Last updated: October 6, 2026

ATH Privacy Policy

ATH is operated by ATH, a Florida, United States company located at Miami, FL 33178 ("ATH", "we", "us", "our"). This Privacy Policy explains what personal information we collect when you use ATH, why we collect it, who we share it with, how long we keep it, and the choices and rights you have.

This policy covers:

• the website and web app at ath.trade;
• the information collected by the former ATH Telegram alerts bot (the "Bot") and the former Peak assistant (the "AI Assistant") while they ran; we closed both in October 2026 and they collect nothing new;
• any API we offer in the future; and
• the emails and messages we send you.

Together, these are the "Service". This policy is part of our Terms of Service. If you do not agree with it, do not use the Service.

Four things to know before the details:

1. We do not hold your keys or your funds. ATH is non-custodial. Transactions from your Wallet are signed by your Wallet: by you in your External Wallet, or by your Embedded Wallet within your signed-in session, whose key only you control. While you are signed in, your Embedded Wallet also signs, without a separate prompt, the account clean-up transactions described in Section 6.7 of our Terms of Service, which close empty token accounts and, unless you turn it off in Settings, burn token balances worth less than their account rent. We keep a record of each balance burned (Section 3.9). Neither ATH nor Privy can sign outside your session. We only relay transactions that are already signed. The one exception is the Bot's former trading wallet, which we are closing down; Section 3.5 explains it.
2. We do not sell your personal information, and we use no advertising or tracking cookies.
3. Most of what ATH shows is public blockchain data. Wallet addresses, trades, holdings, and profits are visible to anyone on Solana, and they are visible on ATH too. Section 6 explains what that means for you.
4. We do not ask for identity documents. Because we do not hold your funds, the law does not require us to verify your identity today. We may screen Wallet addresses and IP addresses against sanctions lists and block access where the law requires. We may add identity checks if we offer purchases with fiat currency or if the law changes.

1. Definitions

• Account means the record we keep about you once you sign in with a Wallet or with Google or Apple.
• AI Assistant means Peak, the former assistant that answered questions about tokens and wallets using our data and a model provided by Anthropic. We closed it in October 2026.
• Bot means the former ATH Telegram bot that sent alerts. We closed it in October 2026.
• Embedded Wallet means the non-custodial Solana wallet that Privy creates for you when you sign in with Google or Apple. Privy splits the private key into fragments (Shamir secret sharing) and signs inside secure enclaves, only when you act under your signed-in session. Neither we nor Privy can sign for you. You can export the private key from Privy at any time. We never see it.
• External Wallet means a Solana wallet you control in third-party software, which you could connect until October 22, 2026, where you approve and sign every transaction yourself.
• Market Archive means the record of On-Chain Data that we have kept continuously since June 2026: every trade of every token on the Service, with holders, prices, candles, and liquidity.
• On-Chain Data means information recorded on the public Solana blockchain, including transactions, balances, token holders, and prices, and everything we compute from them.
• Personal Information means information that identifies you or can reasonably be linked to you or your household. Some laws call it "personal data".
• Plan means a paid membership that we sold until October 2026. We no longer sell Plans, and the Service is free.
• Third-Party Service means a company whose software or infrastructure we use to run the Service. They are listed in Section 7.
• Wallet means an External Wallet or an Embedded Wallet, identified by its public address.
• Wallet Label means an automated estimate (sniper, bundler, insider, or developer wallet) that we compute from patterns in On-Chain Data.
• You means any person who uses the Service.

2. What ATH does

ATH is a social trading and token analytics platform for the Solana blockchain. Other chains may be added later. The Service offers:

• a live feed of tokens with price, market capitalization, liquidity, and charts;
• a page for each token with every trade in the Market Archive, plus holders, candles, and security signals (snipers, bundlers, insiders, developer wallet movements, and a risk indicator);
• trader profiles with open and closed positions, swaps, followers, and following;
• a community with posts, comments, reactions, views, tips in SOL between users, and notifications;
• public rankings (Top profit, Performers, and community leaderboards);
• token swaps routed by the DFlow aggregator;
• transfers of SOL or tokens from your Wallet to another user's Wallet; and
• a referral program.

The Service is free. We no longer sell paid Plans; Section 3.4 explains what we keep from when we did. If we offer an API in the future, Section 7.6 applies to it.

ATH never holds, controls, or transmits crypto assets for you. We are not an exchange, a broker, a money transmitter, or an adviser. Knowing these features makes it easier to see what we collect and why.

3. Information we collect

We have tried to list everything we collect. If we start collecting something new, we update this policy before we do.

3.1 Information you give us

• Profile details: username, bio, profile photo, cover image, and your X and Instagram usernames, if you add them.
• Content you publish: posts (including images you attach), comments, and reactions. We remove metadata, including any location data, from every image you upload.
• Tips you send: the amount, the recipient, and the Solana transaction signature of each tip. The tip itself is a transaction you sign from your own Wallet.
• Views: which posts you open, so we can count views.
• Favorites, follows, and settings: tokens you favorite, users you follow, saved filters, watched wallets, and alert settings.
• Requests to the AI Assistant, while it ran: the token, wallet, or ranking you asked about; the text you typed when you asked a question or used the natural-language search; and how many requests you made each day, so we could apply daily limits.
• Referral information: the referral code you used when you joined and the referral code you share.
• Support messages: anything you send to [email protected].
• In the Bot, while it ran: the email address and phone number the Bot asked for when you started it. Section 3.5 explains what we used them for.

3.2 Information from your Wallet and your sign-in provider

• External Wallet: the public address of the Wallet you connect, the message you sign in your Wallet to prove you control it when you sign in, and the transactions you sign through the Service.
• Google or Apple sign-in through Privy: a Privy user identifier; the email address and name that Google or Apple share with us when you sign in (if you use Apple's "Hide My Email", we receive the relay address instead); and the public address of the Embedded Wallet that Privy creates for you. Never the private key. We use the email address to identify your Account and to email you. We use the name only to to show a display name on your profile until you choose a username, and to address you in emails.
• Session token: a token that keeps you signed in, stored in your browser.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use the name and email address that Google or Apple give us only to create and operate your Account. We do not share them with third parties except the service providers in Section 7.1.

3.3 Information from the Solana blockchain

• Market Archive: since June 2026 we record, continuously, every trade of every token that appears on the Service, together with holders, prices, candles, and liquidity. This archive includes the public wallet addresses that appear in those trades, whether or not their owners use ATH. We use it to compute security signals, positions, profits, rankings, and Wallet Labels.
• Your connected Wallet: the public transaction history and current holdings of the Wallet you connect. We read them from the blockchain through Helius to build your history and your open and closed positions.
• Hourly value snapshot: once an hour, the total value of your connected Wallet, used to draw the chart on your profile.

A Wallet address by itself does not name anyone. We treat a Wallet address as personal information when it is linked to an Account or when we otherwise know it belongs to an identifiable person. Wallet Labels, positions, and rankings are computed from on-chain patterns, not from anyone's identity.

3.4 Former Plans, referrals, and API access

We no longer sell Plans or accept payments for them. If you bought a Plan before we stopped selling them, we keep:

• Plan details: your Plan, its term, start and end dates, and status.
• Card payments through Stripe: the Stripe checkout session identifier, the Stripe customer identifier, and the payment status. Card details were entered on pages hosted by Stripe. We never received or stored card numbers.
• Payments in SOL: the transaction signature and the sending Wallet address of the transfer you made to our collection Wallet, which we verified on the blockchain.

We also keep:

• Referral records: which Accounts joined with your code and which of them became active.
• API access: if we make an API available to you in the future, your API key and a log of your API requests.

3.5 Information from the Bot

We closed the Bot in October 2026. It no longer sends messages or collects anything new. While it ran, it collected:

• your Telegram chat identifier, Telegram username, and Telegram display name;
• the alerts you subscribed to;
• your email address and phone number, which the Bot asked for when you started it and which we used only to the alerts and account notices you asked the bot for; and
• if you used the Bot before September 9, 2026: at that time the Bot created a Solana wallet for you and stored its private key so it could trade on your instructions, and it kept records of its former paid membership and referral program (plan, dates, referral code, and rewards). Telegram trading is closed. On October 6, 2026 we permanently deleted every stored key from our live systems. Our rolling backups that still contained them expire within 15 days; the only remaining copies sit in offline long-term archives that are never used to run the Service. If you ever shared a private key with the Bot, treat that wallet as exposed and move your funds to a new wallet.

3.6 Information collected automatically

• Server logs: your IP address, browser user agent, timestamps, the request you made, and error records, kept by our servers and by Cloudflare, which sits in front of them.
• Bot protection: Cloudflare Turnstile runs in your browser during sign-in, and may run before other sensitive actions, to tell people from scripts. Cloudflare may also challenge suspicious requests before they reach our servers. We receive only whether the request was allowed.
• Usage analytics: page views, referring page, browser type, and approximate country derived from the IP address, collected by Cloudflare Web Analytics. It uses no cookies and does not follow you across other websites.
• View counter: to count each view of a post once per day, your browser generates a random identifier that we store with the post you viewed. It is not linked to your name, email address, or Wallet unless you are signed in, and we do not use it for advertising.
• Notification records: activity that concerns you, such as a comment on your post or a new follower, so we can show you notifications.

3.7 Information stored in your browser

We store the following in your browser's local storage: your language; the state of the menu; whether balances are blurred on your screen; your currency and chart display settings; your swap settings (mode and slippage); the address and type of the Wallet you last connected; the reactions you gave to tokens; the referral code from the link you arrived through; the random identifier used to count post views; and your session token. Privy's software also stores data in your browser to keep you signed in and to operate the Embedded Wallet. See Section 8.

3.8 What we do not collect

• private keys, seed phrases, or recovery phrases for any Wallet you use with the Service (the only exception is the Bot's former trading wallet described in Section 3.5, which we are deleting), and never give them to anyone who claims to be us;
• card numbers, CVV codes, or bank account numbers;
• government identification documents;
• precise geolocation;
• biometric information;
• your contacts or address book; and
• advertising identifiers or cross-site tracking cookies.

3.9 Account clean-up records

• Dust burns: each balance burned for you under Section 6.7 of our Terms of Service: the token, the amount, its estimated value, the rent returned, the transaction signature, and whether it was a position you had bought. This record also helps you with your taxes, because burning a token you bought may count as disposing of it.
• Your dust-burning choice: whether you turned "Burn dust automatically" on or off in Settings, when, which version of the Terms you agreed to, and when we showed you the notice about it.

4. Where the information comes from

5. Why we use information

We do not use your personal information for advertising. We do not build advertising profiles. We do not sell it.

In Canada, we rely on your consent, express or implied depending on the sensitivity of the information and your reasonable expectations, and on the specific exceptions in PIPEDA (section 7) and Quebec's Act (for example, investigating fraud or complying with a legal requirement). Where this table says "to protect the Service" or "to improve the Service", it describes our reason; it is not a separate legal basis in Canada. Section 18.2 explains how we ask for consent.

6. Information that is public by nature

The Solana blockchain is a public ledger. Anyone can read every transaction of every wallet, forever. ATH reads that ledger and makes it easier to understand. Assume that the following is public, on ATH and elsewhere:

• Your Wallet address and its full transaction history, including every swap, tip, and transfer, the tokens you hold, and your open and closed positions and profit or loss.
• Your profile: username, bio, photo, cover image, social usernames, followers, following, the Wallet address linked to your profile, the wallet value chart, and any badge shown next to your username.
• Your posts, comments, reactions, and the tips you send or receive. Reactions show who reacted. View counts are shown; the list of who viewed a post is not.
• Rankings and leaderboards that include your Wallet address or username.
• Wallet Labels (sniper, bundler, insider, developer wallet) that we compute from public on-chain behavior. Labels are automated estimates based on patterns in On-Chain Data. They are not statements of fact about any person, and they can be wrong. If you believe a label on a Wallet linked to your Account is inaccurate, ask us to review it (Section 15). A person will check it and will correct or remove it if the review supports you.

What this means for you:

• Linking a username, photo, or social account to a Wallet connects your identity to that Wallet's entire public history, past and future. Anyone can see it. Think about this before you connect a Wallet you use for other purposes.
• When you tip or transfer to another user, that user, and everyone else, can see your Wallet address.
• Nothing can be removed from the blockchain, by us or by anyone. Deleting your ATH Account removes your profile and unlinks your username from your Wallet. The Wallet's on-chain activity stays on the blockchain and in the Market Archive, just as it stays on any block explorer, but it is no longer linked to your name, email address, or profile (Section 3.3).
• Favorites, saved filters, watched wallets, alert settings, and your dust-burning choice are not shown on your public profile, and neither were AI Assistant requests.

7. Who we share information with

We share personal information only in the ways described here. We do not sell it and we do not rent it.

7.1 Third-Party Services

These companies process information for us, or receive it when the Service uses their software. Each has its own privacy policy. We bind each provider that processes information on our behalf by a written agreement that limits it to providing its service to us, requires it to protect the information and tell us about security incidents, and requires it to return or destroy the information when the agreement ends, as PIPEDA, Quebec's Act, and the CCPA require.

If we ever offer purchases with fiat currency through a third party (such as Crossmint or MoonPay), that provider would collect its own information under its own policy, which may include identity verification. We would update this policy before offering it.

7.2 Other users and the public

Everything described in Section 6 is visible to other users and to anyone who visits the Service.

7.3 Legal reasons

We disclose information when we believe in good faith that we must. That includes: complying with a law, regulation, subpoena, court order, or lawful request from a public authority; complying with sanctions rules, including those administered by OFAC and, in Canada, the Special Economic Measures Act, the United Nations Act, the Justice for Victims of Corrupt Foreign Officials Act, and the Criminal Code; enforcing our Terms of Service; detecting or preventing fraud, abuse, or security problems; and protecting the rights, property, or safety of ATH, our users, or others.

7.4 Business transfers

If ATH is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. Before any such transaction, the other party agrees in writing to use the information only for the transaction, to protect it, and to return or destroy it if the transaction does not go through. If the transaction completes, we notify you within a reasonable time that your information was transferred and to whom. The recipient must honor this policy for the information transferred, and we will tell you before your information becomes subject to a different policy.

7.5 With your direction or consent

We share information when you ask us to or when you agree to it.

7.6 Aggregated information and the API

We may share statistics that cannot reasonably be linked to you, such as the number of swaps on the Service in a day.

If we offer an API, it will return the same On-Chain Data and computed statistics shown publicly on the Service. It will never include Account information (names, email addresses, or profile details). We treat this data as publicly available blockchain information, not as a sale of personal information.

8. Cookies, local storage, and analytics

• No advertising or tracking cookies. We do not use ad networks, tracking pixels, or cross-site tracking.
• Local storage. We keep the items listed in Section 3.7 in your browser's local storage: language, menu state, balance blur, currency and chart display settings, swap settings, the address and type of the Wallet you last connected, your token reactions, the referral code you arrived with, the view-counter identifier, and your session token. Privy's software also stores data in your browser to keep you signed in and to operate the Embedded Wallet. You can clear local storage in your browser settings; doing so signs you out.
• Cloudflare. Cloudflare may set strictly necessary cookies on our domain for security and bot protection. Cloudflare Web Analytics uses no cookies and does not fingerprint your device.
• Turnstile. Cloudflare Turnstile checks that a request comes from a person rather than a script. It runs in your browser during sign-in and may run before other sensitive actions.

Because we use no tracking cookies, we do not show a cookie banner.

9. Emails, former Telegram messages, and anti-spam law

• Transactional emails. We use SendGrid to send emails about your Account, payments, security, and important changes to the Service. Transactional emails never contain marketing. You cannot opt out of them while you have an Account, because they are part of the Service.
• Marketing emails. We send marketing emails only if you expressly opt in. Every marketing email identifies ATH, includes our physical mailing address, and includes an unsubscribe link that works for at least 60 days. We honor unsubscribe requests within 10 business days, as Canada's Anti-Spam Legislation (CASL) requires, and we keep a record of your consent.
• No SMS or calls. We do not send SMS messages or place calls. If we ever do, we will ask for your express written consent first.
• Telegram alerts. We closed the Bot in October 2026, and it no longer sends alerts or any other message. To erase the data the Bot collected, email [email protected].
• In-app notifications. We show notifications inside the Service about activity related to you.

10. How long we keep information

We keep information longer when a law requires it, when we need it for a legal claim or investigation, or to enforce our Terms of Service.

11. Security

We protect your information with measures that include:

• encryption in transit (TLS) for all traffic to the Service, with Cloudflare in front of our servers;
• no custody of private keys (apart from the legacy Bot wallets we are deleting, Section 3.5), no storage of card numbers, and no identity documents, so there is less to steal;
• key fragmentation and secure enclaves for Embedded Wallets, operated by Privy and usable only under your session;
• session tokens that expire, and bot checks to keep automated traffic out;
• encrypted backups; and
• access to production systems limited to the people who need it.

Your part matters as much as ours. Guard your External Wallet, any private key you export from Privy, and the Google or Apple account you sign in with. We will never ask you for a seed phrase, a private key, or a password. Anyone who does is not us.

No system is completely secure. If we learn of a security incident that affects your personal information, we will notify you and the authorities as the law requires (Section 18.8 for Canada).

12. Age requirement

The Service is for adults. You must be at least 18 years old to use it. We do not knowingly collect personal information from anyone under 18, and never from children under 13 (under 14 in Quebec). If you believe a person under 18 has an Account, email [email protected] and we will delete the Account and its information.

13. Where information is stored and international transfers

Our servers are in our own infrastructure and that of our providers, which may be located outside your country, including in the United States. Our Third-Party Services process information in the United States and, in some cases, in other countries where they operate (for example, Cloudflare's global network).

If you use the Service from Canada or from any other country, your information is transferred to and stored in our own infrastructure and that of our providers, which may be located outside your country, including in the United States and in the United States, where privacy laws may differ from those of your country, and where it may be accessible to local courts and authorities under local law. Section 18.5 has more detail for residents of Canada, Quebec, and Alberta.

14. Your choices

• Disconnect or unlink your Wallet. You can disconnect an External Wallet at any time from your Wallet software or from the Service, and you can unlink a Wallet from your profile.
• Edit your profile. You can change your username, bio, photo, cover image, and social usernames at any time.
• Undo reactions and favorites. You can remove any reaction, favorite, or follow.
• Delete your posts and comments. Email [email protected] with a link to the post or comment; we delete it within 30 days.
• Delete your Account. Email [email protected] from the email address on your Account. If your Account has no email address (you signed in with an External Wallet only), we will ask you to prove control of that Wallet. We delete your Account within 30 days, subject to Section 10, and we instruct the service providers that hold your information to delete it too. Your on-chain activity remains on the blockchain and in the Market Archive, unlinked from your identity (Section 6).
• Export your data. Ask us for a copy of the personal information we hold about you in a structured, machine-readable format.
• Export your Embedded Wallet key. You can export the private key from Privy at any time and use the Wallet anywhere.
• Erase Bot data. The Bot is closed and sends nothing. To erase the data it collected, email us (Section 9).
• Dust burning. Turn "Burn dust automatically" off or on at any time in Settings → Wallet (Terms, Section 6.7).
• Unsubscribe from marketing emails. Use the link in any marketing email.
• Dispute a Wallet Label or statistic. Ask us to review it (Section 6).
• Clear browser storage. Clear local storage in your browser to remove preferences and sign out.
• Send a Global Privacy Control signal. See Section 19.

15. Your privacy rights

Whoever you are and wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• tell you which categories of our staff have access to your information and how long we keep it;
• correct information that is inaccurate, including trading statistics and Wallet Labels linked to your Account;
• delete your personal information;
• give you your information in a portable format;
• stop using your information for a purpose you consented to (withdraw consent); and
• explain a decision we made about your request.

To exercise any right, email [email protected] or write to ATH, Miami, FL 33178. Tell us what you want and which Account (username, Wallet address, or email address) the request concerns.

Verification. We must make sure the request comes from you. We may ask you to sign in, to write from the email address on your Account, or to prove control of the Wallet linked to the Account. We never ask for private keys or seed phrases to verify a request.

Timing and cost. We confirm that we received your request within 10 business days. We respond within 30 days for residents of Canada and within 45 days for residents of the United States, and we tell you if the law allows us more time and we need it. Requests are free, unless they are clearly excessive or repetitive, in which case we may charge a reasonable fee or decline, as the law permits. For residents of Canada, Section 18.4 prevails.

Limits. We may keep information that we need to complete a transaction, comply with a law, resolve a dispute, or protect the Service, and we cannot remove anything from the blockchain. We do not delete the Market Archive on request; deleting your Account unlinks your identity from it. Under California law, the public blockchain data in the Market Archive is publicly available information (Section 16.3). Under Canadian law we do not rely on that exception; Section 18.10 explains why we keep the Market Archive.

No discrimination. We will not treat you differently for exercising your rights.

Authorized agents. Someone else can make a request for you if they show us written permission from you and we can verify your identity.

16. California residents

This section applies to California residents and adds to the rest of this policy. It is our notice at collection under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). We link to this section wherever we collect personal information from you.

16.1 Categories of personal information

In the 12 months before the Last updated date we collected the following categories, as the CCPA lists them:

The sources of each category are in Section 4, the purposes in Section 5, and the retention periods in Section 10.

The only sensitive personal information we handle is your account log-in credentials, which we use only to sign you in and keep your Account secure. Because of that limited use, the right to limit does not apply.

16.2 Sale and sharing

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the 12 months before the Last updated date. We do not sell or share the personal information of anyone under 16. We disclose personal information to service providers and contractors only for the business purposes in Section 5, under contracts that limit what they can do with it.

We also disclose personal information to third parties that are not our service providers when you use their services through ATH: DFlow (swaps), the Solana network and RPC nodes, Telegram (while the Bot ran), Google and Apple (sign-in), and the public (Section 6). Those disclosures happen at your direction or are required to provide what you asked for, and they are not sales.

Our referral program offers no reward today. Any reward we add will be for inviting other people, not a payment for your personal information, and we do not offer financial incentives in exchange for personal information.

16.3 Your rights

You have the right to:

• know what personal information we collect, use, disclose, and the categories of sources and recipients, and to receive the specific pieces we hold about you;
• delete your personal information, subject to the exceptions in the CCPA (for example, to complete a transaction, keep the Service secure, comply with a law, or use information internally in ways you would reasonably expect). Under California law, public blockchain data in our Market Archive is publicly available information and is not deleted;
• correct inaccurate personal information, including trading statistics and Wallet Labels linked to your Account;
• opt out of sale or sharing (we do neither);
• limit the use of sensitive personal information (we use log-in credentials only to secure your Account, so this right does not apply); and
• not be discriminated against for exercising these rights.

You may ask for the specific pieces of personal information we hold twice in any 12-month period, free of charge. Requests to delete or correct are not limited. Use the contact methods in Section 15. We verify requests as Section 15 describes. If you use an authorized agent, we need the agent's written permission from you and we may still verify your identity directly.

16.4 "Shine the Light"

California Civil Code § 1798.83 lets you ask which personal information we shared with third parties for their own direct marketing. We share none.

17. Residents of other U.S. states

If you live in a state with a comprehensive privacy law (for example, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Jersey, New Hampshire, Nebraska, Iowa, Tennessee, Minnesota, Maryland, Indiana, Kentucky, or Rhode Island), you may have the right to:

• confirm whether we process your personal information and access it;
• correct inaccuracies;
• delete personal information you gave us or that we obtained about you;
• obtain a portable copy; and
• opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects.

We do not engage in targeted advertising, we do not sell personal information, and we do not profile you for decisions with legal or similarly significant effects.

If you live in Oregon, Minnesota, or Delaware, you can also ask for the list of the specific third parties to which we have disclosed your personal information; it is the list in Section 7.1. Minnesota residents can also ask us to explain the wallet statistics and labels linked to their Account and to review them (Section 6).

Use the contact methods in Section 15. We respond within 45 days and can extend once by 45 days when reasonably necessary, in which case we tell you. If we deny your request, you can appeal by replying to our decision with the word "Appeal". We answer appeals within 45 days (60 days where the law allows). If we deny the appeal, we give you a way to contact your state attorney general.

Nevada residents: we do not sell personal information as defined by Nevada law.

18. Canada: PIPEDA and Quebec's Law 25

This section applies if you live in Canada. It adds to the rest of this policy and prevails over it where the two differ.

18.1 Laws that apply

We handle personal information of people in Canada under the Personal Information Protection and Electronic Documents Act (PIPEDA), and, where they apply, provincial laws including Quebec's Act respecting the protection of personal information in the private sector as modernized by Law 25, and the Personal Information Protection Acts of Alberta and British Columbia.

18.2 Consent

We collect, use, and disclose personal information with your consent, except where the law allows or requires otherwise (for example, to investigate fraud or comply with a legal order). We ask for consent in three ways:

• Information necessary to provide the Service. We collect it because the Service cannot work without it. We tell you what we collect and why at the moment of collection, with a link to the relevant section of this policy, and we tell you that your information is stored outside Canada. You may withdraw this consent by closing your Account.
• Optional purposes. For marketing emails, the email address and phone number you gave the Bot while it ran, and any new purpose, we ask for your express consent separately, in plain language, and you can say no without losing the Service. If we want to use your information for a new purpose, we ask again.
• Financial information. A Wallet linked to your profile reveals financial information: your full trading history, holdings, profit and loss, and the value of your Wallet over time. We ask for your express consent before we link them and before we publish the value chart. You can unlink the Wallet at any time (Section 14).

Accepting this policy or the Terms of Service is not, by itself, how we obtain your consent. You can withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice, by using the choices in Section 14. Withdrawing consent may mean we can no longer provide some or all of the Service. Withdrawal does not affect public On-Chain Data.

18.3 Person in charge of the protection of personal information

our Privacy Officer at [email protected] is responsible for our compliance with Canadian privacy law and is our person in charge of the protection of personal information under Quebec law. Contact: [email protected], or by mail at ATH, Miami, FL 33178.

18.4 Access, correction, and portability

You can ask to see the personal information we hold about you, learn how we use it, which categories of our staff can access it, how long we keep it, and to whom we have disclosed it, and have it corrected. Quebec residents can also ask to receive the computerized personal information they gave us in a structured, commonly used technological format, or to have it communicated to another person or body authorized by law to collect it. We answer within 30 days. If we refuse a request in whole or in part, we tell you why and how to challenge the decision.

For Canadian residents, this section prevails over Section 15: requests are free, except a reasonable charge for transcribing or transmitting large records, which we tell you about in advance.

18.5 Storage outside Canada and outside Quebec

Your personal information is stored and processed in our own infrastructure and that of our providers, which may be located outside your country, including in the United States, and our Third-Party Services process it in the United States and other countries. It is subject to the laws of those countries and may be accessible to their courts, law enforcement, and national security authorities. We communicate personal information outside Quebec only after a privacy impact assessment concludes that it will receive adequate protection, and under a written agreement with the recipient that reflects that assessment. If you live in Alberta, our Privacy Officer at [email protected] can answer your questions about how our service providers outside Canada collect, use, disclose, or store your personal information on our behalf.

18.6 Automated decisions, identification technologies, and privacy by default

Automated decisions. Some decisions are automated: bot-check blocks, blocks based on your IP address or Wallet address under sanctions or geographic rules, cancellation of referral rewards for abuse, removal from rankings for manipulation, and the account clean-up described in Section 6.7 of our Terms of Service, which decides from your holdings and market data which empty token accounts to close and, unless you turned dust burning off, which low-value balances to burn. If an automated decision affects you significantly, we tell you at the time. You can ask us for the personal information we used, the reasons and the main factors behind the decision, have that information corrected, and submit your observations to a person at ATH who can review and change the decision.

Wallet Labels and statistics. We compute trading statistics and Wallet Labels from public On-Chain Data and show them by default (Section 6). We do not use them to make decisions with legal or similarly significant effects on you, and you can dispute them; a person reviews every dispute.

Technologies that can identify or locate you. These are: the session token and Privy's sign-in data (activated when you choose to sign in); the random view-counter identifier (Section 3.6); Cloudflare's security checks and Turnstile (necessary to protect the Service); and the approximate country that Cloudflare derives from your IP address (used for analytics and to enforce sanctions and geographic restrictions). We do not use precise geolocation, and we do not run profiling technology on your device. Sections 3.6 and 8 describe these tools.

Privacy by default. Where the Service offers a privacy setting, the most protective option is on by default; you choose whether to relax it.

18.7 De-indexing and cessation of dissemination (Quebec)

If you live in Quebec, you can ask us to stop disseminating personal information about you, to de-index a hyperlink to it, or to re-index it. This includes information we display about you on the Service, such as rankings and Wallet Labels shown next to your username. The right applies where dissemination contravenes the law or a court order, or where it causes you serious injury that clearly outweighs the public interest and freedom of expression. It does not extend to the blockchain itself, which we do not control. We answer within 30 days. If we refuse, we tell you why in writing and how to apply to the Commission d'accès à l'information within 30 days to review our decision.

18.8 Privacy incidents

We record every privacy incident, whatever its severity, and keep the record for at least five years. When an incident presents a real risk of significant harm, we notify the Office of the Privacy Commissioner of Canada and the affected people as soon as feasible, and any other organization or public body that can reduce the harm. In Quebec, we notify the Commission d'accès à l'information and the affected people with diligence when the incident presents a risk of serious injury.

18.9 Complaints

If you have a concern about how we handle your personal information, write to our person in charge first. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec, or to the privacy commissioner of your province.

18.10 The Market Archive under Canadian law

Under Canadian law, blockchain data is not "publicly available information" in the legal sense, so we do not rely on that exception. We keep the Market Archive because the Service's historical analytics, security signals, and rankings depend on it, an ongoing purpose under Section 5. A Wallet address by itself does not name anyone (Section 3.3), and no Wallet address in the Market Archive is linked to a name, email address, or profile once you delete your Account. Quebec residents can still ask us to stop displaying information about them under Section 18.7.

19. Global Privacy Control and Do Not Track

Global Privacy Control (GPC). Some browsers can send a GPC signal to tell websites not to sell or share your personal information. We treat a GPC signal as a valid opt-out of sale and sharing under California, Colorado, Connecticut, and similar laws. Because we never sell or share personal information for advertising, the signal does not change how the Service works, but we honor it.

Do Not Track (DNT). There is no accepted standard for how websites should respond to DNT signals, so we do not change our behavior when we receive one. We do not track you across third-party websites in any case.

20. Links and third-party websites

The Service links to external sites and services, such as block explorers, token websites, and Privy. Their privacy practices are their own. Read their policies before you give them information.

21. Changes to this policy

We may update this policy as the Service and the law change. When we do, we post the new version at ath.trade and update the Last updated date. If a change is material, we tell you before it takes effect by email, by a notice in the Service, or both.

We will not use personal information we already collected in a way that is materially different from what this policy said when we collected it, unless you expressly agree first.

If you keep using the Service after the effective date, you accept the updated policy. Where the law requires your express consent, we ask for it first. Continued use never counts as consent to a new purpose for your personal information.

This policy is available in English, Spanish, and French. If you live in Quebec, the French version binds you, unless you received the French version and expressly asked to be bound by the English one. Elsewhere, if a translation and the English version differ, the English version controls, except where the law of your province or state says otherwise.

22. Contact us

Questions, requests, or complaints about privacy:

• Email: [email protected]
• Mail: ATH, Miami, FL 33178
• Person in charge of the protection of personal information (Canada and Quebec): our Privacy Officer at [email protected]

Put "Privacy request" in the subject line so we can route it quickly.