Oku Trade Privacy Policy

2.1 Public blockchain data

Public blockchains are generally transparent and immutable. Transactions, token balances, and smart contract interactions associated with a wallet address may be publicly visible. Although wallet addresses are pseudonymous, third parties may be able to link a wallet address to a real identity now or in the future (for example, through exchange records, analytics tools, or public disclosures). Because onchain records are typically immutable, they generally cannot be deleted or modified.

2.2 Non-custodial software; you control your Wallet

The Products are software tools that help you view information and interact with third-party protocols. You control your wallet and authorize transactions. We do not have custody, possession, or control of your crypto assets, and we cannot access, retrieve, transfer, or recover assets for you.

2.3 We do not execute transactions on your behalf

You initiate and authorize transactions for third-party protocols and networks through your wallet (for example, by signing and broadcasting a transaction). As a result, when you take actions through the Products, information may be transmitted to and processed by third parties such as wallet providers, blockchain nodes, relays, indexers, automation providers, and protocol operators.

3.1 Information you provide

We collect information you choose to provide, which may include:

• Contact information (such as email address) if you subscribe, create a login (if offered), contact support, or otherwise choose to receive communications.
• Authentication and Terms acceptance records, such as the wallet address used to accept the Terms, the date/time of acceptance, and the version of the Terms accepted.
• Support, feedback, and correspondence, including the content of messages you send us and any attachments.
• Survey, research, or usability study responses (if you participate).
• Oku Rewards profile and participation data, including your level, points balance, progress toward rewards, Loot Box redemption history, and any off-chain activities you complete to earn points (such as tasks, referrals, or promotional activities).
• Fulfillment information for Oku Rewards redemptions (if you participate, such as name, shipping address, size preferences, and related fulfillment details)
• Subscription and billing metadata (such as plan tier, renewal status, and receipt history) if you purchase subscription-based features.
• Job applicant information (if you apply), such as resume and contact details.

We may also collect other information you choose to provide, depending on how you use the Products.

3.2 Wallet and onchain activity

When you connect a wallet or initiate an onchain interaction through a Product, we may collect or generate:

• Your public wallet address and related identifiers.
• Transaction hashes and limited transaction metadata (for example, chain, timestamp, and status) for transactions you initiate through the Products.
• Public onchain data that we retrieve and display (for example, balances, positions, pools, and other protocol data), which may be associated with your wallet address.
• Points and redemption history (if you use Oku Rewards), which may be associated with your wallet address.
• Trading volume metrics used to determine eligibility for volume-based rewards (such as Loot Boxes), which may be associated with your wallet address and profile.

3.3 Public profile information

If you participate in Oku Rewards, certain information—including your level, points balance, and progress—is displayed on a public profile visible to other users of the Products. You should not expect this information to be private. We do not allow custom profile picture uploads; profile imagery is system-generated.

3.4 Device, network, and usage data

We and our service providers may automatically collect:

• Device and browser information (such as device type, operating system, browser version, language, and settings).
• Network information (such as IP address) and approximate location derived from IP address (for example, country or region).
• Log and diagnostic data (such as access times, pages viewed, actions taken, errors, performance data, and API request metadata).
• Cookie and similar technology data as described in Section 6.
• Off-chain activity verification providers (for example, confirmation that you completed a task or referral action for points eligibility).

3.5 Information from third parties

Depending on which features you use, we may receive information from third parties, such as:

• Wallet providers and connection tools (for example, confirmation that a wallet is connected, chain/network, and wallet address).
• Payment processors (for example, confirmation of payment, billing address, and subscription status).
• Merchandise fulfillment vendors (for example, shipping status, delivery confirmations, and returns processing).
• Third-party analytics and security providers that help operate, secure, and measure the Products.
• If you onboard through Bridge.xyz via our interface, Bridge may provide us with your name, email address, wallet address, and a Bridge-assigned identifier to facilitate your requested transactions and compliance.
• If you use Web3 Sheets (a Google Sheets extension), Google may provide limited account identifiers and authorization tokens necessary to operate the extension, depending on the permissions you grant.

3.6 Information we do not collect

We do not intentionally collect:

• Your wallet private keys, seed phrase, or similar credentials that control your crypto assets.
• Payment card numbers (these are generally processed by your payment processor), except to the extent we receive tokenized payment identifiers and receipt metadata.
• Government-issued identification, biometric data, or similar sensitive identifiers, unless a third-party service you use requires it under its own policies.

3.7 Information you provide to our service providers

We use service providers to operate, secure, analyze, and improve the Products. The providers we use may change over time, and the list below is illustrative and not exhaustive. Examples of service providers we may use include:

• Cloudflare (security and network services; processes IP address to help protect the Products and enforce geographic restrictions, including sanctions compliance).
• PostHog (product analytics; processes technical identifiers and usage information; may provide session replay features to help diagnose issues).
• Google Analytics (web analytics for our public website properties).
• Cookie3 (Web3 analytics for marketing performance and user journey insights, including analysis of onchain and off-chain interactions).
• Stripe (payment processing for subscription-based features, if offered).
• Bridge.xyz (on/off-ramp and bridging services, if you choose to use them).
• DigitalOcean (cloud hosting and storage infrastructure used to operate the Products).

These providers may process information on our behalf or for their own purposes. Where a provider processes information for its own purposes, its processing is governed by its own privacy policy.

6.1 Analytics and session replay

We use analytics tools to understand how users navigate and use the Products so we can improve performance, usability, and security. For example, PostHog may collect technical identifiers and usage information (such as referring URL, pages viewed, and interactions), typically via first-party cookies, and may assign a pseudonymous identifier to understand feature usage over time. We may also use session replay features to capture page interactions (such as clicks and scrolling) to diagnose issues.

6.2 Your cookie choices

You can control cookies through your browser settings. You may also be able to limit certain tracking through device settings or browser extensions. Some Product features may not function properly if cookies are disabled.

Google provides tools that allow you to control certain Google advertising settings. Google also offers an opt-out browser add-on for Google Analytics in some browsers.

Some browsers offer "Do Not Track" signals. Because there is no uniform standard for how to interpret these signals, we do not respond to "Do Not Track" signals as a standalone setting. We do, however, honor applicable opt-out rights where required by law, and we generally treat Global Privacy Control (GPC) signals as a preference signal where feasible.

7.1 Wallet connection and onchain activity

You can generally use many Product features without creating an account. If a feature requires a wallet connection, you can disconnect your wallet through your wallet provider and stop using the Products at any time. Disconnecting a wallet does not remove public onchain records.

7.2 Communications

If you opt in to receive non-essential marketing or product update emails, you can opt out at any time using the unsubscribe link in those messages. Service-related messages (such as policy updates or security notices) may still be sent where permitted.

7.3 Location-based privacy rights

We summarize privacy rights that may be available under certain laws to help you understand potential rights. This summary does not mean those laws apply to us or that we direct the Products to any particular jurisdiction; we provide any rights described here only to the extent required by applicable law.

7.3.1 U.S. state privacy rights. Depending on where you live and to the extent applicable law applies, you may have rights to request access to, correction of, or deletion of certain personal information, and to obtain a copy of information in a portable format. Some laws also provide the right to opt out of certain processing (such as targeted advertising or the sale/sharing of personal information). To exercise applicable rights, email us at legal@gfxlabs.io with your request and enough information for us to verify it. We may ask for additional information to confirm your identity and process the request. Where feasible, we will also coordinate with our service providers (for example, analytics providers) to fulfill verified requests with respect to data processed on our behalf.

7.3.2 EEA/UK privacy rights. If you are located in the European Economic Area or the United Kingdom, and to the extent the GDPR or UK GDPR applies to our processing of your personal data, you may have rights under applicable law, including the right to access, correct, delete, or restrict processing of your personal data, and the right to object to certain processing. You may also have the right to data portability. You can exercise these rights by contacting us at legal@gfxlabs.io.

7.4 Do Not Track and Global Privacy Control

Some browsers offer "Do Not Track" signals and Global Privacy Control (GPC). Because there is no uniform standard for these signals, we generally treat them as a preference signal where feasible. We do not sell personal information for money.