Privacy Policy

Last updated: 6 November 2026

This Privacy Policy explains how Ora handles personal data: what we collect, where it comes from, why we use it, who receives it, how long we keep it, how we protect it and what you can ask us. It applies to our website (useora.xyz), our web app (app.useora.xyz, including the version you can install on your device) and our documentation (docs.useora.xyz), together called the Services.

It is written for Ora users and also for people who don’t use Ora but whose data appears in the Services (see section 4.16).

We have tried to write it in plain language. If something is unclear, contact us (section 17).

Key terms#

• Ora, we, us and our mean the team of individuals who develop and operate Ora (section 1).
• You means the person using the Services, or the person whose data we process.
• Main Wallet means the embedded wallet created for you when you sign up, with a Solana address and an EVM address used on Robinhood Chain. Its infrastructure is provided by Turnkey (section 4.2).
• Ora-operated wallets means the wallets whose keys are held by Ora’s systems: wallets created for your launches, including the relay wallets that pass the supply on during a launch, wallets you buy on the Marketplace, and wallets you import with a private key (section 4.3).
• Husher-routed operation means an operation in which funds are sent through Husher, an independent routing service (section 4.5).
• Terms means the Terms of Service.

Summary#

• Blockchains are public. Wallet addresses and transactions on Solana and Robinhood Chain can be seen by anyone, forever. Neither we nor anyone else can delete them.
• Your Main Wallet’s keys are not on our servers. They are held in encrypted form in Turnkey’s infrastructure. The keys of Ora-operated wallets, including keys you import, are held by Ora’s systems so they can carry out your instructions.
• Some features route funds through Husher, an independent service, under Husher’s own terms and privacy policy. Husher receives the wallet addresses and amounts of these operations, and it can ask us for the records we hold about them. Routing makes links harder to see on-chain; it doesn’t make you anonymous.
• We don’t sell your personal data and we don’t use it for advertising.
• We measure audience with Rybbit. It uses no cookies and stores nothing on your device, and we don’t use it to identify you. You can block it (section 4.15). The rest of what we store on your device is needed to sign you in, run the app or remember your choices.
• Some data is visible to other users: the leaderboard, and what referrers see about the people they referred directly.
• You can ask us about your data: access, correction, deletion, export, objection and more. Write to legal@useora.xyz.

1. Who is responsible for your data#

Ora is not run by a company. It is developed and operated under the name “Ora” by a team of individuals. That team is responsible for the personal data processed through the Services, as this policy describes.

• Privacy contact: legal@useora.xyz, for any question about your data and for the requests in section 11.
• General contact: contact@useora.xyz, for support and questions about your account.

A company may take over Ora later. If that happens, we will tell you in advance (section 7.8).

2. What this policy covers#

This policy covers the personal data we process when you use the Services, contact us, or apply to our partner program.

It does not cover processing that other organisations carry out for their own purposes, even when you reach them through Ora. These include blockchains, launchpads, Husher and the exchanges it works with, Turnkey’s processing for its own purposes, Google, X, Phantom, Discord and Telegram. Their own privacy policies apply. Section 7 explains what data they receive when you use them through Ora.

3. Blockchains are public and permanent#

Ora works with public blockchains (Solana and Robinhood Chain). Please read this before using the Services:

• Anyone can see on-chain data. Wallet addresses, balances, token transfers, trades, launches, burns, locks and other transactions are recorded on a public ledger. Anyone can view them with a block explorer, and some services analyse them to link wallets together or to a person.
• On-chain data is permanent. Once a transaction is confirmed, it can’t be changed or deleted, by us or by anyone else.
• Token content is also public. When you launch a token, its name, ticker, description, images and links are published through the launchpad, usually on IPFS (a public file network) and on-chain. They stay available after you close your Ora account.
• A wallet can be linked to you. An address is not your name, but it can identify you once it is linked to your identity, for example through an exchange, a social media post or on-chain analysis.

What you can ask us about your data (section 11) applies to the data we hold. It can’t apply to the copies held by a blockchain or IPFS.

4. The personal data we process#

We only process the data we need for the purposes in section 6. We don’t ask for identity documents to open an account. In some cases, we or Husher may ask you for information about where you live, your identity or where your funds come from (sections 4.5 and 4.18). We don’t need, and ask you not to give us, sensitive data such as data about your health, religion or political opinions, including in token content or wallet labels.

4.1 Account and sign-in data#

You can create an account and sign in with an email code, a Google account or a Phantom wallet. Sign-in runs through Turnkey (section 4.2).

• Email sign-in: your email address and the one-time codes sent to it. Turnkey sends the codes.
• Google sign-in: the identity information Google shares for sign-in: an account identifier and your email address, and possibly your name and profile picture depending on your Google settings.
• Phantom sign-in: your Phantom wallet’s public address and the signature that proves you control it.
• Your Ora account: your Ora user ID, your Main Wallet addresses, your referral code, the sign-in methods linked to your account, and the dates of sign-up and sign-in.
• Your acceptances: which version of the Terms you accepted and when, when you authorised the automatic balance operations, and which versions of Husher’s documents you accepted and when (sections 2.1, 5.2 and 11.1 of the Terms).
• API access: whether API access is on for your account, whether you have an API key, and a fingerprint (hash) of that key. We never store the key itself (section 10.8 of the Terms).
• Your display name: your referral code also serves as your display name, for example on the leaderboard. If you choose a code that contains your name or a handle, other users will see it.
• Session data: a session token issued by Turnkey, which our servers check before opening an Ora session, and a session cookie (section 12).

Through our Turnkey account, we can see the email address and the sign-in methods linked to your account.

4.2 Your Main Wallet (Turnkey)#

At sign-up, Turnkey Global, Inc. (“Turnkey”) creates your Main Wallet in a separate space reserved for your account. It has one Solana address and one EVM address used on Robinhood Chain.

• Keys: the Main Wallet’s private keys are generated and stored in encrypted form in Turnkey’s secure infrastructure. Ora’s servers don’t hold these keys and have no credential that lets them sign from your Main Wallet.
• Signing: transactions from your Main Wallet are signed in your browser, with the session opened when you sign in. This includes the actions you confirm (such as funding launch wallets, buying Marketplace wallets or withdrawing) and the automatic balance operations described in section 5.2 of the Terms and in section 4.4.
• Recovery key: your recovery key is the private key of your Main Wallet’s Solana address only. Turnkey exports it in two cases: during onboarding, as soon as the onboarding window opens, even if you don’t reveal it; and each time you use Export private key. Each time, Turnkey sends the key to your browser in encrypted form, and it is decrypted inside the Ora page on your device. It isn’t sent to Ora’s servers or stored by the app. Turnkey records that the key was exported.
• Data Turnkey processes: your wallet addresses, the public keys of your browser sessions, the requests you approve (including the transactions, their amounts and recipients), activity logs, and technical data such as your IP address and browser type.

4.3 Ora-operated wallets and private keys#

Some wallets you use in Ora are operated by Ora’s systems, not by your Main Wallet:

• Launch wallets that Ora creates for your launches (“fresh” wallets), including the relay wallets that pass the supply on during a launch;
• Aged wallets you buy on the Marketplace;
• Imported wallets, including a DEV wallet, that you add by pasting their private keys.

For these wallets, we process the wallet addresses, their balances and history, the names and groups you give them, and their private keys.

• Imported keys: when you import a wallet, the private keys you paste are sent over an encrypted connection (HTTPS) to Ora’s servers. They are not sent to Turnkey.
• Launch and Marketplace wallets: Ora’s systems create these wallets, or hold them before you buy them, and keep their keys.
• What this means: Ora’s systems can sign transactions with these wallets. We use the keys only to carry out your instructions, including standing instructions such as sell strategies, as described in section 5.4 of the Terms.
• Storage: we protect these keys with security measures suited to the risk, and only the people who need it can access the systems that hold them.

We never send the private keys of these wallets to Husher or to any other routing provider.

Only import wallets that you own or are entitled to use.

4.4 Balance, deposits and withdrawals#

Your account shows one balance, in US dollars. It is not a bank account. Your balance is the amount of USDC held in your Main Wallet on Solana (or on your Phantom address, if your session uses it), counted at one dollar per USDC. USDC is a stablecoin issued by Circle, not by Ora. The small SOL reserve kept to pay network fees is not part of your balance.

• Deposits: you can deposit USDC on Solana and USDG on Robinhood Chain, as the Deposit window shows. Each network has its own deposit address, which is your Main Wallet’s address on that network or, on Solana, your Phantom address if your session uses it. USDG you deposit moves to your USDC balance on Solana through the automatic balance operations below. We process the deposit address, the network, the coin, the sending address and the amount.
• Automatic balance operations: once you have accepted the Terms and authorised these operations (sections 2.1 and 5.2 of the Terms), the Ora app uses your session, while you are signed in, to keep your balance in USDC on Solana. It converts SOL above about $3 into USDC, keeping a reserve of about $2, and tops the reserve up from your USDC when it falls below about $1. It also moves the USDG and ETH that reach your Main Wallet on Robinhood Chain, once they are worth about $5 or more, to your USDC balance on Solana, or to the SOL reserve when it needs topping up. These operations go through Jupiter (swaps) and Relay (moves between networks), which receive the addresses, amounts and signed transactions they need.
• Withdrawals: you withdraw USDC from your balance in one transfer, routed through Husher (section 4.5), to the single destination address you enter. You enter only the address and the amount: there is no network to choose. We process the destination address, the amount and the transactions. If you can’t use Husher, you can still move your USDC out yourself (section 6.1).
• Withdrawals from launch wallets send funds back to your balance through Husher (Consolidate Withdraw, section 4.5). We process the selected wallets, the amounts and the transactions.

4.5 Operations routed through Husher#

Some features send funds through Husher, a swap-routing service operated by HUSH Technology Inc., which is independent of Ora. Today these are:

• CEX Funding (Solana) or Private Funding (Robinhood Chain), which fund your launch wallets from your balance;
• Consolidate Withdraw, which brings the funds in your launch wallets back to your balance;
• Marketplace payments, including the aged wallets bought for you when you add aged wallets to a launch or use Unlink Wallets;
• withdrawals from your balance, which send your USDC to the single address you enter;
• any other operation for which the app shows Husher as the route before you confirm.

How it works. Our servers create the order with Husher. For funding, Marketplace payments and balance withdrawals, your Main Wallet, or your Phantom address if your session uses it, signs a deposit to the address Husher provides, and our servers broadcast it. For Consolidate Withdraw, our servers send the balance of each selected launch wallet to Husher. Husher and the exchange partners it works with then carry out the swap and deliver the funds, for example to your launch wallets for funding, to your balance for Consolidate Withdraw, and to the destination address you entered for a balance withdrawal, which Husher therefore receives.

What we send Husher for each operation: the sending and destination wallet addresses, the amounts, assets and networks, our order references and the time of the operation. Because our servers place the order, Husher doesn’t receive your IP address or browser details when you make it. If Husher refunds an operation, the refund goes back to the address the funds were sent from (section 11.1 of the Terms).

Requests from Husher. Husher can ask us for the records we hold about a Husher-routed operation, for example for an anti-money-laundering review, a fraud investigation or a request from an authority. We answer only a written request that identifies the operation. We check that the request really comes from Husher, and we give it the records we hold for that operation: the operation details above and, while we still hold them, the server-log entries of the requests that created the operation (IP address and browser details, section 4.14). If we refused such a request, Husher could stop carrying out these operations for Ora’s users.

What Husher may collect from you directly. Husher or its exchange partners may hold, delay or refuse an operation, and may ask you for identity or source-of-funds documents, such as an identity document, a selfie or a liveness check (which involves biometric data), or bank or exchange statements. Husher collects and handles these under its own privacy policy. If Husher sends us a request concerning you, we’ll pass it on to you by email if we have your address, and in the app, within 1 business day of receiving it. We receive copies of your documents only if you send them to us yourself.

What routing hides, and what it doesn’t. Routing through Husher makes the link between your funding wallet and your destination wallets harder to see on public blockchains. It doesn’t make you anonymous: we, Husher and its exchange partners can see that link, keep records of it, and may have to disclose it to authorities.

Where Husher’s terms don’t allow use. Husher’s terms don’t allow people who live in, are citizens of or are located in some countries to use its service, and Husher can change that list at any time. Section 11.1 of the Terms explains what this means for you.

4.6 Activity and transaction data#

To run the Services, we process what you do in them:

• launches (Atomic Launch and other launch types), launch settings and the launchpad used;
• wallet funding sessions, including the funding type you choose;
• buy and sell orders, Instant Trade, Sell All, and sell strategies (Mirror, TWAP, Limit) with their settings and results;
• supply actions: burns, locks, sends (including destination addresses), creator-reward claims and Unlink Wallets runs;
• Marketplace purchases;
• the fees charged and the third-party costs paid;
• positions, P&L, portfolio and history.

Much of this also appears on-chain (section 3).

4.7 Token content, launch options and uploaded images#

When you create a token, we process the content you provide: name, ticker, description, logo and banner images, website, X and Telegram links, and launch options. Drafts are saved automatically on our servers so you can come back to them.

When you launch, we send this content to the launchpad and to an IPFS storage service. From that point it is public and permanent (section 3).

Fee sharing, airdrops and wallets you name. Some launch options involve other people. If you share creator fees, set up an airdrop or give a wallet a role in your token, we process the recipients you enter and their shares, and send them to the launchpad, which usually makes them public, often on-chain:

• Bags: fee-share recipients, identified by a wallet address or by an X, TikTok, Kick or GitHub handle (up to 16), airdrop lists of up to 1,000 wallet addresses, and an admin wallet;
• Ponsfamily: the creator wallet that receives creator fees, and up to 10 team wallets exempt from the snipe tax;
• Pump.fun, once fee sharing is available there: recipients identified by a Pump.fun username, a GitHub account or a donate.gg charity, with their shares. To find them, our servers look up the name you type on Pump.fun, GitHub or donate.gg.

Only upload content you have the right to use. Avoid personal data about other people in token content.

4.8 Linked X profile#

Where the app offers it, you can link an X profile to a token. X then shares your X user ID, username and display name with us. We only ask X for permission to read your profile, and we use these details only to show the link on your token. Our servers hold the connection credentials; the app only receives your public profile.

4.9 Rewards, referrals and leaderboard#

• Points and rank: your trading volume, points, rank and multiplier.
• Referrals: your referral code and link, who referred you and the referral chain above you (up to three levels), and the people you referred.
• Rewards balance: the cashback and referral shares credited to you, with the token they come from, the user who launched it and the rate applied, whether each one is on its way, claimable or claimed, and your claims (the amount, the Solana address it was sent to and the transaction).
• What referrers see: if someone referred you directly, they can see your wallet address (the app shows it in shortened form), the date you joined, how many coins you launched, your trading volume, the points your activity earned them under the earlier points system, and what they have earned through you. The people above them in your referral chain (levels 2 and 3) don’t see these details, only the total of what they earn.
• Leaderboard: signed-in users can see the top 50 users over the period they select, ranked by realised P&L, each with their display name (their referral code, or a shortened wallet address), coins deployed, volume, points and realised P&L.

You can object to appearing on the leaderboard, and to what your referrer sees, at legal@useora.xyz (section 11.2). If you object to the leaderboard, we stop showing you on it.

4.10 Tracker, watchlist and settings#

• Tracker: the wallet addresses you follow, the names and emoji labels you give them, and the wallets you mute. Only you see your labels.
• Watchlist: the tokens you pin.
• Settings: your preferences (for example chart, quick-buy, slippage, fee, notification, sound and table settings, and your wallet names and groups). They are saved to your Ora account so they follow you across devices.
• Announcements: which new-feature announcements you have already seen.

4.11 Paid add-ons#

If you buy a third-party add-on through Ora, such as DexScreener’s Enhanced Token Info, we process the order: the token, the description, links and images you provide, the paying wallet, the payment transaction and the order status. We send this to the provider so it can carry out the order (section 7.4).

4.12 PNL cards (processed on your device)#

PNL cards are created in your browser. If you choose your own background image or video, it stays on your device and is not uploaded to us. The card is saved or copied on your device. If you share it, the people you share it with see what it shows.

4.13 Support, partner applications and messages#

• Support: when you contact us by email, Discord or Telegram, we process your messages, your contact details or handle, and any information you choose to share.
• Partner program: if you apply, we process the details you send in your application, such as your name or handle, your social accounts and audience, and your contact details, and the messages we exchange with you.
• Reports and complaints: if you report content or send us a complaint (sections 18.5 and 27 of the Terms), we process your name and contact details, the content you report and why, your messages, and our decision.

Never send us your recovery key, a private key or a sign-in code. We will never ask for one by email, by direct message, by phone, on Discord or on Telegram. The only place Ora asks for a private key is the import screen inside the app.

4.14 Technical, log and device data#

• Server logs: when your device connects to our servers, we receive and log your IP address, browser and device information (user agent), the time, the page or function requested and any errors. We use them for security, to apply rate limits and to fix problems.
• API requests: when you use the Ora API, we log each request made with your key: the time, the function called, the result, the request ID and your IP address. We use them to run, secure and limit the API, and to answer your questions about a request.
• Approximate location: we may infer your country from your IP address, to apply the checks in section 4.18.
• Viewer counts: we count how many people are viewing a token page and show that number. Other users don’t see who is viewing.
• Device checks on your device: the app checks your screen width, operating system and browser to decide whether to suggest installing the app. This check runs on your device and is not sent to us.

4.15 Usage statistics (audience measurement)#

The app and our website (useora.xyz) use Rybbit to measure how the Services are used. We use these statistics only to understand and improve the Services. We don’t combine them with other data we hold, and we don’t use them to identify you or for advertising. Rybbit doesn’t use cookies, stores nothing on your device and doesn’t follow you across other sites.

With the settings we use, Rybbit receives:

• the pages you visit, with their full web address, including the token address or invite code that some addresses contain and any parameters after a ”?”, and the page you came from;
• your browser, operating system, device type, screen size and language;
• your IP address, which Rybbit uses to work out your approximate country and region. Rybbit’s privacy policy says that it doesn’t store IP addresses;
• what you do on a page: the text of the buttons you click, the links you follow to other sites, and the names of the form fields you change, but not what you type in them;
• page loading times and page errors;
• text you copy yourself: when you select text in the Services and copy it, Rybbit receives that text, up to 500 characters. When you use the app’s Copy buttons instead, Rybbit doesn’t receive what you copy, so use them to copy a private key, a recovery key or an address.

You can object at any time by blocking Rybbit in your browser, for example with a content blocker set to block app.rybbit.io. Rybbit then receives nothing from that browser.

4.16 Data about people who are not Ora users#

The Services show some data about people who may not be Ora users. If that is you, this section explains what we do.

• Known wallets: in trade, holder and top-trader tables, we label some wallets as belonging to well-known traders and creators. A label can include the person’s name or pseudonym, their handles on X, Pump.fun or FOMO, a profile picture and the wallet addresses linked to them. We build these labels from public sources.
• Callouts: once the feature is available, token pages will show public posts about the token from FOMO and Pump.fun, with the author’s name, handle, profile picture, post text, likes, and the position and P&L shown by that source.
• Tracked wallets: users can follow any public wallet address and give it a private label. Only that user sees the label.

We use this data to give users context about who is trading a token (section 6). We keep a label only while it is relevant, and we review the list at least once a year.

You can object to a label about you, or ask us to correct or remove it, at legal@useora.xyz. If you object, we remove the label. You can also make the other requests in section 11.

Because we usually have no way to contact these people directly, we inform them through this policy.

4.17 Data you give us about other people#

Tracker labels, token content, fee-sharing and airdrop recipients, and support messages can mention other people. Include only what is needed, and only what you are entitled to share. Don’t import a wallet that belongs to someone else without their permission.

4.18 Eligibility, sanctions and origin-of-funds checks#

Section 2 of the Terms sets out who can use Ora, and section 2.6 of the Terms lets us carry out some checks. When we do, we process:

• your country, inferred from your IP address;
• the results of any screening of the wallet addresses you use against sanctions lists and risk databases;
• the information we ask you for, where the law, a third-party service such as Husher, or a specific risk requires it: for example where you live, your identity (such as an identity document) or where your funds come from (such as exchange or bank statements), and your answers.

We ask only for what the check needs, and we tell you why we ask.

• Who receives it: any screening provider we use for the check; Husher, only where the check concerns a Husher-routed operation and Husher asked for it; authorities, where the law requires it (section 7.7).
• How long we keep it: see section 9.
• If you don’t answer: we may refuse, restrict or suspend your account or the feature concerned, as section 2.6 of the Terms explains.

5. Where the data comes from#

• From you: what you type, paste, upload or choose in the Services, and the messages you send us.
• From the sign-in method you use: Turnkey, and through it Google or Phantom.
• From X, if you link an X profile.
• From public blockchains and data providers: addresses, balances, transactions, holders, prices and market data, including from providers such as Helius, BitQuery and DefiLlama.
• From services you use through Ora: launchpads, Jito, Jupiter, Relay, Husher, Streamflow, HoodLock and DexScreener, which return the status and result of your operations. Husher may also send us requests for information about an operation (section 4.5).
• From Pump.fun, GitHub and donate.gg, once Pump.fun fee sharing is available: the profiles found when we look up a fee-sharing recipient you type (section 4.7).
• From FOMO and Pump.fun: public posts and profiles used for Callouts, once the feature is available.
• From public sources, for known-wallet labels (section 4.16).
• From sanctions lists and risk databases, if we screen wallet addresses (section 4.18).
• From other users: the referral code in the invite link you used, and the labels other users give wallets (visible only to them).
• Automatically: logs, technical data and audience statistics.

6. Why we use your data#

We use your data only for the purposes below. Where we use data because you agreed to it, you can withdraw your agreement at any time; this doesn’t affect what we did before.

6.1 What happens if you don’t provide data#

You need a sign-in method (email, Google or Phantom) to create an account. Without it, we can’t provide the app. To launch or trade, we need the data each operation requires.

Husher-routed operations need the data in section 4.5. If you don’t want Husher to receive it, or you object to our answers to Husher’s requests for records, you can’t use Husher-routed features. Where the app offers another route, such as Classic Funding instead of CEX or Private Funding, you can use it instead. Withdrawals from launch wallets, withdrawals from your balance and Marketplace purchases (including aged wallets added to a launch or used in Unlink Wallets) have no other route in the app. You can still move your USDC out yourself: with your recovery key (section 4.2), or from Phantom if your session uses your Phantom address (section 6.3 of the Terms).

If you don’t answer a request under section 4.18, we may restrict the feature concerned or your account.

Other data is optional: for example a Tracker label, a linked X profile or a support message.

7. Who receives your data#

7.1 Other users and the public#

• Everyone: on-chain data, published token content, and the fee-sharing and airdrop recipients that the launchpad makes public (sections 3 and 4.7).
• Signed-in users: the leaderboard (section 4.9), the labels of known wallets and, once the feature is available, Callouts (section 4.16), and viewer counts, which are anonymous.
• Your referrer: the details listed in section 4.9.
• The people you share with: PNL cards and anything else you choose to share.

7.2 Our service providers#

These providers process data on our behalf, to provide their services to us. We give each of them only the data its service needs.

This table lists our main providers. Others, such as services that run parts of our systems, receive only the data their service needs.

Turnkey provides its sign-in and wallet services on our behalf. Its privacy policy also says that it uses some data for its own purposes, for example to meet its legal obligations, to keep its platform secure and to run it. Turnkey’s privacy policy describes that processing.

7.3 Husher#

Husher, operated by HUSH Technology Inc., receives the data described in section 4.5. It is not our service provider: it decides for itself how it uses that data, including for its anti-money-laundering and fraud checks, how long it keeps it and to whom it discloses it.

• Who Husher may share data with: the exchange partners that execute swaps, identity-verification providers, its technical providers and authorities.
• Where Husher processes data: Husher may process data in other countries, as its privacy policy explains. Husher, not Ora, is responsible for that processing.
• How long Husher keeps data: according to its privacy policy, most data for up to 5 years, and biometric data for up to 3 years after your last interaction with Husher, or less.
• Husher’s privacy policy: husher.io/privacy-policy. Its other documents are its Terms of Service and its AML Policy.
• Contact for the data Husher holds: support@husher.io.

We are responsible for what we send Husher and for the records we keep. Husher is responsible for its own processing.

7.4 Other services you choose to use through Ora#

When you use a feature that relies on another service, we, or your browser, send that service the data it needs to carry out your instruction. These services decide for themselves how they use the data, under their own terms and privacy policies. Many of them work on-chain, so what they receive is often a public transaction.

7.5 Services your browser contacts directly#

To display data and send transactions, the app makes some of your browser’s requests directly to other services. Each of them receives your IP address and browser details, plus the data listed:

• Turnkey: sign-in and Main Wallet requests (section 4.2).
• Blockchain nodes (RPC): PublicNode’s Solana node, the Robinhood Chain node, and PublicNode’s Ethereum and BNB Chain nodes for some balance reads. They receive wallet addresses and signed transactions.
• Jupiter and Relay: as described in section 7.4.
• DefiLlama: price requests. It receives only the identifiers of the coins priced.
• Google Fonts: the app’s typefaces.
• DexScreener and Ponsfamily image servers: token logos.
• WalletConnect (Reown): the wallet software we use, provided by Turnkey, starts a background connection to WalletConnect’s servers when the app loads, even though Ora doesn’t offer WalletConnect as a way to connect a wallet. WalletConnect receives the app’s details (name, description, address and icon) and the technical data of that connection.
• Rybbit: audience statistics (section 4.15), unless you block it.

Your browser doesn’t contact Husher. If you open Husher’s documents or website from a link in Ora, Husher’s own cookie policy applies there.

7.6 TradingView charts#

Our price charts are drawn with TradingView’s Advanced Charts and Lightweight Charts libraries, software made by TradingView, Inc. Both run from Ora’s own servers, as part of the Ora app, so viewing or using a chart doesn’t send your personal data to TradingView. Your chart settings are saved in your Ora account (section 4.10). Advanced Charts may also keep chart settings, such as chart properties and favourites, in your browser’s local storage (section 12.2). If you click the TradingView logo on a chart, you leave Ora for tradingview.com, where TradingView’s privacy policy applies.

7.7 Authorities, legal claims and safety#

We disclose data to judicial, police, tax or other public authorities when the law requires it, or when they make a lawful request. We may also disclose data when needed to establish, exercise or defend legal claims, or to protect the safety and rights of users, of Ora or of others, to the extent the law allows. We check that each request is lawful and disclose only what is needed. Requests from Husher are covered in section 4.5.

7.8 A company that takes over Ora#

A company may take over Ora later. If that happens, the Services and the data needed to run them will be transferred to that company, which will then be responsible for your data and bound by this policy. The same applies to any later merger, sale or reorganisation. We will tell you at least 30 days in advance, by email if we have your address and in the app. You will keep everything this policy gives you, and you can close your account before the transfer if you don’t want to continue.

7.9 No sale of personal data#

Ora earns money from the fees in the Terms, not from personal data. No one buys data from us, and we give no one data to target you with ads. Figures we publish, such as Ora’s total trading volume, are totals that can’t be traced back to a person.

8. Where your data is processed#

Our service providers (section 7.2), Husher (section 7.3) and the other services you use through Ora (sections 7.4 and 7.5) may process your data in countries other than the one where you live, where data-protection rules may differ from those that apply to you. We give our service providers only the data their service needs.

Blockchains are global networks: data written to them is copied to computers around the world.

You can ask us which providers process your data, and where (section 17).

9. How long we keep data#

We keep data only as long as needed for the purposes in section 6, then delete it or make it anonymous. When we have to keep data for longer, for example for a legal claim or because a provider’s conditions require it, we keep it in a separate archive with restricted access. Where deleted data also exists in backups, it is removed from them as the backups are replaced.

Inactive accounts. If you don’t sign in for 3 years, we may close your account (section 21.5 of the Terms). We will first warn you at least 60 days before, by email if we have your address and in the app, with instructions to withdraw your funds and save your recovery key. Section 21.4 of the Terms applies to any assets left.

Data stored on your device is covered in section 12.

10. How we protect data#

10.1 Our measures#

We use technical and organisational measures suited to the risks, including:

• encrypted connections (HTTPS) between your device and our servers;
• Turnkey’s secure infrastructure for your Main Wallet keys;
• security measures suited to the risk for the keys of Ora-operated wallets, on systems that only the people who need it can access;
• access to production systems limited to the people who need it, with logging;
• rate limits and monitoring against abuse;
• password protection of test environments;
• keeping only the data we need.

No system is completely secure, but we work to keep risks low and review our measures regularly.

10.2 What you can do#

• Keep your recovery key offline and private. Anyone who has it controls the Solana address of your Main Wallet.
• Ora can’t recover your recovery key for anyone. If you want someone you trust to be able to reach your funds, for example if something happens to you, plan for it yourself.
• Copy keys and addresses with the app’s Copy buttons rather than by selecting the text (section 4.15).
• Secure your sign-in methods: your email account, your Google account and your Phantom wallet.
• Log out on shared devices.
• Never share a private key or recovery key with anyone who contacts you, even if they claim to be from Ora or Husher.

10.3 Data breaches#

If a breach affects personal data, we will notify the authorities where the law requires it. If the breach is likely to create a high risk for you, we will also tell you without undue delay, explain what happened and what you can do.

11. Your rights#

11.1 What you can ask#

You can ask us to:

• give you access to your data and a copy of it;
• correct data that is inaccurate or incomplete;
• delete your data, for example when we no longer need it or you withdraw your agreement;
• limit our use of your data for a while, for example while we check a correction you asked for;
• export the data you gave us in a portable format, and send it to another provider where that is technically possible.

You can also:

• object to some uses of your data (section 11.2);
• withdraw your consent at any time, where we use data because you agreed to it, without affecting what we did before.

The laws that apply to you may give you further rights. Nothing in this policy limits them.

For the data Husher holds (section 7.3), you can also contact Husher directly at support@husher.io.

11.2 Your right to object#

You can object at any time to our use of your data for the leaderboard, for what your referrer sees, for known-wallet labels, for audience measurement and for our answers to Husher’s requests for records. We will stop, unless we have compelling reasons to continue that override your interests, or we need the data to establish, exercise or defend a legal claim. If you object to the leaderboard, we stop showing you on it. If you object to a known-wallet label, we remove it. For audience measurement, the quickest way is to block Rybbit (section 4.15). For Husher-routed operations, objecting means you can no longer use those features (section 6.1). We may keep the records of operations already made, for example to deal with a fraud investigation or a legal claim.

You can object to direct marketing at any time, with no reason needed. We will then stop using your data for marketing.

11.3 How to make a request#

Write to legal@useora.xyz. Making a request is free.

• Identity checks: we may ask you to confirm your identity, for example by writing from the email address linked to your account, by signing in, or by signing a message with your wallet. We will never ask for your recovery key or a private key.
• Timing: we answer within one month. If a request is complex, or if we receive many requests, we may take up to two more months, and we will tell you why within the first month.
• Refusals: if we can’t do what you ask, we will explain why, and tell you how to complain (section 11.5).

11.4 Closing your account, and the limits of deletion#

The app doesn’t have a closing function yet. To close your account, write to contact@useora.xyz, as section 21.1 of the Terms explains. Once your account is closed, we delete or anonymise your data as section 9 explains. To ask us to delete some of your data without closing your account, write to legal@useora.xyz.

Before you close your account:

• Move your funds out of your balance, of your Main Wallet’s Robinhood Chain address and of your Ora-operated wallets.
• Save your recovery key if you want to keep using your Main Wallet’s Solana address outside Ora.

If assets are still in launch, relay or aged wallets when your account is closed, section 21.4 of the Terms applies, and we don’t delete those wallets’ keys while they hold assets except as that section provides. The keys of imported wallets are deleted when your account is closed: after that, only your own copy of each key gives access to the wallet, and we can’t recover it for you. Once a wallet’s key is deleted, the wallet can no longer be used through Ora.

Some limits apply:

• On-chain and IPFS data can’t be deleted (section 3).
• Records we keep: we keep the records listed in section 9, such as fee and payment records, for the periods stated there, even after your account is closed.
• Husher-routed operations: we keep their records for the period in section 9, even after your account is closed. Husher’s own records are governed by Husher’s privacy policy.
• Your Main Wallet: closing your Ora account doesn’t erase your Main Wallet’s addresses or their on-chain history. Once your account is closed, you can no longer use your Main Wallet through Ora. You can still use its Solana address with your recovery key, but not its Robinhood Chain address. The wallet stays in Turnkey’s infrastructure, where Ora can’t delete it on its own, and Turnkey’s privacy policy covers the data Turnkey keeps.

11.5 Complaints#

If you think we haven’t handled your data properly, please write to us at legal@useora.xyz, so that we can try to fix the problem. As section 27 of the Terms explains, we acknowledge a complaint within 5 business days and answer it within 30 days.

12. Cookies and similar technologies#

12.1 What we use and why#

Cookies and similar technologies, such as local storage and IndexedDB, store or read information on your device. We use them only for the purposes below:

• Sign-in and security: to sign you in, and to keep your session and your wallet connection secure.
• Invite links: when you click Accept on an invite page, the app keeps the invite’s referral code in your browser until you sign in. This lets us credit the sign-up you asked for to that invite: the person who invited you becomes your referrer.
• Preferences: to remember choices you made in the interface, including chart settings.
• Wallet software: the WalletConnect software described in section 7.5 keeps the data of its connection.

Rybbit stores nothing on your device (section 4.15). We don’t use advertising or social-media tracking technologies.

12.2 List#

The documentation site (docs.useora.xyz) uses no analytics and hosts its own fonts. Its “Ask ChatGPT” and “Ask Claude” buttons open those services with the page’s content; their privacy policies apply once you use them.

12.3 Managing your choices#

• Audience measurement: you can block Rybbit at any time (section 4.15).
• Clearing local data: Log Out (in the profile menu) and Reset Local cache (in Account and security) clear the data the app keeps in your browser’s local storage.
• Your browser: you can also delete or block cookies and site data in your browser settings. If you block the storage needed for sign-in, you won’t be able to sign in.

13. Automated decisions and profiling#

We don’t make decisions about you based solely on automated processing that have legal effects on you or affect you in a similarly significant way.

Some processing is automated:

• Points, ranks and multipliers are calculated automatically from your trading volume, under the rules of the rewards program. This is a form of profiling. It decides your rewards, not your access to the Services.
• Cashback and referral shares are calculated automatically from the fees collected on tokens, the user who launched each token and the referral links used at sign-up, under the rules of the rewards program.
• The leaderboard ranks users automatically on their realised P&L over the period selected.
• Sell strategies (Mirror, TWAP, Limit) run automatically, but only on the instructions and settings you choose.
• Security checks, such as rate limits and abuse detection, can automatically block a request or restrict access for a while. So can the country and sanctions checks in section 4.18, where we apply them. If you think a restriction is wrong, contact us and a person will review it.
• Husher’s checks: Husher and its exchange partners may use their own automated risk checks to hold, delay or refuse an operation. These are their decisions, under their own policies, and we can’t override them. If an operation is held, contact us and we will help you with Husher.

The partner rate of the referral program is granted by us after reviewing your application, not automatically. It applies to the people who sign up through the partner’s link after approval.

14. Children#

The Services are for adults only: you must be at least 18, or the age of majority where you live if it is higher. We don’t knowingly collect data from minors. If we learn that a minor has an account, we will close it and delete the data, except what the law requires us to keep, following the process in section 2.2 of the Terms.

15. Messages we send you#

• Service messages: sign-in codes, security alerts, requests passed on from Husher about your operations, and notices about important changes to the Services, the Terms or this policy. We send them because they are needed to provide the Services or required by law, so you can’t opt out while your account is open.
• In-app announcements: news about features, shown in the app. We record which ones you have seen so we don’t show them again.
• Marketing emails: we don’t send any today. If we start, we will ask for your consent where the law requires it, and every message will let you unsubscribe in one click.

16. Changes to this policy#

We may update this policy when the Services, our providers or the law change. The date at the top shows the latest version. Earlier versions are available on request at contact@useora.xyz.

If we make a significant change, we will tell you at least 30 days before it applies, by email if we have your address and in the app. If a change requires your consent, we will ask for it and won’t rely on you continuing to use the Services.

17. Contact us#

• Privacy questions and requests about your data: legal@useora.xyz
• General questions and support: contact@useora.xyz

You can also reach the team on Ora’s official Discord or Telegram for general help. Don’t send personal details there that you don’t want others to see, and never send a recovery key or a private key.