Privacy Policy

1. Who we are

Booyah Wallet ("Booyah", "we", "us") provides a non-custodial interface for viewing, swapping, staking, trading and tracking Solana-based assets, including the $BOO token. This policy explains what information we collect when you use the Booyah Wallet app and website at booyahwallet.com (the "Service"), why we collect it, and the choices you have.

2. Information we collect

Account information

• Your email address and name, used to create and secure your account.
• If you sign in with Google, we receive your name, email address and Google account identifier from Google. We do not receive your Google password.
• If you register with an email and password, your password is handled by our authentication provider in hashed form and is never visible to us.

Wallet and on-chain information

• The public Solana wallet address you connect to the Service, and the token balances associated with it. We read this information from public blockchain nodes to display your holdings.
• Records of the activity you perform through the Service — swaps, transfers, stakes, unstakes, reward claims, card cashback and perps trades — including transaction signatures.
• Your wallet's private keys are never sent to us. Every transaction is signed in your own wallet, and we never ask you for your seed phrase outside the optional recovery-phrase storage described next.

Recovery phrase (optional, encrypted)

• A recovery phrase is generated on your device. If you choose to save it, it is stored in our database encrypted with AES-256-GCM under a server-held key. It is never written to logs, never included in emails or notifications, and never sent to any third party.
• Only the account that saved the phrase can read it back, through an authenticated action in Settings, and we use it for nothing other than returning it to you.
• If you do not save it, we hold nothing. You can replace a saved phrase at any time, and you can ask us to delete it.

App lock information (stays on your device)

• If you turn on the app lock, this browser stores a PBKDF2 hash of your 6-digit PIN and, for biometrics, an identifier for the credential your device created. Neither is sent to us.
• Biometric data — your face, fingerprint or iris — never leaves your device. The device only tells the app whether the check passed.

Booyah Visa card information

• Information you submit in a card application: legal name, date of birth, phone number, the last four digits of your Social Security Number, postal address, and a government ID image you upload (stored privately and reachable only through short-lived signed links).
• Card status, the last four digits of the issued card, expiration date, spending limits you set, and card transactions and cashback records.
• Full card numbers, CVV codes and Social Security Numbers are not stored by us; identity verification and card issuing are handled by our card issuer.

Community, referral and preference information

• Your referral profile: display name, chosen username, avatar image (if you upload one), and who invited you.
• Your leaderboard alias, staking records, earning bonuses, referral rewards and perps fee share.
• Price alerts you create, and the Discord webhook URL you provide if you choose to connect a notification channel.
• Your marketing email preference, including any unsubscribe you request.

Monetize (publisher) information

• The banner units you create: name, artwork choices, size, the destination URL you enter and the invite link printed on the artwork.
• Impression and click counts for each banner unit. These are aggregate counters on our own tracking endpoint — we do not identify individual visitors to the pages where your banner appears.

Gallery

• If you import from Google Photos, we receive the photos you pick and copy them into private storage tied to your account. We request read access only to the items you select.

Technical information

• Device and browser type, approximate location derived from your IP address, and security/error logs generated when you use the Service.
• Local storage and cookies used to keep you signed in, to remember your preferences and to keep the app lock on this device.

3. Public blockchain data

Solana is a public blockchain. Wallet addresses, token balances, staking deposits, transfers, trades and transaction signatures are public by design and are permanently recorded outside our systems. We cannot delete, alter or hide on-chain records, and anyone can read them independently of the Service.

4. How we use information

• To create and secure your account and sign you in.
• To display your wallet balances, portfolio, staking positions, trades and rewards.
• To build, submit and verify the transactions you request, including staking deposits, payouts and leveraged trades.
• To operate the app lock and the optional encrypted recovery-phrase storage so you can get back into your own account.
• To process card applications, pass KYC information to the card issuer, apply your spending limits, and calculate cashback.
• To run Monetize: render your banners, count impressions and clicks, and report performance to you.
• To operate community features such as referrals, leaderboards and earning bonuses.
• To send the price alerts, account notices and marketing emails you ask for.
• To detect fraud, abuse, duplicate reward claims and other misuse of the Service.
• To provide support, comply with legal obligations and enforce our Terms of Service.

5. Sharing

We do not sell your personal information. We share it only with service providers who help us run the Service, and only as far as needed:

• Hosting, database and authentication provider — stores account records and app data on our behalf, including the encrypted recovery phrase if you saved one.
• Solana RPC and infrastructure providers — receive the wallet addresses and transactions needed to read balances and submit transactions.
• Swap and perps execution providers — receive the token amounts, market and slippage parameters of the orders you place, so they can be routed and filled.
• Market data providers — receive token identifiers (not your personal data) to return prices and charts.
• Card issuer and processor — receives the application details and government ID needed to verify your identity and issue your Booyah Visa card, and supplies the authorization and settlement data we use for cashback.
• Google — only if you connect Google Photos, to list and download the photos you choose to import.
• Discord — receives the notification content you configured, only if you connect a Discord webhook.
• Email delivery — processes account, verification, notification and marketing emails sent to you, and honours unsubscribes.
• Legal and safety — where required by law, or to protect the rights, property or safety of Booyah, our users or the public.

If Booyah is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction; we will notify you before your data becomes subject to a different privacy policy.

6. Retention

We keep account and activity records for as long as your account is active, and afterwards only as long as needed for the purposes described above, to resolve disputes, prevent abuse and meet legal requirements. Card application and identity records are kept for as long as card and financial record-keeping rules require. A saved recovery phrase is kept until you replace it, ask us to delete it, or close your account. Aggregated, non-identifying statistics may be kept longer. On-chain records are permanent and outside our control.

7. Security

We use industry-standard measures to protect your information, including encryption in transit, encryption at rest for the optional recovery phrase, access controls and server-side handling of sensitive operations. The app lock is an extra, device-side layer you control. No method of transmission or storage is completely secure, and you are responsible for keeping your wallet, account credentials, PIN and recovery phrase safe.

8. Your choices and rights

• You can update your profile details and preferences in the app at any time.
• You can disconnect your wallet and remove notification channels whenever you wish.
• You can replace or delete a saved recovery phrase, and turn the app lock on or off, from Settings on your device.
• You can unsubscribe from marketing email from the link in any marketing message, and transactional messages such as receipts and security notices will continue to be sent while you hold an account.
• You can request a copy of, correction of, or deletion of your account data by contacting us. Deleting your account removes your off-chain records; it cannot remove on-chain activity.
• Depending on where you live, you may have additional rights to access, correct, delete or restrict the use of your personal information, or to object to certain processing.

9. International transfers

Our service providers may process information in countries other than your own. Where we transfer personal information internationally, we take steps to ensure it receives an appropriate level of protection.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy as the Service or the law changes. We will revise the date at the top and, for significant changes, notify you in the app or by email. Continued use of the Service after an update means you accept the revised policy.

12. Contact us

Questions about this policy or your personal information? Write to us at privacy@booyahwallet.com or through the contact page in the app.