Privacy policy

1. Who is responsible for your data

The controller is Rekt Brands Inc., a Delaware corporation whose team works from the United Kingdom. UK data protection law applies to us because of that team, and EU data protection law applies when we offer the service to people in the European Union.

• Privacy questions and requests: privacy@rekt.trade
• UK Information Commissioner’s Office registration number: [ICO registration number, owner to supply]
• Our representative in the European Union under Article 27 of the GDPR: [EU representative name and postal address, owner to supply]

2. What we collect

Sign-in and profile. When you sign in with email, Google, Apple or X, our wallet provider confirms who you are and gives us an account identifier, and your email address if you used one. You choose a username, and you can add a bio. If you sign in with X, we import your X handle and profile picture to show on your profile. We do not collect your followers, the accounts you follow or anything else from X, and you can remove the X link.

Wallet addresses. The addresses of the wallets created for you, linked to your account. Wallet addresses are personal data when they are linked to you.

Trading and money. Your spot trades, perps orders, trades and positions, deposits, withdrawals, the fees you paid and the rebates you received, and notes you add to your trading journal.

Rooms and social. Rooms you own or join, seat payments and invites, chat messages, comments, follows and alerts.

Acceptances and checks. A record of when you accepted the risk notice or the terms, with the country your connection came from at the time. The results of sanctions checks on your wallet addresses, and any block that follows. Reports you make about messages, and reports others make about yours.

Notifications. If you allow push notifications, the subscription your browser gives us so we can send them.

Location and device. Your IP address and the country it points to, which we use to block regions where the service or a feature is not offered, and which we store as your country when you first sign in. Our servers also log requests, including IP address, browser type and the page asked for. When something breaks in your browser, the app sends us a short error report with the error, the page and the browser type.

Perps trading key. If you trade perps, the encrypted trading key you approved, which can place and cancel orders on your perps account and cannot withdraw funds.

We do not ask for identity documents, and we do not use advertising or analytics cookies.

3. Why we use it and our legal basis

• To run your account, your wallet, your trades and your rooms. Basis: performing our contract with you.
• To show your profile, trades and performance publicly, in feeds, leaderboards and rooms. This is the core of the service. Basis: performing our contract with you.
• To import your X handle and picture. Basis: your consent, given when you sign in with X, which you can withdraw by removing the link.
• To block sanctioned and restricted regions, screen for misuse and keep compliance records. Basis: our legal obligations, and our legitimate interest in preventing fraud and breaches of sanctions law.
• To moderate rooms and chat and act on reports. Basis: our legitimate interest in keeping the service safe and lawful, and our legal obligations for user content.
• To calculate and pay rebates and referral rewards. Basis: performing our contract with you.
• To send push notifications. Basis: your consent, which you can withdraw in your browser settings at any time.
• To keep the service secure and fix faults. Basis: our legitimate interest in a working, secure service.

4. What is public

Rekt is a social trading app. Your username, profile picture, bio, trades and trading performance are public by design, and so are your messages to everyone in a room. Some settings let you keep your live trades out of the public feed.

Chat messages in a room can be read by the room’s members, by the room owner and the moderators they appoint, and by us when we moderate. Do not post anything in a room that you would not want those people to read.

Transactions from your wallet are recorded on public blockchains, where anyone can see them and nobody, including us, can change or erase them. We never write your name, email or other identifiers to a blockchain.

5. Who processes your data for us

These companies process personal data on our behalf, under data processing terms:

• Privy (United States) provides sign-in and the wallets created for you.
• Vercel (United States) hosts the app and its server logs.
• Neon (United States) hosts our database.
• Chainalysis (United States) checks wallet addresses against sanctions lists. It receives the address only.

These services receive the data they need to carry out what you ask, under their own terms and privacy policies:

• Relay routes spot trades and transfers and receives your wallet address and trade details.
• Hyperliquid runs perps and receives your wallet address and orders, which it records publicly.
• Google, Apple and X confirm your identity if you sign in with them.
• Your browser’s push service, run by the browser maker, delivers notifications.

We do not sell your personal data, and we do not share it for advertising. We may disclose it if the law requires us to, or to protect the rights and safety of our users or of Rekt.

6. Transfers outside the UK and the EU

Our processors are in the United States, so your data is transferred there. We protect those transfers with [owner to confirm: the EU-US Data Privacy Framework with its UK extension, or the European Commission’s standard contractual clauses with the UK addendum]. You can ask us for a copy of the safeguards at privacy@rekt.trade.

7. How long we keep it

• Account and profile details: while your account is open, and removed within 30 days of closing it.
• Trades, payments, fees and rebates: [owner to confirm, for example six years after the trade for tax and accounting records]. Published trades and performance stay public as described in section 8.
• Chat messages: [owner to confirm a retention period, for example 24 months], and removed or anonymised when you close your account, unless needed for a report under investigation.
• IP addresses, country and compliance logs: 12 months, and five years for records of a sanctions check that found a match or led to a block.
• Records of what you accepted: while your account is open and for six years after, so we can show what you agreed to.
• Reports about messages: [owner to confirm, for example 12 months after the report is closed].
• Server logs and error reports: [owner to confirm, for example 30 days].
• Push subscriptions: until you turn notifications off or close your account.
• Perps trading key: until you ask us to delete it or close your account.

8. Closing your account and your public record

When you close your account we delete or anonymise your profile, email, X link, push subscriptions and trading key. Trades you already published, and the public performance records built from them such as leaderboards and room records, stay, because they are a necessary part of the service that other users rely on. The wallet addresses you traded from are retired rather than deleted, and records on public blockchains cannot be erased.

[Owner to confirm with a UK privacy lawyer that keeping public performance after an erasure request is defensible, as the legal review advises.]

9. Your rights

Depending on where you live, you have the right to:

• Get a copy of your personal data, and receive data you gave us in a portable format.
• Have inaccurate data corrected.
• Have your data erased, subject to the limits in section 8.
• Restrict or object to our use of your data, including use based on our legitimate interests.
• Withdraw consent at any time, without affecting what we did before.
• Ask for a person to review a decision made automatically, such as blocking your region.

Write to privacy@rekt.trade. We reply within one month, and may need to confirm that the request comes from you. You can also complain to the UK Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live in the European Union.

10. Cookies and browser storage

We use only what the service needs to work: a cookie that remembers you passed the site password, the cookies and browser storage our wallet provider uses to keep you signed in, and storage in your browser for your theme, a referral code you arrived with, and transactions that are still on their way so a refresh shows them. We do not use advertising or analytics cookies, so we do not ask for cookie consent. If that changes, we will ask first.

11. Security

Your wallet is self-custodial and we never hold its keys. Data is encrypted in transit, and perps trading keys are encrypted at rest. If a breach puts your data at risk, we will tell the regulator within 72 hours where the law requires it, and tell you without undue delay.

12. Children

Rekt is only for people aged 18 or over. If we learn that someone under 18 has an account, we will close it and delete their data.

13. Changes to this policy

We will post any change here with a new date, and tell you in the app before a material change takes effect. The terms of service and the risk disclosure explain the rest of how Rekt works.