Privacy Policy

Theta Labs Markets, Inc. (“updown”, “we”, “us”) operates the updown website and mobile app (the “Service”). This Privacy Policy explains what personal information we collect when you use the Service, how we use and share it, and the choices you have. We are responsible for your personal information as described here.

Information you give us.

• Account details: your email address or the Google or Apple account you sign in with, your phone number if you provide one, your username, avatar choices, an X handle if you add one, and your profile visibility settings.
• Content you post: takes, GIFs you choose, likes, follows and chat messages.
• Messages to us: your name, email address and message when you use the contact form or email us.

Information created when you use the Service.

• Wallet details: the addresses of the wallets linked to your account and whether you have granted trading permission.
• Trading and payment records: your orders, trades, positions, settlements, deposits, withdrawals, trade credit and rewards.
• Usage information: how you use the Service, such as the pages and screens you view and the features you use.
• Device and log information: your IP address and the approximate location (country) derived from it, browser, device type, operating system, app version, language settings, timestamps and event logs.
• Diagnostics: crash and error reports and performance measurements. If you have accepted analytics in our cookie banner, an error report can include a recording of the page activity that led up to it, with the text you see and type masked so it is never recorded.
• Session recordings: on the website, if you have accepted analytics in our cookie banner, we record how you use the Service, such as the pages you view, where you click and scroll, and what is shown on screen, so we can understand how people use it and improve it. Anything you type into a form field is masked and never recorded. The mobile app does not record your screen: it notes which buttons you tap, by the button’s name, never what is shown on screen or what you type. (Versions of the app before its October 2026 update recorded sessions with all text on screen and your deposit addresses masked.)
• Referral information: the referral link you arrived from, if any.
• Agreement records: when you accepted our Terms of Service, which version, and the IP address and browser you accepted them from; and each time you turn marketing emails on or off, with the wording you saw and the IP address and browser you used.

Information from others. We do not run our own username-and-password login. You sign in through Privy, using your email, Google or Apple. Privy tells us the email address and a stable account identifier for your login, and keeps the session that keeps you signed in. We never receive your Google or Apple password; those providers handle your sign-in under their own terms and privacy policies. Public blockchains record transactions to and from your wallet.

We do not see or store your card details or identity documents. Card, Cash App and exchange deposits, and withdrawals converted to another token or network, are handled by Unifold and the payment partners it connects, who collect that information under their own privacy policies.

We use your information to:

• create and run your account, and provide the Service, including carrying out trades, settlements, deposits and withdrawals;
• check that you are eligible to use the Service, including where you are located, and comply with sanctions and other legal obligations;
• detect, prevent and investigate fraud, market abuse, security incidents and breaches of our Terms, which may include monitoring activity and screening wallet addresses against sanctions lists;
• review trades for errors and irregularities, and keep records of those reviews;
• handle disputes, claims and requests from courts, regulators and law enforcement;
• show your public profile, takes and activity to other users, according to your settings;
• respond to your messages and send you notices about your account and the Service;
• send you marketing emails about new markets, promotions and product updates, only if you opt in;
• understand how the Service is used, fix problems and improve it;
• measure the effectiveness of our advertising, if you allow it;
• run promotions and rewards.

Where the law (such as the GDPR) requires a legal basis for using personal information, we rely on:

• Contract: to provide the Service you ask for.
• Legitimate interests: to secure, run and improve the Service and prevent fraud, balanced against your rights.
• Legal obligation: to comply with the law and lawful requests.
• Consent: for analytics cookies, X’s ad pixel and sharing information with X to measure our ads, and for marketing emails. You can change your cookie choice at any time in Your privacy choices, and your marketing email choice in Settings on the website (in your profile menu) or in the app; this does not affect processing that happened before.
• Vital interests: where needed to protect someone’s safety.

updown is a social trading app. Other users and visitors can see your username, avatar, X handle (if you add one), trading statistics and leaderboard rank, and the takes you post. Your positions and trading activity are also shown on your profile and in the feed unless you hide them in your profile settings.

Your email address and wallet addresses are not shown to other users. However, transactions on public blockchains, including those to and from your wallet, are visible to anyone and cannot be changed or deleted.

Anything public can be viewed, copied or reshared by others, including through third-party services, and we cannot control what they do with it.

We do not sell your personal information for money. We share it only as described here. Sharing with X for advertising may count as “sharing” under some U.S. state laws; see U.S. state privacy rights.

• Service providers that run parts of the Service for us, under contract: Privy (sign-in and wallets), Vercel (hosting), Supabase (database), Sentry (error monitoring), PostHog (product analytics and session recordings), Klipy (GIF search), and our communication tools.
• AI providers that power certain features, such as drawing apparel for your avatar. We send them only what the feature needs, such as your avatar design.
• Payment partners when you choose to deposit by card, Cash App, an exchange or a crypto asset other than a stablecoin, or to withdraw as another token or on another network: Unifold, which converts the deposit and sends it to your wallet, or converts the withdrawal and sends it to the address you enter, and the card, Cash App and exchange providers it connects. We share your account identifier and wallet address with Unifold so it can deliver the deposit or withdrawal; Unifold also receives the withdrawal address you enter, your IP address and device information when you use its deposit or withdrawal window. Privy’s card payment providers may also be used.
• Advertising partners, only if you accept. If you accept advertising cookies in our cookie banner, we use X’s advertising tools to measure our ads. When you sign up, make your first deposit or place your first trade, we send X a hashed version of your email address, which X can match to an X account, together with your IP address, browser type and an ad-click identifier. We never send X how much you deposit or trade. X handles this information under its own privacy policy and may use it for its own purposes. If your browser sends a Global Privacy Control signal, nothing is sent to X even if you accept. If you decline, or use the updown app, nothing is sent to X.
• Blockchain networks. Transactions you make are broadcast to public blockchains.
• Legal and safety. When we believe in good faith that the law requires it, or to protect the rights, property or safety of updown, our users or others.
• People you let in. If you let someone use your account through Team, they can see your positions, balance, orders and activity (not your email), and we record what they do there for you to see. If someone lets you into their account, they can see what you did in it.
• With your consent. When you ask us to share information or agree that we may.
• Business transfers. As part of a merger, acquisition, financing or sale of assets, subject to this Privacy Policy.

We and our partners use cookies, local storage and similar technologies for these purposes:

• Essential: keeping you signed in, remembering preferences such as your theme and watchlist, remembering your cookie choice, and recording which referral link you used. These are always on.
• Analytics, only if you accept: understanding how the Service is used (PostHog), including recordings of your visits to the website with anything you type masked, and masked recordings of the page activity that led up to an error (Sentry). If you decline, we still count visits, but without cookies or local storage, so we cannot recognise you from one visit to the next, and nothing you do is recorded.
• Advertising, only if you accept: X’s pixel, which tells us when someone who clicked one of our ads signs up or trades. If you decline, the pixel is never loaded.

Some cookies are set by us and some by our partners; some last only until you close your browser and others stay until they expire or you delete them.

When you first visit, we ask whether you accept analytics and advertising cookies, and nothing beyond essential cookies is used until you do. You can change your choice at any time with the “Your privacy choices” link at the bottom of the site, or in the menu on phones. You can also block or delete cookies in your browser settings; blocking essential cookies may stop parts of the Service from working.

In the mobile app: the app does not use cookies. It stores an analytics identifier on your device and sends PostHog the screens you view, the actions you take (such as placing a trade, opening a deposit method or sharing a card) and which buttons you tap, by name, linked to your account once you sign in. It does not record your screen. This is on by default. You can turn it off at any time in Settings → Preferences → “Share usage analytics”, which stops all of it. The app never sends this information to advertisers, and nothing is used to track you across other companies’ apps or websites.

We keep your information for as long as your account is open and as needed to provide the Service. After an account is deleted, we keep trading and payment records, in a form no longer linked to your profile, for as long as we need them to meet legal, accounting and tax obligations, resolve disputes and enforce our agreements. Records of security, fraud-prevention and trade reviews are kept for as long as reasonably needed for those purposes. When we no longer need information, we delete or anonymise it. Information recorded on public blockchains cannot be deleted by us or anyone else.

You can delete your account from Edit profile. If your wallet is empty and you have no open positions, your account is deleted straight away: your sign-in and wallet are removed, your profile details (such as your email, phone number and X handle) are erased, and your takes, likes, chat messages and follows are deleted.

If you still have funds or open positions, we will record your request and tell you what to do first (for example, withdraw your balance). You can also ask us to delete your account by emailing hello@updown.fast.

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy of it, object to or restrict how we use it, and withdraw consent you have given. You can also complain to your local data protection authority.

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing, except where needed to comply with the law, such as applying location and sanctions restrictions.

Marketing emails. We send them only if you agree to receive them. When we ask, the box is already ticked and you can untick it before you confirm. You can turn them off at any time in Settings, on the website (in your profile menu) or in the app. Turning them off does not stop messages about your account, such as notices about withdrawals, security or changes to these policies.

Analytics and session recordings. On the website, use “Your privacy choices”. In the mobile app, turn off “Share usage analytics” in Settings → Preferences.

You can change much of your information yourself in Edit profile, including your username, X handle and what your profile shows. To make any other request, email hello@updown.fast. We will verify your identity before acting on a request, and will not treat you differently for making one. You may also have an authorised agent make a request for you; we will ask for proof of their authority. We may decline or limit a request where the law allows, for example where we must keep information for legal, security or dispute-resolution reasons, where it would affect someone else’s privacy, or where it is manifestly unfounded or excessive.

Some U.S. state laws, including California’s, give residents additional rights. The Service is not currently offered in the United States, but this section applies to anyone those laws cover.

• What we collect and why. The categories of personal information we collect, where it comes from, why we use it, who we disclose it to and how long we keep it are described in the sections above.
• No sale for money. We do not sell personal information for money.
• Sharing for advertising. If you accept advertising cookies, X may use the information described under “How we share information” for its own purposes. Under California law this may count as “sharing” for cross-context behavioral advertising, and under other states’ laws as “targeted advertising”. The categories involved are identifiers (a hashed email address, IP address and an ad-click identifier) and internet activity (that you signed up, made your first deposit or placed your first trade). We share them with X only.
• Do Not Sell or Share. You can opt out at any time by choosing “Decline” in “Your privacy choices” (at the bottom of every page, or in the menu on phones), by turning on Global Privacy Control in your browser, or by emailing hello@updown.fast. Opting out never affects your account, prices or access to the Service.
• Sensitive information. We do not use or disclose sensitive personal information to infer characteristics about you.
• Your other rights. You can ask to know, access, correct or delete your personal information as described in “Your rights and choices”. If we decline a request, you can appeal by emailing hello@updown.fast with “Appeal” in the subject line.
• Minors. We do not sell or share personal information of anyone we know to be under 16; the Service is only for people aged 18 or over.

We use industry-standard safeguards designed to protect your information, including encryption in transit, access controls, and monitoring and logging of security events. Your wallet’s private keys are secured by our wallet provider’s infrastructure; we never receive or store them. No system is completely secure, so we cannot guarantee the security of your information. You are responsible for keeping your device, email account and login secure.

We are based in the United States, and our service providers may process information in the United States and other countries. Where we transfer personal information across borders, we take steps to protect it as required by law.

We treat a Global Privacy Control signal from your browser as a request to opt out of sharing for advertising: while your browser sends it, X’s pixel does not load and nothing is sent to X, whatever you choose in our cookie banner.

Some browsers also offer a “Do Not Track” setting. There is no common industry standard for it, so the Service does not respond to it.

The Service is only for people aged 18 or over. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it and close the account. If you believe a child has given us information, contact us at hello@updown.fast.

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date above and, for material changes, give notice on the Service or in the app.

For questions or requests about this Privacy Policy or your personal information, email hello@updown.fast.