Privacy Policy

C3 Labs Ltd operates Kickr. This Policy explains how we handle personal data in our websites, mobile applications and related services, including Ask Kickr. We determine the purposes and means of our own processing and act as the controller for that processing. Independent providers may have their own responsibilities and policies.

1. Information you provide

Depending on the features you use, we receive:

• Account information, such as email, authentication identifiers and information returned by the sign-in method you choose.

• Wallet information, including public addresses, wallet identifiers and records of signing permissions or approvals.

• Profile information, such as your username, avatar, referral information and preferences.

• Instructions and activity associated with orders, positions, claims, deposits, transfers and withdrawals.

• Questions, conversation history and feedback submitted to Ask Kickr.

• Support messages, complaints, privacy requests and information reasonably needed to verify ownership or investigate an issue.

Do not send us passwords, private keys, recovery phrases or one-time codes. Avoid putting sensitive personal information into a public profile, transaction memo or AI chat.

2. Information collected through use

We maintain account and transaction records needed to operate Kickr, including provider responses, pending and completed statuses, portfolio information and reconciliation records. We also record the agreement version you accept and its acceptance time.

Technical information can include IP address, timestamps, browser or device type, operating system, app version, error categories, security events and approximate location inferred from network information. A geographic eligibility check can disclose your IP address to the service performing the check, including Polymarket when a client checks that provider directly.

Notification features use push tokens, device registrations, notification preferences and delivery or engagement information. A tap or delivery receipt is not proof that you read a message.

Analytics can include page or screen views, feature interactions, session or account identifiers, performance and categorized errors. We also obtain relevant information from authentication providers, market infrastructure, public profiles and public blockchains. A public wallet address or pseudonymous identifier can still be personal data when it can be linked to a person.

3. Purposes and legal bases

We use information to create and authenticate accounts, support wallet connections and authorized operations, display and track market activity, provide social and AI features, deliver notifications, handle support and privacy requests, and maintain the security and reliability of the Services.

We also use relevant information to detect fraud and abuse, apply eligibility controls, administer referrals and rewards, preserve agreement records, reconcile pending activity, resolve disputes and comply with applicable legal obligations.

Where a legal basis is required, processing may rely on providing the service you request, compliance with law, our legitimate interests where recognized and not overridden by your rights, or your consent. Legitimate interests can include preventing abuse and improving service reliability. When consent is required for a particular activity, we obtain it for that activity; accepting Terms is not general permission for every processing purpose. You may withdraw consent without affecting processing already lawfully carried out.

4. Wallet infrastructure and public records

Privy or another wallet provider processes information for authentication, wallet creation, connection and supported recovery features. Kickr stores wallet addresses and identifiers and can use separately authorized additional-signing permissions for supported operations. A signing permission is different from possession of the wallet's private key, and we do not describe an authorized wallet as beyond Kickr's ability to sign.

Blockchain transactions, contract interactions and wallet activity can be visible to others, copied, analyzed and linked with other information. C3 Labs cannot erase or rewrite a public blockchain record. Some orders and service interactions occur off-chain, so not every account event is a public blockchain transaction.

5. Public profiles and social features

A public profile or feed may disclose your username, avatar, public trading activity, performance summaries and social connections. Sharing a trade, profile or referral link makes the information in that share available to its recipients and potentially others who receive the link. Other users may save or redistribute public information.

Your public profile is different from your private account and cash information. We do not intentionally publish your sign-in email, private support messages, private wallet credentials or private cash balance as social profile fields. Public blockchain activity can independently reveal financial information.

6. Ask Kickr and AI processing

Ask Kickr uses OpenAI to generate responses. Processing can involve your current question, supplied conversation history, football and market information and, when relevant to a personalized response, information drawn from the signed-in account or a public trader profile. This can include usernames and account, portfolio or trading context. We do not promise that all material sent to the AI provider is anonymous or excludes personal data.

Kickr stores authenticated chat turns and supplied history, responses, the associated account identity and fixture, and operational information such as status, model, token use and latency. Authorized personnel can review stored conversations for support, reliability and investigation. These chats are not intended to be public social posts.

Stored Kickr chats currently have no automatic expiry and remain until a separate erasure is processed. Deleting the main Kickr account does not automatically erase the separate AI-chat store. Account and privacy requests covering AI history require that additional erasure step. Contact gm@kickr.fun to request access or deletion of AI history; identifying the relevant account helps us locate it. Backup copies may remain until their normal expiry, subject to applicable legal requirements.

OpenAI's processing and retention are also subject to its applicable terms, settings and legal obligations. See OpenAI's Privacy Policy. We do not guarantee zero provider retention or that a provider never receives sensitive information you choose to submit. Do not use Ask Kickr to transmit secrets or another person's confidential data.

7. Disclosures and service providers

We disclose information as needed for the purposes above to:

• Privy and chosen sign-in or wallet providers, for identity, wallet infrastructure and authorized operations.

• Polymarket, blockchain and bridge infrastructure, for market information, instruction processing and transaction tracking.

• OpenAI, for Ask Kickr processing described above.

• PostHog, where configured, for product analytics, reliability and engagement measurement.

• Expo and platform push services, for delivering notifications to registered devices.

• Hosting, database, storage, security, communications and support providers that help operate the Services.

• Professional advisers, regulators, courts, law enforcement or others where disclosure is legally required or reasonably necessary to protect rights and investigate misuse.

• A successor or relevant business-transfer participant, subject to applicable confidentiality, notice and data-protection requirements.

We do not sell personal data or use it for third-party targeted advertising. Information made public through a feature or blockchain is accessible independently of these provider disclosures.

Providers acting on our instructions are subject to applicable contractual requirements. Providers determining their own purposes may act independently under their own policies. Review Privy's Privacy Policy and Polymarket's Privacy Policy. A provider may request identity or payment information directly; do not assume that Kickr holds all information collected by that provider.

8. Cookies, local storage and analytics

The Services use cookies, local storage, mobile storage and SDKs for sign-in, session continuity, preferences, onboarding state, security and feature operation. Product analytics can associate interactions with a session or account; pseudonymization does not necessarily make the resulting information anonymous.

Our analytics filtering is designed to omit secrets, raw chat content, private financial details and other sensitive fields from product events. This is a safeguard, not a guarantee that all technical or provider processing is anonymous. Provider telemetry can include network and device information independently of the event fields we select.

You can manage browser storage through browser controls and notification permissions through device settings. Blocking necessary storage may prevent sign-in or break a feature. Where law requires a separate choice for non-essential tracking, that processing is subject to the required choice. If you have a question or objection about analytics processing, contact us.

9. Retention and account deletion

Retention depends on the record and its purpose. Account, transaction, agreement, security and support records may be needed to operate an account, reconcile activity, meet legal obligations or resolve a dispute. We delete or de-identify information when it is no longer needed for an applicable purpose, subject to legal holds and backup cycles. AI-chat retention has the specific exception described in section 6; no fixed automatic chat expiry is currently implemented.

Where available, use the in-app or web account-deletion control, or contact support under the account-deletion guide. Self-service deletion requires checking that funds, positions, open orders and pending activity can be handled safely. A blocked self-service flow does not prevent you from submitting a privacy request, which we assess under applicable law.

Public blockchain records, independently held provider data, other users' copies and records we lawfully must retain may remain. Deletion of a Kickr account cannot force an independent provider to erase its records. We may need to process main-account data, AI-chat data and provider requests separately and explain any exception that applies.

10. International processing

C3 Labs is incorporated in the British Virgin Islands and operations and providers can involve the United Arab Emirates and other countries. Information may be processed wherever our relevant providers operate, with different local privacy laws. Where applicable law requires transfer safeguards or consent, the transfer must follow those requirements. Contact us for information about safeguards applicable to your data.

11. Your choices and rights

Depending on applicable law, you can request access, a copy, correction, deletion, restriction or portability of personal data, object to certain processing, withdraw consent or stop direct marketing. You may also complain to the competent data-protection authority. These rights can be subject to lawful exceptions and verification requirements.

Send requests to gm@kickr.fun. We may ask for information reasonably necessary to confirm ownership, locate records and avoid disclosing someone else's information. We respond within applicable legal time limits and explain lawful refusals or extensions. You do not need to waive a legal right to receive support.

Notifications can be disabled in device settings. Essential security, account and legal communications may still be sent where permitted. Marketing communications, if sent, provide the applicable unsubscribe method.

12. Security and children

We use technical and organizational safeguards intended to protect information against unauthorized access, misuse and loss. No system is completely secure. Protect your account, device and wallet recovery methods, and report suspected compromise promptly. Do not send credentials or recovery secrets in a support or privacy request.

Kickr is not intended for anyone under 18 or below the age of majority where they live. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.

13. Changes and contact

We will post revisions and update the document date, with additional notice or consent where required. A Terms/EULA acceptance record is not a substitute for a separate privacy consent required by law.

C3 Labs Ltd

Privacy requests and complaints: gm@kickr.fun.

Website: kickr.fun.