Privacy Policy

Draft for review. Prepared 6 October 2026. This notice is not yet effective. Operator identification, a private privacy-request channel, retention periods and international transfer arrangements must be confirmed before publication.

​

1. Scope and responsibility

This draft describes the Primal terminal and optional account flow. It distinguishes information used for account authentication, public wallet and transaction information, browser preferences, and technical diagnostics. Visiting a third-party website or using an external wallet is also subject to that provider’s own privacy notice. The identity and contact details of the person or organization responsible for Primal’s processing have not been supplied. This draft does not substitute for that information. A final notice must identify that operator and explain how to exercise privacy rights privately.

​

2. Information processed

• Account information: a Privy user identifier and the linked identities returned by your chosen method. Depending on the method, this can include an email address, social-account identifier, basic profile information and a public wallet address.
• Authentication information: verification codes, signatures and session credentials are processed by the authentication flow to verify control of your chosen method. They are not market data and should not be sent to product analytics.
• Wallet and transaction information: public addresses, holdings and public blockchain activity, plus records of transactions initiated through the terminal. Trade history is associated with a public wallet address so it can be retrieved across devices.
• Browser information: settings, presets, watchlists, display preferences and session-related storage used by the application and its providers.
• Technical information: request metadata such as IP address and device or browser information, security and error logs, performance measurements and usage events where enabled.
• Communications: information you choose to provide when contacting the team through a channel made available for that purpose.

Primal’s current external-wallet flow does not request your seed phrase or private key. Do not provide them through a form, chat or support request.

​

3. Authentication and linked accounts

Privy handles account authentication using the enabled methods. Email authentication uses a one-time code, rather than a password stored by Primal. Google supplies the identity information permitted by the requested authorization scopes. Phantom verifies control of an external wallet. Telegram can supply an account identifier and permitted profile information when that method is enabled. Linking another method associates its identity with your existing account. A wallet address that was previously pseudonymous can therefore become associated with an email or social identity. Account authentication does not itself create a public profile containing those linked identities. Read Privy’s Privacy Policy and the notices of any social or wallet provider you choose. Methods shown in a local design preview may still require provider configuration before they work.

​

4. Purposes and proposed legal bases

Account identity and session information are used to provide the account you request, verify access and manage linked methods. Public wallet data supports portfolio views, transaction requests, historical records and market analysis. Preferences support the interface choices you make. Technical information supports availability, security, troubleshooting and product measurement. For a final notice, the operator must confirm the legal basis for each purpose. Proposed bases include performing the account or service agreement for requested functionality, legitimate interests for proportionate security and reliability work, legal obligations where applicable, and consent for optional processing that requires it. These proposed bases are not a completed legal assessment. Creating an account is not blanket consent to analytics, advertising or marketing. Consent, where required, must be specific and withdrawable through an implemented choice.

​

5. Providers and sharing

Authentication involves Privy and the method you select. Hosting, delivery and network security involve infrastructure such as Cloudflare. API and blockchain requests involve the relevant Primal services, RPC or data providers and public networks. External wallets process the connection and signature requests you approve. The codebase includes PostHog for product analytics and Sentry for error and performance diagnostics. Their collection depends on the deployment configuration. The documentation site also includes a PostHog integration. Frontend protections redact sensitive transaction and credential information; the full configuration and processor list must be reviewed before this notice is published. Information may also need to be disclosed to meet a lawful obligation, protect the service or address a security incident, subject to applicable law. Any additional sharing, advertising use or commercial transfer must be identified in the final notice rather than assumed from this draft.

​

6. Cookies, browser storage and analytics

Primal and its authentication or wallet providers use browser storage to maintain sessions and preferences. Clearing that storage can sign you out or reset local settings. It does not erase blockchain activity or records retained by a server or provider. Where enabled, analytics may record page visits, interactions, referral information and technical performance. Error monitoring may process diagnostics about failures. The final cookie and storage inventory must identify each purpose, duration and any required consent control. This draft does not assert that all telemetry is optional, consent-gated or anonymous.

​

7. Retention and deletion

Account information is needed while an account exists, subject to justified security or legal retention. Local preferences remain in the browser until reset or removed. Public transaction history and other server records may have different retention needs. Exact schedules for Primal, authentication records, logs, analytics, backups and deletion requests have not yet been confirmed. A final policy must specify those periods or meaningful criteria and the process for deletion. Signing out or disconnecting a wallet does not delete an account. Deleting an off-chain account cannot remove transactions or addresses from a public blockchain, or information independently retained by third parties.

​

8. International processing and security

Providers may process information outside your country. Before publication, the operator must confirm relevant locations and the safeguards used for restricted international transfers, such as applicable adequacy arrangements or standard contractual clauses. No data-location or transfer guarantee is made in this draft. The application uses authentication and transaction-validation controls, and sensitive fields should be excluded from telemetry. No system is completely secure. Protect your email and wallet, use trusted devices, and reject unexpected signature requests.

​

9. Your rights and choices

Depending on the law that applies, you may have rights to access, correct or erase personal information, restrict or object to processing, receive a portable copy and withdraw consent. These rights can have exceptions, including obligations to retain certain records. You may also complain to the relevant data-protection authority. Primal needs a private, usable request channel and an identity-verification process before this notice takes effect. Do not post personal information, verification codes or identity documents in a public Telegram channel to make a privacy request. No self-service deletion control is represented as available by this draft.

​

10. Children and updates

Primal’s trading and account flows are intended for people with the legal capacity to use them. Any applicable age threshold, verification requirements and process for handling a child’s information must be confirmed before publication. Material changes should be reflected in a dated notice and communicated where required. The current document is a review draft, not a claim that every described policy or operational process has already been finalized.