Privacy Policy

Mini App Labs, LLC ("we", "us", or "our") operates 10X, a self-custodial perpetual futures trading application available at trade.10xperps.xyz and through World App (collectively, the "Services").

This Privacy Policy describes how we collect, use, and share information when you use our Services. Your use of the Services is also subject to our Terms of Service.

Overview

Privacy is fundamental to how we build 10X. Here is what you should know upfront:

• We collect minimal personal information. 10X is designed to work without requiring extensive personal data. You can use the Services by simply connecting a wallet.
• We do not custody your funds. 10X is a self-custodial application. Your private keys are generated and stored on your device. We never have access to your private keys or the ability to move your funds.
• We do not sell your data. We will never sell or share your personal information with third parties for their marketing purposes.
• Blockchain data is public. Transactions you make through 10X are executed on the Hyperliquid L1 blockchain and are publicly visible. We cannot delete or modify blockchain data.

Information We Collect

Information You Provide

We collect minimal information directly from you. This may include:

• Wallet address. When you connect your wallet to use the Services, your public wallet address is associated with your session.
• Identity verification information. If required by applicable law or regulation, our third-party partners may process identity verification information on our behalf. This may include your legal name, date of birth, government-issued identification, and related information. We do not store this information in our own systems.
• Support communications. If you contact us for support via email or social media, we collect the information you provide in those communications, such as your message content and contact details.
• Feedback and surveys. If you voluntarily participate in surveys or provide feedback, we collect the responses you submit.

Information Collected Automatically

When you use the Services, we automatically collect certain technical information:

• Device information. Device type, operating system type and version, browser type, screen resolution, and language settings.
• Usage data. Pages viewed, features used, actions taken, time spent on the Services, and referring URLs.
• Network information. IP address, which we use to derive approximate location (country level) for analytics purposes and to comply with applicable legal requirements. We do not use your IP address for marketing or advertising.

Blockchain Data

When you execute trades or other transactions through 10X, those transactions are processed on the Hyperliquid L1 blockchain. The following data is recorded on-chain and is publicly accessible:

• Wallet addresses
• Transaction details (trades, deposits, withdrawals)
• Token balances

By design, blockchain data is immutable and cannot be modified or deleted by us or any party. If you want to ensure your privacy rights are not affected, you should be aware that any data recorded on the blockchain will be permanently and publicly available.

Information from Third-Party Services

If you access 10X through World App, we may receive limited information from World App necessary to facilitate your use of the Services, such as your wallet address, in accordance with World App's authorization procedures.

How We Use Your Information

We use the information we collect for the following purposes:

Provide the Services. To operate, maintain, and deliver the functionality of 10X, including processing your trading activity through the Hyperliquid protocol.

Improve the Services. To understand how users interact with 10X, identify issues, and improve performance, features, and user experience. We use privacy-focused analytics that do not rely on cookies or track individual users across sites.

Security and fraud prevention. To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activity. To protect our users, our Services, and the integrity of our platform.

Legal compliance. To comply with applicable laws, regulations, legal processes, or governmental requests. To enforce our Terms of Service and protect our legal rights.

Communications. To respond to your support requests, feedback, or inquiries. To send service-related notices, such as updates to this Privacy Policy or our Terms of Service.

How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

Service providers. We share information with third-party service providers who perform functions on our behalf, including:

• Privy (wallet infrastructure and authentication)
• Hyperliquid (blockchain protocol for trade execution)
• Vercel (application hosting)
• Cloudflare (content delivery and security)
• Plausible (privacy-focused analytics)

These providers only receive information necessary to perform their services and are contractually obligated to protect your information.

Blockchain. As described above, transaction data is recorded on the Hyperliquid L1 blockchain and is publicly accessible. This is inherent to the design of blockchain technology and is necessary to provide the Services.

Legal requirements. We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers. If we are involved in a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will endeavor to notify you of any such change where practicable.

With your consent. We may share your information with your consent or at your direction.

Cookies and Tracking

10X uses Plausible Analytics, a privacy-focused analytics service that does not use cookies, does not collect personal data, and does not track users across websites or applications. Plausible is compliant with GDPR, CCPA, and PECR without requiring cookie consent banners.

We do not use advertising cookies, tracking pixels, or similar technologies for marketing or advertising purposes.

We do not respond to browser "Do Not Track" signals. Because we do not use cookies or cross-site tracking technologies, this setting has no effect on the data we collect through the Services.

Third-Party Links and Services

The Services may contain links to third-party websites, applications, or blockchain protocols. These third-party services are not controlled by us, and this Privacy Policy does not apply to them. We encourage you to review the privacy policies of any third-party services you access. Third-party services connected to or accessible through 10X include, but are not limited to:

• Hyperliquid (hyperliquid.xyz) for trade execution and settlement
• World App (world.org) if you access 10X as a mini app
• Privy (privy.io) for wallet and authentication services

Data Retention

We retain information for as long as necessary to provide the Services and fulfill the purposes described in this Privacy Policy. Specifically:

• Usage and analytics data is retained for up to 12 months, after which it is anonymized or deleted.
• Support communications are retained for up to 3 years after the last interaction.
• Blockchain data (wallet addresses, transactions) is permanently recorded on the Hyperliquid L1 blockchain and cannot be deleted.

When information is no longer needed, we delete or anonymize it. Anonymous data is not personal data and may be retained indefinitely for analytical purposes.

How Your Wallet Works

10X uses Privy to create and manage embedded wallets for each user. Here is how it works:

• Your wallet's private keys are generated using multi-party computation (MPC). The full key is never stored in any single location and is never accessible to us or to Privy.
• Keys are reconstituted only in a secure environment under your control when you sign transactions.
• Neither Mini App Labs nor Privy can access your funds, move your assets, or reconstruct your full private key.
• If you lose access to your authentication method, you may lose access to your wallet and any funds it contains. We cannot recover lost keys on your behalf.

For more information about Privy's security architecture, please see Privy's privacy policy at privy.io/privacy-policy.

Account Deletion

You may request deletion of your account and associated data at any time by contacting us at [email protected]. Upon receiving a valid deletion request, we will:

• Delete or anonymize your usage data, device information, and analytics data within 30 days.
• Remove any support correspondence within a reasonable timeframe.
• Note that we cannot delete data recorded on the Hyperliquid L1 blockchain, including wallet addresses and transaction history, as this data is immutable by design.

Risk Disclosures

Trading perpetual futures involves significant risk. You should be aware that:

• You can lose some or all of your deposited funds.
• Leveraged trading amplifies both potential gains and potential losses.
• Past performance does not guarantee future results.
• Digital assets are volatile and prices can change rapidly.
• You are solely responsible for your trading decisions and the security of your wallet.

10X does not provide investment advice, and nothing in the Services should be construed as financial, investment, or trading advice.

Data Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit, access controls, and regular security reviews.

However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information. Blockchain transactions are publicly visible by design.

Children

10X is not intended for use by anyone under the age of 18. We do not knowingly collect or solicit personal information from children under 13, and we do not knowingly allow individuals under 18 to use the Services. If we learn that we have collected personal information from a child under 13 without parental consent, we will use commercially reasonable efforts to delete that information. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected].

International Data Transfers

10X is operated from the United States. If you access the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. These countries may have different data protection laws than your country of residence.

Where required by applicable law, we implement appropriate safeguards for international data transfers, such as standard contractual clauses, to ensure your information receives an adequate level of protection.

Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access. Request access to the personal information we hold about you.
• Correction. Request correction of inaccurate personal information.
• Deletion. Request deletion of your personal information. Note that we cannot delete data recorded on the blockchain.
• Restriction. Request that we restrict processing of your personal information.
• Objection. Object to our processing of your personal information.
• Portability. Request a copy of your personal information in a structured, machine-readable format.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within the timeframe required by applicable law. We may need to verify your identity before processing your request.

Please note that some of these rights may be limited where we have a legitimate business reason or legal obligation to continue processing your information.

For California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to know what personal information we collect, use, and disclose.
• Right to delete personal information we have collected from you, subject to certain exceptions.
• Right to opt out of the sale of personal information. We do not sell personal information.
• Right to non-discrimination for exercising your CCPA rights.

In the preceding 12 months, we have not sold any personal information of consumers.

You may designate an authorized agent to submit a request on your behalf. We may require verification of the agent's authorization before processing the request.

If we deny your request, you may appeal our decision by contacting us at [email protected].

For European Residents

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the GDPR provides you with additional rights as described above. Our legal bases for processing your personal data are:

• Performance of a contract when processing is necessary to provide the Services you have requested.
• Legitimate interests when processing is necessary for our legitimate business interests (such as improving the Services, ensuring security, and communicating with you), provided these interests do not override your rights.
• Legal obligation when processing is necessary to comply with applicable laws.
• Consent when you have given us your consent to process your personal data for specific purposes. You may withdraw your consent at any time.

You may lodge a complaint with your local data protection authority:

• EEA: edpb.europa.eu
• UK: ico.org.uk
• Switzerland: edoeb.admin.ch

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where appropriate, through a notice on the Services. We encourage you to review this Privacy Policy periodically.

Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Mini App Labs, LLC
Email: [email protected]