Privacy Policy

1. Introduction

This Privacy Policy explains how Alpha Studios LLC ("Alpha Studios," "we," "us," or "our") collects, uses, shares, and protects information about you when you use the Alpha mobile application, the websites at tryalpha.xyz and any subdomains, and any related services (collectively, the "Service").

Alpha is a non-custodial wallet and trading interface. Your private keys are managed in hardware-backed trusted execution environments by our service provider Turnkey, Inc. and are not accessible to Alpha Studios. We design the Service to collect the minimum information necessary to provide it.

Your use of the Service is governed by both this Privacy Policy and our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms.

2. Information We Collect

We collect the following categories of information:

a. Information you provide

• Account. Your email address, account identifier, and (if you set them) display preferences.
• Authentication. Email one-time codes, passkey credentials (public keys; private keys never leave your device), and biometric verification status (we receive only the boolean result, not your biometric data).
• Wallets. The public addresses of Wallets you create or import; if you import a wallet, the import is performed inside Turnkey's enclave and we do not see your private key or seed phrase.
• User content. Strategies, alerts, hidden tokens, watchlists, referral codes, and similar configuration you create within the Service.
• Communications. Messages you send to us at our support, security, legal, or privacy addresses.

b. Information we collect automatically

• Device. Operating system and version, device model, app version, language, time zone, and a device identifier we generate to bind your session to your device.
• Network. IP address (used in part to determine your approximate region for geographic feature gating), connection type, and approximate latency.
• Usage. The screens you view, the features you use, error and crash reports, and aggregate usage metrics. We do not track you across other apps or websites.
• Push tokens. If you enable notifications, the platform-issued push token used to deliver them.
• On-chain activity. Transactions you sign through the Service are broadcast to public blockchains and are publicly observable. We index and display this activity to power your portfolio and history views.

c. Information from third parties

• Public blockchain data (balances, transactions, prices) from RPC and indexing providers including Helius, Codex, the Hyperliquid info API, and our self-hosted nodes.
• Onramp transaction status from MoonPay or Coinbase Onramp when you initiate a fiat-to-crypto purchase. KYC information you provide directly to those providers is governed by their privacy policies; we receive only transaction metadata.
• Wallet authentication state from Turnkey relating to your account.

3. Information We Do Not Collect

• Private keys, seed phrases, or passwords. These are never sent to our servers. Wallet keys live inside Turnkey's hardware enclaves; passkey private keys live on your device.
• Biometric data. Face ID, Touch ID, and equivalents are processed entirely on your device by the operating system. We receive only a pass/fail result.
• Government-issued identification or KYC. Alpha Studios does not collect or store KYC information. If a Third-Party Service (such as a fiat onramp) requires KYC, you provide that information directly to them.

4. How We Use Your Information

We use the information we collect to:

• operate, maintain, and improve the Service;
• authenticate you, secure your sessions, and detect and prevent fraud, abuse, and security incidents;
• determine which features are available in your jurisdiction and enforce geographic restrictions;
• display your portfolio, transaction history, prices, charts, news, and other content within the Service;
• generate AI responses to your queries via our AI Features (see Section 6);
• deliver notifications and other communications you have requested;
• respond to your support inquiries;
• comply with applicable laws, sanctions, regulations, court orders, and lawful requests from authorities;
• enforce our Terms and protect our rights, property, and the rights of others.

We do not sell your personal information, we do not share it with third-party advertisers, and we do not use it to build cross-app advertising profiles.

5. How We Share Your Information

We share information only as described in this section. The categories of recipients are:

a. Service providers acting on our behalf

We use vendors who process information solely to provide services to us under contractual confidentiality and data-protection obligations. These include:

• Turnkey, Inc. — wallet key management and transaction signing.
• Cloud and hosting providers for the application backend and databases.
• Email and authentication providers for delivering one-time codes and notifications.
• Analytics, crash, and observability providers for diagnosing errors and improving reliability. We minimize the data sent and disable cross-app tracking where the platform supports it.

b. Protocol and data providers integrated into the Service

• Public blockchain networks (Solana, Ethereum, Base, BNB Smart Chain, Arbitrum, Hyperliquid, and others). Transactions and addresses you broadcast through the Service are public and immutable.
• RPC, indexing, and market-data providers including Helius, Codex, Relay, Jupiter, the Hyperliquid info API, and our self-hosted nodes. Queries about a Wallet typically include the address you are viewing.
• DEX and routing partners when you swap or trade. Transaction details are sent to the relevant protocol and broadcast on-chain.
• Hyperliquid when you trade Perpetual Contracts. Order details, margin, and position data are processed by the Hyperliquid protocol.
• Fiat onramps (MoonPay, Coinbase Onramp) when you initiate a fiat purchase. Information you provide directly to those services (KYC, payment) is governed by their privacy policies.

c. AI providers

When you use AI Features, we transmit your prompt, conversation context, and limited account-related metadata (such as the screen you are on or a Wallet address you are inspecting) to our AI provider Anthropic, PBC. See Section 6 for details.

d. Push and platform providers

We deliver notifications through Apple Push Notification service (and equivalents on other platforms). The platform receives the push token, the delivery time, and any payload we send.

e. Compliance, safety, and legal

We may share information when we believe in good faith it is necessary to: comply with applicable laws, regulations, sanctions, or legal process; respond to lawful requests from public authorities; enforce our Terms; protect the rights, property, or safety of Alpha Studios, our users, or others; or detect, prevent, or address fraud, security, or technical issues.

f. Business transfers

If Alpha Studios is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to standard confidentiality obligations.

6. AI Features and Your Data

When you use AI Features:

• Your prompt and limited context (the screen you are on, the Wallet address you are inspecting, market data relevant to the question) are sent to our AI provider to generate a response.
• We do not include your private keys, seed phrases, email address, or session tokens in prompts.
• The AI provider processes the request to generate a response. Under our agreement with Anthropic, your prompts are not used to train Anthropic's general-purpose models. Anthropic may retain prompts for a limited operational period for safety, abuse-prevention, and debugging purposes per its policies.
• AI proposals are returned to your device for your review. The AI does not initiate transactions; every on-chain action requires your explicit confirmation.
• We may retain your conversation history within the Service so you can revisit prior questions. You can clear or delete this history through the Service.

7. Cookies and Similar Technologies (Web)

Our websites use a small number of strictly necessary cookies and similar technologies for session management, security, and basic analytics. We do not use third-party advertising cookies. The mobile application does not use cookies in the conventional web sense; analogous local-storage mechanisms (Keychain for credentials, on-device databases for cached content) serve similar purposes and are not shared with third parties beyond what is described in this Policy.

8. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service. After account deletion, we retain limited information for legitimate business purposes — including legal, regulatory, fraud-prevention, and dispute-resolution requirements — for a reasonable period, after which we delete or anonymize it.

On-chain data is permanent and outside our control. Wallet addresses, transactions, and balances written to a public blockchain cannot be deleted by us or anyone else.

9. Security

We use technical, administrative, and physical safeguards to protect information, including:

• TLS 1.2+ encryption in transit;
• encryption of databases at rest;
• short-lived access tokens with single-use refresh and device-bound sessions;
• passkey (WebAuthn) and biometric step-up for sensitive actions;
• strict scoping of Turnkey policies so a leaked Alpha credential cannot move funds without your authorization;
• least-privilege internal access controls and audit logging.

No security control is perfect. You play a critical role: keep your device updated, use a strong device passcode, do not share authentication factors, and never share your seed phrase or private key. If you suspect unauthorized access to your account, contact security@tryalpha.xyz immediately.

10. International Data Transfers

Alpha Studios is based in the United States and our service providers and infrastructure may be located in the United States and other countries. By using the Service, you understand that information may be processed outside your country of residence, including in jurisdictions whose data-protection laws may differ from your own. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

11. Your Rights

Depending on where you live, you may have rights regarding your personal information. These can include:

• Access — request a copy of the personal information we hold about you.
• Correction — request correction of information that is inaccurate.
• Deletion — request deletion of your account and associated personal information, subject to retention obligations and the immutability of on-chain data.
• Portability — request a machine-readable export of your information.
• Objection / restriction — object to or restrict certain processing.
• Withdrawal of consent — where processing relies on your consent, you may withdraw it at any time.
• Complaint — lodge a complaint with a supervisory authority.

To exercise these rights, use the in-app settings or email privacy@tryalpha.xyz. We may need to verify your identity before responding.

12. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights regarding your personal information, including the rights to know, delete, correct, and limit the use of sensitive personal information, as well as the right not to be discriminated against for exercising these rights.

We do not sell your personal information and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law. To submit a request, email privacy@tryalpha.xyz.

13. European Privacy Rights (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the controller of your personal information is Alpha Studios LLC. The legal bases on which we rely for processing include:

• Performance of a contract — to provide the Service you request.
• Legitimate interests — to operate, secure, and improve the Service, prevent fraud, and protect our users; we balance these interests against your privacy rights.
• Consent — for activities that require consent (e.g., certain notifications); you may withdraw consent at any time.
• Legal obligation — to comply with laws and regulations applicable to us.

You may contact us at privacy@tryalpha.xyz to exercise the rights described in Section 11. You also have the right to lodge a complaint with your local supervisory authority.

14. Children's Privacy

The Service is not directed to children under 13 and we do not knowingly collect personal information from children under 13. The Service is generally intended for users who are of the legal age of majority in their jurisdiction; users under that age may use the Service only with the verifiable consent of a parent or legal guardian. If we learn that we have collected information from a child under 13, we will delete it. If you believe a child has provided information to us, contact privacy@tryalpha.xyz.

15. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. For material changes, we will provide reasonable advance notice through the Service or by email. Your continued use of the Service after the effective date of an updated version constitutes acceptance of the changes.

16. Contact

Alpha Studios LLC
Privacy: privacy@tryalpha.xyz
Security: security@tryalpha.xyz
Legal: legal@tryalpha.xyz