwise on the UK International Data Transfer Agreement or Addendum, together with an assessment of the risks of that transfer. Transfers to the EU rely on the UK's adequacy regulations.

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you (you can download most of it yourself in Settings, under Privacy);
• correct anything that is wrong;
• delete your data (you can do this yourself in Settings → Delete account);
• restrict or stop a particular use of it;
• send your data to another service in a portable format;
• object to uses based on our legitimate interests, including feed personalisation and analytics;
• withdraw a consent you gave, such as notifications or personalised ads, at any time.

Some decisions are made automatically. Our moderation system can hide a post or message, remove a clear breach of the rules, and give a strike that limits your account for a time. It never bans an account; only a person can. You can appeal any decision and a person will look at it.

Email privacy@decryptr.ai. We respond within one month and it costs nothing. If a request is especially complex we may take up to two months more, and we will tell you within the first month if so.

If you are unhappy with how we handled it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you came to us first.

Decryptr is for adults. You must be 18 or over to have an account, because the app is about cryptoasset markets, carries advertising, and lets adults message each other. We ask you to confirm your age when you sign up.

We do not knowingly collect data about children. If you believe a child is using Decryptr, tell us at privacy@decryptr.ai and we will close the account and delete the data.

Data is encrypted in transit and at rest. Message text is encrypted again with a key held in a vault, and message photos are encrypted on your phone. Exchange keys are kept in the same vault. Access to production systems is limited to people who need it and protected by multi-factor authentication. Sign-in tokens are held in your device's secure keychain, not in ordinary app storage. Photos have location and other hidden details removed before upload.

No system is perfect. If a breach happens that risks your rights, we will tell the ICO within 72 hours and tell you without undue delay where the risk to you is high.

When we change how we use your data we will update this notice and change the date at the top. If the change is significant we will tell you in the app or by email before it takes effect.

See also our Terms of Use and Support.