Privacy Policy

BottomUP, Inc., a Delaware corporation (Corporation Trust Center, 1209 Orange Street, Wilmington, Delaware 19801, USA), is the controller of the personal data described here. "We" and "BottomUP" mean BottomUP, Inc. Our team works from Istanbul, Turkey.

This policy covers Foxy Pro: the website at bottomup.app/foxy-pro, the Foxy Pro apps for iPhone and Android, the Foxy Pro API, the connector for AI assistants and the BottomUP Foxy browser extension (together, the "Service"). Write to us about privacy at info@bottomup.app.

This policy is part of the Terms of Use. If you live in Turkey, the Turkish version of this policy is also our information notice (aydınlatma metni) under Law No. 6698.

• Account data: your email address, the sign-in method you use (Google, Apple or an email code), your account and workspace identifiers, your role, and the language and time zone you use.
• Profile: the answers you give when you start (goals, experience, markets you follow) and your settings, such as chart and notification preferences.
• What you ask Foxy: your messages, the answers, charts and reports, and voice recordings when you use voice on the web (converted to text and not kept as audio).
• Exchange data, when you connect OKX: your API key, secret and passphrase (encrypted), your OKX user ID, the key's permissions, and the balances, positions, orders, fills, deposits, withdrawals and transfers we read from your account. With an OKX Agentic Wallet, the session tokens OKX gives us (encrypted) and wallet addresses.
• Trading activity in Foxy Pro: the traders you subscribe to, your Together, Surf, Paper and protection settings, every copy and decision we make for you, order tickets you confirm, alerts and watch rules.
• Purchases: your plan, token purchases and spending, and the store or payment reference. Card details are handled by Stripe, Apple or Google; we never see your full card number.
• Payout data: the wallet address you give us for rewards, and, for creators and partners, the details needed to pay you and meet tax rules.
• Device and usage data: device type, operating system, app version, push notification tokens, the pages and features you use, errors, and your country (from Cloudflare or a country lookup of your IP address). We keep IP addresses only in hashed form for fraud checks, except in the records of your legal acceptances and in staff security logs.
• Your acceptances: which version of these documents you accepted, when, from which IP address, app and language.
• Attribution: the campaign, link or referral code that brought you to Foxy Pro, and on the phone the AppsFlyer ID and your App Tracking Transparency choice.
• Support and messages: what you write to support or to the Foxy Pro team, reports about creators, and whether our emails were delivered and opened.
• Creators: your public profile, the trades and signals you publish, your results and your earnings.

We do not ask for, and you should not send us, government ID numbers, health data or other sensitive data. We do not run identity checks (KYC); OKX does that for your OKX account.

Mostly from you and your use of the Service. We also receive data from Google or Apple when you sign in with them, from OKX through the connection you authorize (and, if you opened OKX through our link, OKX's referral report on your trading volume, fees and verification date), from Stripe, Apple and Google about purchases and refunds, and from AppsFlyer about the campaign that brought you.

• To provide the Service you asked for (performance of our contract with you): your account, Foxy's answers, reports, charts, alerts, the Marketplace, Together, Surf, Paper, watch rules, the orders you authorize on your exchange account, payments, transactional emails and push notifications.
• To keep the Service safe (legitimate interests, and legal obligations): preventing fraud and abuse of free tokens, protecting accounts and keys, sanctions compliance, investigating misuse and market manipulation, keeping records of your acceptances.
• To improve the Service (legitimate interests): understanding which features work, fixing errors and measuring which campaigns bring people, using data keyed to an account ID rather than your name or email.
• Analytics cookies, the AppsFlyer SDK on iPhone tracking and marketing messages (your consent, which you can withdraw at any time).
• To meet legal duties (legal obligation): tax, accounting, responding to lawful requests from authorities.
• To establish, exercise or defend legal claims (legitimate interests).

Giving us your email is needed to have an account; connecting an exchange is optional and needed only for real trading features. If you do not give us data the Service needs, we cannot provide that part.

Foxy is an AI. To answer you, we send your message, the conversation, your onboarding profile and the account data a question needs (for example your balances or positions when you ask about them) to Anthropic (Claude models). Voice on the web uses Deepgram, ElevenLabs or OpenAI to turn speech into text and text into speech. These providers process the data in the United States as our service providers.

Under their business terms these providers do not use our data to train their models, and keep it only for a limited time (generally up to 30 days) for safety and abuse monitoring. We never send your exchange keys, passwords or payment details to an AI provider.

We keep your conversations in your account so you can return to them. You can delete a conversation at any time; deleting your account deletes all of them.

Some features decide by themselves, because that is what you turn them on for: Together and Surf copy trades and size them by fixed rules, Foxy Shield may block or reduce a copy it rates risky, Foxy Tracing may move or close a copy, and the free token gift is limited per device and network to stop abuse. These decisions use market data, the trader's signal, your settings and balances.

You choose whether to use these features and can switch them off at any time. If you think an automated decision about you was wrong, write to info@bottomup.app and a person will review it.

We never sell your personal data, and we do not share it for other companies' advertising, except that campaign attribution on the phone (AppsFlyer) can tell an ad network that an install came from its campaign, only if you allow tracking.

• OKX, the exchange you connect: we send the requests you authorize (reading your account, placing and managing orders). Our orders carry BottomUP's broker code, and OKX reports to us the fees and rebates from trading through Foxy Pro.
• Service providers that run the Service for us: Render (hosting and database, Frankfurt, Germany), Hetzner (servers in Germany and Singapore, including the fixed address our OKX traffic leaves from), Cloudflare (network, security, bot checks), Google Firebase (sign-in and push), Apple and Google (app distribution, in-app purchases, push), Stripe (card and stablecoin payments), Resend (email), Anthropic, OpenAI, Deepgram and ElevenLabs (AI), PostHog and Google Analytics (product analytics, only after consent on our public pages), AppsFlyer (attribution), Sentry (error reports, with personal data removed).
• Creators you subscribe to see how many subscribers they have and their totals; they do not see your name, email or account.
• Partners and resellers: if you joined through a partner's link or code, the partner may see that you joined and your purchases, to calculate their commission.
• Authorities, when the law requires it, or to protect the rights and safety of users, BottomUP or others.
• A buyer or successor, if BottomUP is merged, sold or reorganized, under the same protections.

BottomUP is a US company and our providers are in the United States, the European Union and elsewhere. Our database is in Germany. Data about you may be processed in the United States, the EU, Turkey (where our team works), Singapore and other countries.

When we move personal data out of the EU, UK, Turkey, Brazil or another country with transfer rules, we use the safeguards the law provides: the EU-US Data Privacy Framework where the recipient is certified, the European Commission's Standard Contractual Clauses (and the UK addendum), the standard contracts approved by the Turkish Personal Data Protection Authority, or the equivalent instruments of other countries. Ask us at info@bottomup.app for a copy of the safeguards.

• Account, profile, settings and conversations: while your account is open. Deleting your account deletes them at once.
• Exchange keys and wallet sessions: until you disconnect or delete your account.
• Trading records (copies, orders, fills, decisions), purchases, token history and earnings: for the life of the account and up to 7 years after, for accounting, tax, disputes and regulatory requests.
• Records of your legal acceptances: for the life of the account and up to 7 years after, as evidence of our agreement.
• Support messages: up to 3 years after the conversation closes.
• Security logs and hashed IP data: up to 24 months.
• Analytics and attribution events: up to 25 months.

When a period ends we delete the data or make it anonymous.

Exchange keys are encrypted with AES-256-GCM and never sent to your browser or app. Foxy Pro refuses keys that can withdraw money, so a stolen key cannot move your funds out of OKX. Traffic is encrypted, access to production systems is limited to staff who need it and is logged. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Depending on where you live, you can ask us to tell you what data we hold and give you a copy (also in a portable format), correct it, delete it, restrict or object to its use (including use based on our legitimate interests), withdraw a consent at any time, and not be subject to a solely automated decision with legal or similarly significant effects without human review.

To use a right, write to info@bottomup.app from the email of your account. We answer within one month (30 days under Turkish law, 45 days under California law), and we may ask you to confirm your identity. You can also delete your account yourself in Settings on the web or More in the app. We do not treat you differently for using your rights.

You can complain to your data protection authority, for example your local EU supervisory authority, the UK Information Commissioner's Office, the Turkish Personal Data Protection Authority (KVKK) or Brazil's ANPD. We would be glad to hear from you first.

Turkey: under Article 11 of Law No. 6698 you may learn whether your data is processed, request information, learn the purpose and whether it is used accordingly, know the third parties it is transferred to in Turkey or abroad, request correction, deletion or destruction and notice of these to third parties, object to a result against you that arises from analysis solely by automated systems, and claim compensation for damage from unlawful processing.

United States: we do not sell personal data or share it for cross-context behavioural advertising except as described for phone attribution. We honour the Global Privacy Control signal as an opt-out on our website. Our website does not respond to Do Not Track signals other than GPC. We do not disclose personal data to third parties for their own direct marketing (California Civil Code 1798.83).

Delete your account in Settings (web) or More (app). Your Foxy Pro conversations, profile, settings, push devices, support threads, wallet sessions and stored exchange keys are deleted at once; no automated feature can trade on your exchange account after that, and positions already open on your exchange stay there under your control. We close the shared BottomUP account within 30 days and confirm by email. Unspent tokens are lost.

We keep only what the law or a legitimate need requires, as listed under "How long we keep it". Deleting your account does not cancel an App Store or Google Play subscription; cancel it there.

Our website uses cookies and local storage that are strictly necessary for sign-in, security, language and your cookie choice. Analytics (Google Analytics, PostHog) run on our public pages only after you accept them in the cookie banner, and never inside the signed-in app. You can change your choice at any time from the cookie banner link in the footer or your browser settings.

On iPhone, AppsFlyer uses your device advertising ID only if you allow tracking when the app asks. You can change this in iPhone Settings > Privacy > Tracking. On Android you can reset or delete the advertising ID in Android settings.

We send messages you need to use the Service: sign-in codes, purchase receipts, trade and alert notifications, security and legal notices. We send marketing messages only with your consent, and every marketing email has an unsubscribe link. You can turn notification types on and off in Settings.

Foxy Pro is only for adults aged 18 or older. We do not knowingly collect data from anyone under 18. If we learn an account belongs to someone under 18, we close it and delete its data.

We may update this policy. The effective date and version at the top show the latest one. If a change matters, we tell you in the app and by email before it applies, and where the law requires it we ask for your consent again.

BottomUP, Inc., Corporation Trust Center, 1209 Orange Street, Wilmington, Delaware 19801, USA. Email: info@bottomup.app.