Gobi Privacy Policy

• Account information, such as your email address, authentication identifiers, display name, handle, and avatar choices.
• Profile and social information, such as friends, follows, community posts and comments, direct messages, market-room and news-thread messages, shared paper trade cards, and other content you choose to post or send.
• Practice trading activity, such as virtual balances, watchlists, simulated orders, positions, fills, PnL, account history, learning progress, and app interactions.
• AI assistant interactions, such as the questions you ask Gobi and the messages you send to the assistant. When you ask about your account, we also include a snapshot of your simulated trading activity (such as your virtual balance and open practice positions) so the assistant can answer in context.
• Voice input, when you use the optional microphone (push-to-talk) feature to ask Gobi a question. Audio is streamed to a speech-to-text provider to convert it into text and is not retained after transcription. The microphone is only used while you are actively holding the voice button, and only if you grant microphone permission.
• Device and usage information, such as device type, operating system, app version, push notification tokens, IP address, approximate location derived from network information, logs, diagnostics, and crash reports.
• Website information, such as pages visited, browser type, referring pages, and basic analytics used to understand site performance.

If you access Gobi through Apple TestFlight, Apple may collect and share certain testing information with us, such as your name or email associated with TestFlight, invitation status, install status, device details, crash logs, screenshots, or feedback you submit through TestFlight. Apple's handling of that information is governed by Apple's own policies.

• Provide, maintain, and improve the Gobi app, website, accounts, simulated trading experience, and social features.
• Show your practice portfolio, trade history, market context, profiles, messages, community feed, notifications, and related app state.
• Understand app performance, troubleshoot bugs, prevent abuse, protect safety, and maintain service reliability.
• Send service messages, product updates, TestFlight communications, and support responses.
• Power the Ask Gobi AI assistant, including generating educational explanations of your simulated positions, charts, and markets, and transcribing voice input into text. The assistant is a learning aid and does not provide financial advice or trade signals.
• Develop new features and improve onboarding, education, risk explanations, and simulated trading workflows.

• With other users, when you choose to share profile information, social activity, messages, posts, comments, or paper trade cards.
• With service providers that help us operate the app, website, hosting, authentication, analytics, diagnostics, support, communications, and infrastructure.
• With third-party AI and speech-to-text providers that process your assistant messages, the simulated-account context described above, and voice audio in order to generate the Ask Gobi assistant’s responses and transcribe voice input. These providers act as our service providers, process this data on our behalf to provide the feature, and we do not permit them to use it for their own advertising.
• With market data, infrastructure, and technical vendors as needed to provide app functionality.
• When required by law, legal process, safety obligations, or to protect the rights, property, and security of Gobi, our users, or others.
• In connection with a merger, financing, acquisition, reorganization, or transfer of assets, subject to appropriate protections.

Except for the advertising-measurement activities described in “Advertising, Attribution, and Measurement” below, we do not sell your personal information, and we do not use your personal information for cross-context behavioral advertising.

We run paid ads (for example on Meta and TikTok) to tell people about Gobi. When you arrive at our app download page after clicking one of those ads, we and our advertising partners may use cookies, pixels, and similar technologies, together with the campaign parameters carried in the link (such as UTM tags and a click identifier), to measure how our ads perform and to attribute app installs to the campaign that drove them.

To measure mobile installs, we use a mobile measurement partner (AppsFlyer) and Apple's privacy-preserving SKAdNetwork. In the current app build this is done without using your device advertising identifier (IDFA) and without asking you to allow tracking across other companies' apps and sites. If we later enable that user-level ad measurement, we will request your permission through Apple's App Tracking Transparency prompt first and update this policy.

You can limit ad measurement through your device and browser settings, your ad-platform preferences (Meta and TikTok each offer ad and activity controls), and, on iOS, the App Tracking Transparency setting. You can also contact us to ask about your choices.

Gobi's trading activity is simulated and uses virtual money. Simulated trades, balances, positions, PnL, leaderboard entries, shared trade cards, and related learning data may still be personal information because they are associated with your account. Treat anything you share with friends or on public profiles as visible to those recipients.

Gobi includes an AI assistant (“Ask Gobi”) that explains your simulated positions, charts, and markets in plain language and can help you set up a practice trade that you confirm. To generate responses, we send your assistant messages and a snapshot of your simulated trading activity (such as your virtual balance and open practice positions) to third-party AI providers that process this data on our behalf. The assistant is a learning aid and does not provide financial advice or trade signals, and it never places a trade without your explicit confirmation.

The optional voice (push-to-talk) feature uses your device microphone only while you are actively holding the voice button and only if you grant microphone permission. The captured audio is streamed to a third-party speech-to-text provider to convert it into text so you can ask questions hands-free. We do not retain the voice audio after it is transcribed, and we do not use it to build a voiceprint or to identify you. You can use Gobi without the voice feature by typing your questions instead.

HEVM Wallet is a separate app from us for holding USDC on the HyperEVM network and sending it to other wallet addresses. It has its own account, and it has none of the practice-trading, social, or AI features described above. This section applies only to HEVM Wallet. The rest of this policy applies to both apps unless it says otherwise.

• Sign-in and your key. You sign in through Privy, our wallet infrastructure provider, using Apple, Google, or a code sent to your email. Privy verifies your sign-in and creates and secures your wallet key in hardware enclaves. We receive your email address, a user identifier, a display name if you provide one, and your wallet address. We never receive your private key.
• Wallet and transaction information. Your wallet address, your USDC balance, and every deposit and send are recorded on the public HyperEVM blockchain, which we do not control and cannot edit or delete; anyone can look up the transactions of an address. We also keep a copy of your activity in our systems to show it to you and to operate your account.
• Camera. If you scan a QR code on the Send screen, the camera reads the address on your device. No image is stored or sent to us, and you can paste an address instead.
• Device and usage information. A push notification token if you allow notifications, device type, operating system, app version, IP address, and diagnostics. Approximate location may be inferred from your IP address by our infrastructure and diagnostics providers.
• How we use it. To create and show your account, relay the transactions you approve and pay the network fee for them, notify you about your money, prevent fraud and abuse, meet legal obligations (including screening transfer addresses against sanctions lists where that is enabled), respond to support requests, and keep the service reliable.
• Who we share it with. Privy, for sign-in and key infrastructure; blockchain node providers, to submit the transfers you sign to the network; diagnostics and analytics providers; and any deposit partner you choose to use, which has its own privacy policy. We share information when the law requires it. We do not sell it and do not use it for advertising.
• Deleting your account. In the app: Home, then the account button, then Security & recovery, then Delete account. This deletes your account and profile information from our active systems. It does not move your money and cannot remove records from the public blockchain, so withdraw your balance or export your key first. We keep some records where the law requires it.
• Age. HEVM Wallet is for adults. You must be 18 or older to use it.

• You can update certain profile and account information in the app when those controls are available.
• You can choose what to share in social features, including messages, posts, comments, and paper trade cards.
• You can manage device permissions, such as notifications, through your device settings.
• You can delete your account at any time from the app (Profile, then Delete account). Deleting removes your profile information from our active database, signs you out, and marks your practice account as deleted in our infrastructure. This cannot be undone, and signing in again later starts a fresh practice account. In HEVM Wallet the same control is under Security & recovery; see the section above.
• You can request access, correction, deletion, or export of your personal information by contacting us.

We keep information for as long as needed to provide the service, maintain account history, comply with legal obligations, resolve disputes, enforce agreements, and protect the app. Some information may be retained in backups, logs, or security records for a limited period after deletion requests.

We use reasonable technical and organizational measures designed to protect information. No system is perfectly secure, and we cannot guarantee that information will never be accessed, disclosed, altered, or destroyed.

Gobi is not directed to children under 13, and we do not knowingly collect personal information from children under 13. HEVM Wallet is for adults 18 and older. If you believe a child has provided us personal information, contact us and we will take appropriate steps.

Gobi may process information in the United States and other countries where we or our service providers operate. Those countries may have privacy laws that differ from the laws where you live.

We may update this policy as Gobi changes. If we make material changes, we will update the effective date above and provide additional notice when appropriate.

If you have questions or requests about this privacy policy, contact us at support@arcaos.io.