Privacy Policy

• Account: your display name, @username, bio and chosen picture, and when you joined.
• Sign-in: if you use Google, your Google account id, email address and name; if you use X, your X account id and username; if you use a Solana wallet, its public address and the signed message that proves you control it. We never receive your passwords or wallet keys.
• What you do on Chumbucket: your calls and theses, Back, Fade and Dare responses, who you follow, reports you file, and who you block or mute.
• Funded trades: for each order, the call it belongs to, the wallet address, market, side, amount, order status and Solana transaction signature.
• Eligibility confirmations: that you confirmed you are 18 or older, eligible where you live and accept Panta’s terms, with the terms version and time.
• Device: a push notification token and whether your device is Android or iOS, so we can send notifications you have allowed.
• Support: what you write to us in the support chat.
• Technical logs: our servers record requests (including IP address, time and the action requested) for security and to fix problems.

We do not collect your contacts, precise location, photos or card details.

Chumbucket is a public network. Your display name, @username, picture, calls and theses, your responses, your record and accuracy, and receipts you or others share are visible to anyone, including people who are not signed in. Calls marked “followers only” are visible to your followers. Your linked wallet address can be visible alongside your profile, and everything you do on the Solana blockchain (including funded trades) is public there and permanent.

• to run your account, show your calls and record, and settle receipts from venue results (performing our contract with you);
• to prepare funded trades you ask for and show their status (contract);
• to keep Chumbucket safe: rate limits, the link and language filter, reports, blocks and fraud prevention (legitimate interests and legal obligations);
• to record your eligibility confirmation before funded trading (legal obligations and legitimate interests);
• to send notifications you have allowed (consent);
• to measure how the app is used, only if you switch analytics on (consent).

We do not sell your personal data and we do not use it for advertising.

We share personal data only with the services that run Chumbucket, and only what each needs:

• Supabase — our database and sign-in service. Holds the data in section 1.
• Railway — hosts our API servers, which process your requests and keep technical logs.
• Vercel — hosts this website.
• Google and X — if you sign in with them, they confirm who you are to us.
• Panta Market (Balr Holdings Corporation) — provides market data and executes funded trades. For a trade, Panta receives your wallet address and the order. We do not send Panta your name, email or Chumbucket account id. panta.market
• Crossmint — if you add funds by card or bank, Crossmint processes the payment and may verify your identity under its own privacy policy. It receives your wallet address.
• Solana network and RPC providers (such as Helius) — read balances and send the transactions you sign. They see your wallet address and IP address.
• Google Firebase Cloud Messaging — delivers push notifications using your device token.
• Tawk.to — runs the support chat when you open it.
• Shorebird — delivers app updates and receives your app version and basic device information.
• Legacy website features — the older Arena pages of this website use Privy for sign-in and embedded wallets, may use Anthropic to generate replies in the “Gaffer” chat, and mirror Arena money events to the public Walrus network.

We may also disclose data when the law requires it, to protect people’s safety, or as part of a merger or sale, in which case this policy continues to apply.

Earlier versions of the app sent your wallet address and display name to a private Telegram channel we used for internal alerts when you signed in or created an escrow challenge. Current versions do not.

Product analytics are off until you switch them on in the app (Profile, Settings, Privacy & data). When on, usage events are recorded without your name, wallet or thesis text. Today they stay on your device: we have not chosen an analytics provider. If we add one, we will name it here and ask again before anything is sent. You can switch analytics off at any time.

Push notifications are sent only if you allow them in your device settings. We do not use crash reporting services at this time.

• Your account data is kept until you delete your account.
• When you delete your account we remove your name, @username, bio, picture, email, sign-ins, linked wallets, Google or X links, follows, friends, blocks, mutes, push tokens and inbox. Your calls stay in the public record as "Deleted account", because a call is a permanent, timestamped statement other people's records and receipts depend on.
• Records of funded trades and your eligibility confirmations are kept for [retention period] to meet legal and financial obligations, linked only to the anonymised account.
• A security log of wallet links and removals is kept for [retention period].
• Database backups are overwritten within [backup window].
• Anything written to a public blockchain stays there permanently; no one can delete it.

• Export: in the app, Profile, Settings, Privacy & data, Export my data gives you a copy of your profile, calls, responses, follows, blocks, mutes, reports and trade records in JSON.
• Delete: in the app, Profile, Settings, Delete account; or request deletion on the web.
• Correct: edit your name, bio and picture in your profile.
• Withdraw consent: switch analytics or notifications off at any time.
• Depending on where you live (for example under the GDPR or the CCPA), you may also have the right to object, restrict processing, and complain to your data protection authority. We do not sell or share personal data for cross-context advertising. Contact [privacy contact email] to exercise any right.

Chumbucket is not for anyone under 18, and we do not knowingly collect their data. Our providers may process data in the United States and other countries; where required we rely on standard contractual clauses. We protect data with access controls and encryption in transit. We will tell you in the app before material changes to this policy.