Privacy Policy

BottomUP, Inc., a Delaware corporation (Corporation Trust Center, 1209 Orange Street, Wilmington, Delaware 19801, USA), is the controller of the personal data described here. "We" and "BottomUP" mean BottomUP, Inc. Our team works from Istanbul, Turkey.

This policy covers BottomUP: the website at bottomup.app/console, the BottomUP apps for iPhone and Android, the BottomUP API, the connector for AI assistants and the BottomUP Foxy browser extension (together, the "Service"). Write to us about privacy at info@bottomup.app.

This policy is part of the Terms of Use. If you live in Turkey, the Turkish version of this policy is also our information notice (aydınlatma metni) under Law No. 6698.

• Account data: your email address, the sign-in method you use (Google, Apple or an email code), your account and workspace identifiers, your role, and the language and time zone you use.
• Profile: the answers you give when you start (goals, experience, markets you follow) and your settings, such as chart and notification preferences.
• What you ask Foxy: your messages, the answers, charts and reports, and voice recordings when you use voice on the web (converted to text and not kept as audio).
• Exchange data, when you connect OKX: your API key, secret and passphrase (encrypted), your OKX user ID, the key's permissions, and the balances, positions, orders, fills, deposits, withdrawals and transfers we read from your account. With an OKX Agentic Wallet, the session tokens OKX gives us (encrypted) and wallet addresses.
• Trading activity in BottomUP: the traders you subscribe to, your Together, Surf, Paper and protection settings, every copy and decision we make for you, order tickets you confirm, alerts and watch rules.
• Purchases: your plan, token purchases and spending, and the store or payment reference. Card details are handled by Stripe, Apple or Google; we never see your full card number.
• Payout data: the wallet address you give us for rewards, and, for creators and partners, the details needed to pay you and meet tax rules.
• Device and usage data: device type, operating system, app version, push notification tokens, the pages and features you use, errors, and your country (from Cloudflare or a country lookup of your IP address). We keep IP addresses only in hashed form for fraud checks, except in the records of your legal acceptances and in staff security logs.
• Your acceptances: which version of these documents you accepted, when, from which IP address, app and language.
• Attribution: the campaign, link or referral code that brought you to BottomUP, and on the phone the AppsFlyer ID and your App Tracking Transparency choice.
• Support and messages: what you write to support or to the BottomUP team, reports about creators, and whether our emails were delivered and opened.
• Creators: your public profile, the trades and signals you publish, your results and your earnings.

We do not ask for, and you should not send us, government ID numbers, health data or other sensitive data. We do not run identity checks (KYC); OKX does that for your OKX account.

Mostly from you and your use of the Service. We also receive data from Google or Apple when you sign in with them, from OKX through the connection you authorize (and, if you opened OKX through our link, OKX's referral report on your trading volume, fees and verification date), from Stripe, Apple and Google about purchases and refunds, and from AppsFlyer about the campaign that brought you.

• To provide the Service you asked for (performance of our contract with you): your account, Foxy's answers, reports, charts, alerts, the Marketplace, Together, Surf, Paper, watch rules, the orders you authorize on your exchange account, payments, transactional emails and push notifications.
• To keep the Service safe (legitimate interests, and legal obligations): preventing fraud and abuse of free tokens, protecting accounts and keys, sanctions compliance, investigating misuse and market manipulation, keeping records of your acceptances.
• To improve the Service (legitimate interests): understanding which features work, fixing errors and measuring which campaigns bring people, using data keyed to an account ID rather than your name or email.
• Analytics cookies, the AppsFlyer SDK on iPhone tracking and marketing messages (your consent, which you can withdraw at any time).
• To meet legal duties (legal obligation): tax, accounting, responding to lawful requests from authorities.
• To establish, exercise or defend legal claims (legitimate interests).

Giving us your email is needed to have an account; connecting an exchange is optional and needed only for real trading features. If you do not give us data the Service needs, we cannot provide that part.

Foxy is an AI. To answer you, we send your message, the conversation, your onboarding profile and the account data a question needs (for example your balances or positions when you ask about them) to Anthropic (Claude models). Voice on the web uses Deepgram, ElevenLabs or OpenAI to turn speech into text and text into speech. These providers process the data in the United States as our service providers.

Under their business terms these providers do not use our data to train their models, and keep it only for a limited time (generally up to 30 days) for safety and abuse monitoring. We never send your exchange keys, passwords or payment details to an AI provider.

We keep your conversations in your account so you can return to them. You can delete a conversation at any time; deleting your account deletes all of them.

You can use BottomUP inside an AI assistant through our connector, a Model Context Protocol (MCP) server at foxy-api.bottomup.app/mcp. This section describes everything that flows through the connector.

Connecting. With OAuth sign-in (ChatGPT, Claude and other OAuth clients) you sign in with your BottomUP account; we record the account that authorised the assistant and the assistant's client identifier, and we issue an access token valid for 30 days and a refresh token valid for 180 days, both stored hashed. With an API key (Grok Bot, Cursor, file-configured clients) you create a key on the Connector page and paste it into the assistant; it is stored hashed and tied to your workspace. The only permission is "use BottomUP on my behalf": an assistant cannot change your account, connect an exchange or spend money.

The tools, their inputs and outputs. Every call carries the tool name, the arguments below, your workspace id and the time. Nothing else from your conversation with the assistant reaches us.

• ask_foxy: receives your market question (text, up to 4,000 characters), the detail level, an optional summary id and a language. Returns Foxy's analysis and a link to a page with its charts. The question and answer go to Anthropic to generate the answer and are stored as a Foxy conversation in your workspace. Billed in tokens.
• start_report and get_report: receive the report topic (text, up to 4,000 characters) and later the report id. Return the status and, when finished, the full report. Stored as a Foxy report in your workspace. Billed in tokens.
• options_levels: receives the coin (BTC or ETH). Returns options positioning from public Deribit and OKX market data. No personal data. Billed per call.
• token_balance: receives a number of days. Returns your workspace's token balance and usage. Read-only.
• workspace_usage: receives a number of days. Returns your workspace name, plan and token usage. It does not return exchange balances, positions or orders; those stay in the app. Read-only.
• prepare_order: receives an instrument, side, size and an optional note and returns them as a draft ticket. Nothing is sent to any exchange and the draft is not stored; an order is placed only by you, in the app, after you review it.

Shared answer pages. When an answer has charts we save it as a page with an unguessable link so the assistant can show them. The page holds the question, the answer and the charts, no account data. Anyone with the link can open it; you can revoke it in BottomUP.

Purposes. To answer you and produce your reports (contract); to bill tokens and show your usage (contract); to keep the connector secure, with rate limits, abuse and fraud prevention (legitimate interests); and to see which assistants people use BottomUP from, in aggregate (legitimate interests). Connector data is never used for advertising or sold.

Recipients. The assistant's provider (OpenAI for ChatGPT, Anthropic for Claude, xAI for Grok, Google for Gemini, or the maker of another MCP client) receives what you type and the results we return, under its own privacy policy; we do not control what it shows, stores or trains on. Anthropic generates the answers as our service provider. Our hosting providers (see "Who receives your data") store and transmit the data. Market data providers receive only the instrument or topic, never your identity. Your exchange keys, wallet sessions, passwords, payment details, balances, positions and orders never leave BottomUP.

Retention. Questions, answers and reports: as Foxy conversations and reports while your account is open; you can delete each one, and deleting your account deletes all. Call logs (tool, workspace, time, token cost, outcome, hashed IP): up to 24 months. Token usage history: the life of the account and up to 7 years after, as a billing record. OAuth tokens and API keys: until they expire, you revoke them or you delete your account. Shared answer pages: until you revoke them or delete your account. At the AI provider: up to 30 days.

Your controls. Disconnect by removing BottomUP in the assistant or revoking its key or sign-in on the Connector page. Delete individual conversations and reports in BottomUP, revoke shared pages, or delete your whole account. Every call and its token cost is visible in BottomUP. For a copy of everything we hold, write to info@bottomup.app. What the assistant itself remembers about you is governed by that assistant's settings, not by us.

Some features decide by themselves, because that is what you turn them on for: Together and Surf copy trades and size them by fixed rules, Foxy Shield may block or reduce a copy it rates risky, Foxy Tracing may move or close a copy, and the free token gift is limited per device and network to stop abuse. These decisions use market data, the trader's signal, your settings and balances.

You choose whether to use these features and can switch them off at any time. If you think an automated decision about you was wrong, write to info@bottomup.app and a person will review it.

We never sell your personal data, and we do not share it for other companies' advertising, except that campaign attribution on the phone (AppsFlyer) can tell an ad network that an install came from its campaign, only if you allow tracking.

• OKX, the exchange you connect: we send the requests you authorize (reading your account, placing and managing orders). Our orders carry BottomUP's broker code, and OKX reports to us the fees and rebates from trading through BottomUP.
• Service providers that run the Service for us: Render (hosting and database, Frankfurt, Germany), Hetzner (servers in Germany and Singapore, including the fixed address our OKX traffic leaves from), Cloudflare (network, security, bot checks), Google Firebase (sign-in and push), Apple and Google (app distribution, in-app purchases, push), Stripe (card and stablecoin payments), Resend (email), Anthropic, OpenAI, Deepgram and ElevenLabs (AI), PostHog and Google Analytics (product analytics, only after consent on our public pages), AppsFlyer (attribution), Sentry (error reports, with personal data removed).
• Creators you subscribe to see how many subscribers they have and their totals; they do not see your name, email or account.
• Partners and resellers: if you joined through a partner's link or code, the partner may see that you joined and your purchases, to calculate their commission.
• Authorities, when the law requires it, or to protect the rights and safety of users, BottomUP or others.
• A buyer or successor, if BottomUP is merged, sold or reorganized, under the same protections.

BottomUP is a US company and our providers are in the United States, the European Union and elsewhere. Our database is in Germany. Data about you may be processed in the United States, the EU, Turkey (where our team works), Singapore and other countries.

When we move personal data out of the EU, UK, Turkey, Brazil or another country with transfer rules, we use the safeguards the law provides: the EU-US Data Privacy Framework where the recipient is certified, the European Commission's Standard Contractual Clauses (and the UK addendum), the standard contracts approved by the Turkish Personal Data Protection Authority, or the equivalent instruments of other countries. Ask us at info@bottomup.app for a copy of the safeguards.

• Account, profile, settings and conversations: while your account is open. Deleting your account deletes them at once.
• Exchange keys and wallet sessions: until you disconnect or delete your account.
• Trading records (copies, orders, fills, decisions), purchases, token history and earnings: for the life of the account and up to 7 years after, for accounting, tax, disputes and regulatory requests.
• Records of your legal acceptances: for the life of the account and up to 7 years after, as evidence of our agreement.
• Support messages: up to 3 years after the conversation closes.
• Security logs and hashed IP data: up to 24 months.
• Analytics and attribution events: up to 25 months.

When a period ends we delete the data or make it anonymous.

Exchange keys are encrypted with AES-256-GCM and never sent to your browser or app. BottomUP refuses keys that can withdraw money, so a stolen key cannot move your funds out of OKX. Traffic is encrypted, access to production systems is limited to staff who need it and is logged. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Depending on where you live, you can ask us to tell you what data we hold and give you a copy (also in a portable format), correct it, delete it, restrict or object to its use (including use based on our legitimate interests), withdraw a consent at any time, and not be subject to a solely automated decision with legal or similarly significant effects without human review.

To use a right, write to info@bottomup.app from the email of your account. We answer within one month (30 days under Turkish law, 45 days under California law), and we may ask you to confirm your identity. You can also delete your account yourself in Settings on the web or More in the app. We do not treat you differently for using your rights.

You can complain to your data protection authority, for example your local EU supervisory authority, the UK Information Commissioner's Office, the Turkish Personal Data Protection Authority (KVKK) or Brazil's ANPD. We would be glad to hear from you first.

Turkey: under Article 11 of Law No. 6698 you may learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the third parties it is transferred to in Turkey or abroad, request correction, deletion or destruction and notice of these to third parties, object to a result against you that arises from analysis solely by automated systems, and claim compensation for damage from unlawful processing.

United States: we do not sell personal data or share it for cross-context behavioural advertising except as described for phone attribution. We honour the Global Privacy Control signal as an opt-out on our website. Our website does not respond to Do Not Track signals other than GPC. We do not disclose personal data to third parties for their own direct marketing (California Civil Code 1798.83).

Delete your account in Settings (web) or More (app). Your BottomUP conversations, profile, settings, push devices, support threads, wallet sessions and stored exchange keys are deleted at once; no automated feature can trade on your exchange account after that, and positions already open on your exchange stay there under your control. We close the shared BottomUP account within 30 days and confirm by email. Unspent tokens are lost.

We keep only what the law or a legitimate need requires, as listed under "How long we keep it". Deleting your account does not cancel an App Store or Google Play subscription; cancel it there.

Our website uses cookies and local storage that are strictly necessary for sign-in, security, language and your cookie choice. Analytics (Google Analytics, PostHog) run on our public pages only after you accept them in the cookie banner, and never inside the signed-in app. You can change your choice at any time from the cookie banner link in the footer or your browser settings.

On iPhone, AppsFlyer uses your device advertising ID only if you allow tracking when the app asks. You can change this in iPhone Settings > Privacy > Tracking. On Android you can reset or delete the advertising ID in Android settings.

We send messages you need to use the Service: sign-in codes, purchase receipts, trade and alert notifications, security and legal notices. We send marketing messages only with your consent, and every marketing email has an unsubscribe link. You can turn notification types on and off in Settings.

BottomUP is only for adults aged 18 or older. We do not knowingly collect data from anyone under 18. If we learn an account belongs to someone under 18, we close it and delete its data.

We may update this policy. The effective date and version at the top show the latest one. If a change matters, we tell you in the app and by email before it applies, and where the law requires it we ask for your consent again.

BottomUP, Inc., Corporation Trust Center, 1209 Orange Street, Wilmington, Delaware 19801, USA. Email: info@bottomup.app.