Privacy Policy
Version 1.2Effective date: [Effective date]
1. Who is responsible for your data
1.1. The controller (operator) of your personal data is [Company name], registration number [Registration number], [Registered address, Uzbekistan] ("we", "us"). Contact for privacy questions: [email protected].
1.2. This Policy covers OddSnipe and MemeGun: the websites, Telegram bots, Mini Apps, browser extension and APIs (the "Service").
1.3. Residents of Uzbekistan. The Service is not offered to persons located in or resident in the Republic of Uzbekistan (Section 3 of the Terms of Service). We do not intend to process personal data of residents of Uzbekistan beyond what is needed to apply this restriction and to let existing users take their money out.
(a) New accounts. Residents of Uzbekistan cannot register. On the websites, in the Mini App and in the browser extension the country determined from the IP address of the request is checked; if it is Uzbekistan, registration is refused before anything is recorded: no account, no login history, no record of accepting the Terms. The refused request is not stored in our application logs and is not written to the access logs of our proxy. In a Telegram bot the IP address is not available, so an account can be opened there without stating a country: we then store only your Telegram user ID, username, language and the time of registration. Deposits and trading in the bot become available only after your country has been checked by IP when you sign in to a website or the Mini App. If you declare Uzbekistan when opening the account in the bot, registration is refused before anything is recorded; if a bot account turns out to be connected with Uzbekistan later, paragraph (b) applies, and you can delete the account at any time.
(b) Existing accounts. If an existing account is connected with Uzbekistan — you declared Uzbekistan as your country, you signed in from an IP address in Uzbekistan, or our support confirmed it after a review — the account is switched to withdraw-only mode (Section 3.3 of the Terms): you can sign in, see your balance, close your open positions, withdraw the remaining balance and delete the account. To apply this restriction we record only that the account is in withdraw-only mode, since when, and the kind of reason (declaration, sign-in, repeated sign-ins or support decision). We do not record the declared country itself or the country you had declared before, we do not create a security alert for such a declaration, and the country of such a sign-in is not added to your login history. If the country of a single earlier sign-in is the only connection with Uzbekistan, the account is not restricted: it is marked for a manual review by our team, which either removes the mark or confirms withdraw-only mode.
Note for the lawyer: confirm the applicable law (for example, the Law of the Republic of Uzbekistan "On Personal Data" and, if users in the EU/UK are served, the GDPR / UK GDPR), the legal bases below and the registration of the personal data database. Residents of Uzbekistan are excluded because of the requirement to store personal data of citizens of Uzbekistan in databases located in Uzbekistan. Registration from Uzbekistan detected by IP (websites, Mini App, extension) or declared in a bot is refused before any record is created; the refused request is not kept in application logs or proxy access logs. Since version 1.2 a bot account can be opened without a country (the IP address is not available to a bot): until the country is checked by IP, such an account holds only the Telegram user ID, username and language, and cannot deposit or trade — confirm that this minimal record is acceptable under the data localisation requirement. Existing accounts are not locked completely, so that their owners can withdraw their funds; the only data recorded for the restriction is the withdraw-only flag, its date and the kind of reason, kept for as long as the account exists and then as set out in Section 4. The operator's own tools — the admin panel, the operator's Telegram bot and the notifications of the signing service — are not covered, because the operator may be located in Uzbekistan. Limits: the country is determined from the IP address (a VPN can hide it) or, in a Telegram bot, from the user's declaration (a false declaration breaches Section 3.4 of the Terms; trading from the bot additionally requires an IP check). Confirm the wording, whether serving existing accounts in withdraw-only mode is acceptable, and whether citizens of Uzbekistan living abroad are covered.
2. What we collect
| Category | What exactly | Where it comes from |
|---|---|---|
| Telegram account | Telegram user id, username, language code, Telegram Premium flag | Telegram login, Mini App, bot |
| Wallets | Wallet addresses you link (EVM, TON), custodial wallet addresses we create for you, your Polymarket Deposit Wallet address | You, the Service |
| IP address and country | IP address of each request; country and region derived from the IP by our network provider; history of countries you declared and countries of your logins | Your device, Cloudflare, you |
| Device identifier | A random identifier created in your browser or Mini App; we store only a salted hash of it | Your device |
| Login history | Time of login, client (website, Mini App, wallet sign-in), salted hashes of the IP address and of the device identifier | The Service |
| Trades and money | Deposits, orders and trades, withdrawals, withdrawal addresses, balances and ledger entries, copy-trading subscriptions, Telegram Stars payments | The Service, blockchains, venues |
| Programs | Referral relations and rewards, points, competition entries and results | The Service |
| Acceptance of terms | Version of the Terms you accepted, time, channel (website, Mini App, bot, extension), salted hash of the IP address | The Service |
| Settings | Language, theme, your limits, alert preferences | You |
| Security records | Security alerts, actions in the audit log, confirmations of withdrawals | The Service |
| Token checks | Token addresses you check; the public feed shows checks without your identity and with rounded time | You |
2.1. We do not collect your passport or ID documents [unless this becomes required by law — to be confirmed], your precise location, your contacts, or data for advertising. We do not use analytics or advertising trackers. The telemetry of the TON Connect library that the Mini App uses to connect a TON wallet is switched off: the library does not send usage or error events, including your wallet address, to its developer (analytics.ton.org) — see section 6 of the Cookie Policy.
2.2. Blockchains are public. Your wallet addresses and on-chain transactions are visible to anyone and cannot be deleted by us.
3. Why we use it
| Purpose | Examples | Legal basis [to be confirmed by the lawyer] |
|---|---|---|
| Providing the Service | Account, balance, deposits, trades, withdrawals, copy trading, notifications | Contract |
| Security | Sessions, confirmation of withdrawals, freezing, detecting account takeover | Contract, legitimate interest |
| Anti-fraud | Detecting multiple accounts, referral and competition abuse (IP and device hashes, funding sources) | Legitimate interest |
| Geographic restrictions and sanctions | Determining your country from the IP address and your declarations | Legal obligation, legitimate interest |
| Legal compliance | Keeping records of transactions and of your acceptance of the Terms, answering lawful requests | Legal obligation |
| Operating and improving the Service | Aggregated metrics without personal data, error diagnostics | Legitimate interest |
4. How long we keep it
| Data | Retention |
|---|---|
| Website and Mini App sessions (refresh token) | 30 days from the last renewal |
| Login history (IP and device hashes) | Used over a rolling 90-day window for security and anti-fraud; stored records are kept for [retention period] |
| Trades, deposits, withdrawals, ledger | [Period required by law, e.g. 5 years after the account is closed] |
| Acceptance of the Terms | For the life of the account and [period] after it is closed |
| Security alerts and audit log | [Retention period] |
| Account closed at your request | The account is closed at once; your Telegram username, language, Telegram Premium flag and device hash are erased at once; the records above are kept for the periods in this table and then anonymised |
| Withdraw-only flag (Section 1.3) | While the account exists, then as the account's other records |
| Encrypted database backups | 14 days (rolling) |
| Proxy access logs | 14 days (rolling); they do not contain request parameters or authorization headers; refused registrations from Uzbekistan are not written to them |
| Proxy error logs | Written only when a request fails at the proxy (for example, the backend did not respond): IP address, requested address (may include request parameters), time. Kept in a size-limited rotating log (at most about 100 MB) and overwritten by newer entries |
| Application logs | They do not contain IP addresses, request parameters or authorization headers; kept in a rotating buffer limited by size (100 MB per service), older entries are overwritten |
5. Who we share it with
5.1. We share data only as needed to run the Service:
- HOSTKEY — our servers (application, signing service, key vault); everything we store is processed there.
- Cloudflare — network protection and delivery (CDN and WAF), access control for our administration tools (Cloudflare Access), storage of encrypted backups (R2) and email forwarding for our support addresses (Email Routing). It processes your IP address and tells us your country; backups are encrypted before upload and Cloudflare cannot read them.
- Zoho Mail — our support mailbox: it receives the messages you send to our support addresses.
- Telegram — bots, login, Mini Apps and notifications: your Telegram ID and the messages we exchange with you.
- Alchemy — blockchain access (RPC): to read blockchains and send transactions it receives the wallet addresses and transactions involved.
- Polymarket and its relayer — to create your Deposit Wallet and execute your orders.
- Anthropic — AI explanations of prediction market rules: it receives only the public text of a market (question, rules, resolution source, end date), with no data about you.
- TypeSafe AI — a quick risk label for a memecoin: it receives only the results of our token check and the token’s name and symbol, with no data about you.
- Better Stack — uptime monitoring: our servers send it a regular “alive” signal with no personal data.
- Authorities, when required by law.
5.2. We do not sell your personal data.
5.3. Some providers process data outside your country. [The lawyer to describe cross-border transfer safeguards.]
6. Security
We protect data with encryption, access separation and hashing; private keys are kept in an isolated signing service. See the Security page on the website for details. No system is completely secure.
7. Your rights
7.1. Depending on applicable law, you may ask us to give you access to your data, correct it, delete it, restrict or object to its processing, or give you a copy. Some data (for example, transaction records) must be kept by law and cannot be deleted on request. Write to [email protected].
7.2. You can delete your account yourself — in a Telegram bot with /deleteaccount, or on the website — once your balance is zero and no withdrawal is in progress (withdraw the rest first). This also works in withdraw-only mode. The account is closed at once: all sessions end, you can no longer sign in, copy-trading subscriptions stop, and your profile data is erased as described in Section 4; records that the law requires us to keep stay for the periods in Section 4.
7.3. You may complain to the data protection authority: [supervisory authority].
8. Children
The Service is only for people aged 18 or over. We do not knowingly collect data of minors.
9. Cookies
See the Cookie Policy.
10. Changes
We publish each new version of this Policy on the websites with a new version number and date.
11. Contact
[Company name], [Registered address, Uzbekistan], [email protected].