Privacy Policy

Last updated 26 October 2026

This policy covers the Perminal iPhone app, the Perminal web app and this website. It says what we collect, why, who else sees it, and how to have it deleted.

The short version

Perminal is self-custodial: we never hold your money or your keys. Your trades happen on a public blockchain exchange, so they are public by nature. We keep your profile, your posts and a copy of your public trading record to run the app. We do not sell your data, show ads, or track you across other companies' apps and sites. You can delete your account inside the app at any time.

What we collect in the app

Your sign-in. Signing in is handled by Privy (privy.io). With email, Privy keeps your email address and sends you a six-digit code. With Apple or Google, Privy receives the name and email that Apple or Google share (with Apple you can hide your email). Our own server keeps Privy's id for your account, not your email.

Your wallet. At sign-in Privy creates a wallet that only you control. Its keys are kept by Privy's secured key system and on your device; Perminal's server never receives them. We keep your wallet's public addresses, tied to your account, and the deposit addresses made for it.

Your public profile. Your username, and if you add them, a display name, bio, profile picture and banner. Other people can see these.

Your posts and activity. The theses and replies you write, the posts you like, who you follow and who follows you, and the people you block or report. Posts, replies, likes and follows can be seen by other people; blocks and reports cannot.

Your trading record. What your wallet does on the exchange (orders filled, positions, deposits, withdrawals and funding) is public on the blockchain. We copy it to show your results, positions and place on the leaderboards. If you make your profile private, other people no longer see your positions and results in the app.

Notifications. If you allow notifications, the push token Apple gives your phone and the kinds of alerts you chose, so we can tell you about fills, stops, liquidation risk and replies.

Face ID. When the app asks for Face ID, the check happens on your phone, by iOS. We never see your face or your Face ID data.

Error reports. When something fails or the app crashes, it sends us what went wrong, the app and iOS version, and your account's id, so we can fix it.

How the app is used. We use PostHog to count which screens are opened, which actions are taken (for example an order placed or a deposit started), what failed and how long things took, tied to your Perminal account's id, never to your email or wallet address. With them go a random id for the app on your phone, the kind of phone, its iOS and app version, and the rough place (country and city) PostHog reads from your internet address. PostHog also records sessions of the app's screens so we can see where people get stuck: everything you type, your email, your sign-in code, your wallet's address, and every balance, amount, position and profit and loss are hidden in those recordings. To turn both off, open Settings in the app and switch off Share usage data.

Nothing else. The app does not read your contacts, location, microphone or camera. It asks to add a picture to your photo library only when you save a share card, and to read a photo only when you choose one for your profile.

What we collect on this website

Your email, if you join the waitlist, and the time you joined. Your username, if you reserve one, tied to your account so it carries over to the app.

How the site is used, counted without cookies. Vercel Web Analytics counts which pages are visited, where visitors come from (the referring site and country) and what kind of device and browser they use. It sets no cookies; a visit is told apart only by an anonymous code that resets every day.

What we do with it

We use it to run Perminal: to sign you in, show your profile, posts and results, send the alerts you asked for, keep the community safe (acting on reports and blocks), fix bugs and make the app better. We use your waitlist email to tell you when Perminal opens and for occasional news about the launch; every email has a link to unsubscribe.

We do not sell or rent your data, we do not use it for advertising, and we do not share it with data brokers.

Who else sees it

These companies handle data only to provide their part of Perminal:

Privy (sign-in and wallets) · Apple (Sign in with Apple, notifications) · Google (if you continue with Google) · Fly.io (hosts our server) · Supabase (our database and profile pictures) · PostHog (app analytics and error insight) · Vercel (hosts this website and the web app) · Relay and Hyperunit (route deposits and withdrawals between networks to your wallet).

Hyperliquid is the exchange your orders go to. The app signs each order on your phone and sends it straight there; what your wallet does on it is public on the blockchain, for anyone to see. To show prices, charts, team logos and headlines, the app also reads public data from Hyperliquid, ESPN, Nasdaq and news sites. Like any website, those services see your IP address when your phone asks them for data; they do not receive your name or email.

We may share data if the law requires it, or to protect people from fraud or harm.

How long we keep it

We keep your account data for as long as you have an account. Analytics events are kept for up to a year, session recordings for up to a month, and error reports until the error is fixed. We keep your waitlist email until the launch emails are done, or until you ask us to delete it.

Deleting your account

In the app, open Settings and tap Delete account. This deletes everything Perminal keeps about you (your profile, pictures, posts, replies, likes, follows, blocks, reports you made, devices, notifications and our copy of your trading record) and then your account at Privy. After that your wallet can no longer be reached through Perminal, so withdraw your money or export your key first (Settings, Security, Export keys).

What your wallet did on the blockchain stays there: it is public and permanent, and nobody, including us, can delete it.

Children

Perminal is for people aged 18 and over. We do not knowingly collect data from anyone younger; if you think we have, tell us and we will delete it.

Your rights

To see, correct, export or delete what we hold about you, or to object to how we use it, email ops@perminal.com. We answer within 30 days. Where data-protection law such as the GDPR or the UK GDPR applies to you, you also have the right to complain to your local data-protection authority.

Security

Data moves only over encrypted connections, and our database is reachable only by our server. No system is perfectly safe, so keep your phone locked and never share your key.

Changes

If we change this policy, we will update the date at the top of this page, and tell you in the app if the change is important.

Contact

Questions about your data: email ops@perminal.com.