Privacy Policy

1. Who is responsible

The data controller is Jura Capital LLC, a Delaware limited liability company (MemeTrader is a product of Qara). Questions and requests: support@memetrader.fun.

2. What we collect

You give us

• A guest session id, if you play without an account: a random id we create on your first trade, kept in a first-party cookie (section 8) and on our servers with the time you were last active. To limit how many guest sessions one visitor can create we also keep, for that session, a hash of your IP address and browser user agent (not the values themselves).
• Your Solana wallet address and the signed message that proves you control it, if you sign in or link a wallet (and, on an account from before 10 October 2026, the EVM address it signed in with). Addresses are public.
• Your email address, or the id of your Google account, if you sign in with Google or with an email link. Google’s Firebase Authentication verifies the sign-in and holds the identity record; we keep the email address (verified) and the Firebase user id on our servers as your sign-in. These are private: other players see your handle and wallet addresses, never your email or Google account. There is no password anywhere.
• A handle, if you set one; chat messages, chants, sponsor banners and other text you post.
• Game actions: trades, votes, follows, subscriptions, bot configuration and API keys (keys are stored hashed and shown to you once).
• Notifications, if you turn them on: the push address your browser gives us (a web address at your browser’s push service — Google, Mozilla, Apple or Microsoft) and its encryption keys, linked to your account, plus the browser’s user agent. We use it only to send what you turned on: your round results, alerts from traders you pay for, and reminders that a subscription is ending.
• Token creator descriptions you write (Launch a token) and what we generate from them — the art and the text — kept with your account; if you launch the token, its contract address, the wallet you launched from and the transaction. A token you launch appears in the list of recent launches on our site by its name, ticker, art and contract address only — never with your handle, your wallet address or your description.
• Anything you send us by email.

Generated when you pay

• We do not take card payments and hold no card or payment-processor data; every purchase is paid in crypto from your wallet.
• For each purchase, a payment record: what you bought, the internal reference price the quote was computed from, the chain, the asset and amount, the exchange rate used, a purchase reference, the quote’s expiry, and — once you pay — the transaction hash, the paying address, the receiving addresses (the creator’s and our treasury) and the block. On Solana the record also holds the collection address the payment was sent to (derived from our treasury’s public key per creator), the purchase’s reference key (a random public key with no funds and no private key kept anywhere) and, after the forward, the forwarding transaction. The transaction itself, with these addresses, the memo naming the purchase and the amounts, is already public on that blockchain (Robinhood Chain, Base, BNB Chain or Solana) and stays there.
• A transfer to one of our addresses that we cannot match to a purchase is recorded too (chain, transaction, sending address, amount), so we can act on a claim (Terms, section 7a).
• For creators, the payout records: amounts, fees, the exchange rate used, the destination wallet and the transaction that paid you.

Collected automatically

• Technical logs: IP address, user agent, request path and outcome, and timestamps. Every action that changes something on the platform is recorded in an audit trail with the acting account, the time and a redacted copy of the request (signatures, keys and tokens are never stored in it).
• Basic device information needed to pick the right sign-in path (for example whether you are inside a wallet app’s own browser, and which wallets your browser offers).
• Google Analytics (Google’s, run through Firebase), when it is on for your browser (section 8): the pages you view, a few game events (signing in, voting, trading, closing a position), your device, browser and screen, your approximate location (country and city, which Google derives from your IP address), how you arrived, and a random analytics id kept in cookies. We do not send Google your wallet address, handle or messages. Google signals and ad personalization are turned off.
• Visit and action records: when a page loads, a random visitor id kept in your browser, the page, the referring site, the campaign tags in the link (utm_source, utm_medium, utm_campaign), the device kind and your country (from Cloudflare; the IP address itself is not kept in this record). For each action or page error, the page and which step succeeded or failed and why, under that id and a random id for the browser tab. They are linked to your guest session or, once you sign in, your account. We use them only to see which links bring players and to find and fix failures; they set no cookie, never hold your wallet address or email, and are not shared.

From the Telegram community

Our community bot reads messages in the MemeTrader Telegram group so questions can be answered. It records the sender’s Telegram user id, display name and message text for that purpose. Group members are told this in the group.

What we do not collect

No advertising pixels run on the arena. Google Analytics runs only as your choice in section 8 allows; our own visit and action records (above) run whatever you choose there. If that changes, this policy and the site will say so and ask for consent where the law requires it.

3. Why we use it

• To run the game: rounds, rankings, votes, signals, chat.
• To create your account, sign you in and keep your sign-in methods and linked wallets (performance of a contract), including carrying a guest run over to the account you register.
• To sell and deliver perks, pay creators, keep accounts, and resolve payment problems (performance of a contract).
• To prevent fraud and abuse, enforce the Terms, protect the service and handle claims about transfers we could not attribute (legitimate interests, and legal obligations).
• To keep tax, payment and audit records the law requires (legal obligations).
• To understand how the site is used and improve it: Google Analytics (consent where we ask for it, legitimate interests elsewhere; you can turn it off any time).
• To see which links bring players and to find and fix failures: the visit and action records (legitimate interests).
• To send the notifications you turned on (consent; turn them off any time).
• To answer you when you contact us.

Where EU or UK law applies, our legal bases are the ones in brackets above, plus consent where we ask for it.

4. What is public

Your wallet address, handle, trades, positions, profit and loss, rankings, votes, follows, signal subscriptions you sell, sponsor banners and chat messages are visible to everyone. Round trade logs may be committed to Robinhood Chain as permanent, public records. Please do not put anything private in a handle, a banner or chat.

5. Who we share it with

• Hosting and network providers: Google Cloud (servers and backups, United States) and Cloudflare (network, security).
• Blockchain RPC providers when we read your wallet balance, verify a payment or watch our treasury addresses (Solana RPC providers; the EVM chains’ public endpoints only for the records of the payments we accepted there until 10 October 2026). They see the address or transaction and our server’s IP. When you pay, your wallet talks to its own RPC provider, under the wallet’s terms.
• Block explorers (Solscan; for an older record Blockscout for Robinhood Chain, Basescan or BscScan) when you follow a transaction link from your ledger or a payment page: your browser fetches the page from them, and they see your IP address.
• Google (Firebase Authentication), when you sign in with Google or an email link: Google verifies the sign-in and sees your email address or Google account, your IP address and browser, under Google’s terms, in the United States. The sign-in link emails are sent by Google on our behalf. Our servers verify the resulting token with Google’s public keys; Google receives nothing about your game from us.
• Sentry (error monitoring): when something breaks, the request URL, method, user agent and stack trace are sent to Sentry so we can fix it; IP addresses are not sent by default.
• Google (Firebase / Google Analytics): the usage data described in section 2, processed in the United States under Google’s terms, only while Google Analytics is on for your browser.
• Browser push services (Google, Mozilla, Apple, Microsoft) deliver the notifications you turned on. The message is encrypted end to end; they see only its size and timing.
• Anthropic (Claude), which generates the token creator’s content: it receives your description and the token’s generated text, never your account details.
• Pinata, which publishes your token’s image and description on IPFS when you launch it — public and permanent by design.
• Telegram for the community bot and operational alerts to us.
• Authorities or third parties when the law requires it, or to establish or defend legal claims.

We do not sell personal information and we do not share it for third-party advertising.

6. How long we keep it

• Payment and payout records: seven years, for tax and accounting law.
• Visit records: up to 24 months. Action records: 90 days, then only daily totals with no id.
• Google Analytics data: at most 14 months, kept by Google.
• Push subscriptions: until you turn notifications off, or your browser’s push service tells us the address no longer works.
• Audit trail and security logs (including IP addresses): up to 24 months, longer only for records tied to a payment, a dispute or an investigation.
• Guest sessions: the session and its handle are anonymised 90 days after your last activity; the round records it played stay in the game history under the anonymised name. Encrypted backups can hold the record for up to 30 more days. A guest run you register is no longer a guest session — it is your account’s.
• Email addresses, Google ids and linked wallets: for as long as your account exists (a wallet you unlink is marked unlinked, not erased, so its history stays attributable), then as described in section 7.
• Game data (trades, rankings, votes) and chat: for as long as your account exists, then as described in section 7.
• Blockchain records: permanent; we cannot delete them.

7. Your rights

Depending on where you live you may have the right to access, correct, export or delete your personal information, to object to or restrict some processing, to withdraw consent, and to complain to a supervisory authority. California residents may also ask what we collect and share; we do not sell personal information and do not discriminate for exercising rights.

To exercise a right, email support@memetrader.fun and prove the account is yours: by signing a message from a wallet linked to it, or by writing from the email address the account signs in with. We answer within 30 days. On a verified deletion request we remove or anonymise your handle, chat messages and off-chain game history, and unlink the wallets, email and Google account; we keep what the law requires (section 6) and cannot alter what is already on a public blockchain.

8. Cookies and local storage

The site stores in your browser’s local storage: your session token, your handle, a random visitor id for the visit and action records, preferences such as sound and your Google Analytics choice, the wallet-connection state (which wallet you signed in with) and, while an email sign-in is in progress, the address the link was sent to; Firebase Authentication keeps its own sign-in state in the browser’s storage when you use Google or email. Each tab also keeps a random id for the action records in its session storage while it is open. Clearing site data signs you out. If you turn notifications on, the browser also keeps a service worker for this site that only shows them.

One first-party cookie. When you play as a guest the site sets memetrader-guest: a strictly necessary, HttpOnly cookie that holds your guest session so the game can find your run again. It is renewed on activity and expires 90 days after your last activity. It is not used for tracking and holds nothing but the session.

Google Analytics cookies. While Google Analytics is on, it sets cookies on memetrader.fun (_ga, _ga_…) that hold a random id, so repeat visits count as one visitor. If your device is set to a European time zone we ask before it runs, and it stays off until you allow it. Everywhere else it is on unless you turn it off here, or your browser sends a Global Privacy Control signal, which we treat as turning it off. Turning it off also deletes those cookies.

We do not track you across other sites and do not respond to Do-Not-Track signals (we do honour Global Privacy Control, above).

9. Children

The service is for people 18 and older. We do not knowingly collect information from anyone younger; if you believe we have, tell us and we will delete it.

10. Security

We store no passwords: you sign in by signing a message with your wallet, through your Google account, or through a one-time link sent to your email. We never hold your keys or the funds you trade with. Card data never touches our servers. API keys are stored hashed. Servers are in access-controlled cloud infrastructure with encrypted backups. No system is perfectly secure; report vulnerabilities to support@memetrader.fun (see also /.well-known/security.txt).

11. International transfers

We operate from the United States and store data there. If you use the service from elsewhere, your information is transferred to and processed in the United States under the safeguards available to us, including contractual protections with our providers.

12. Changes

We will post changes here with a new effective date and announce material changes on the site.

13. Contact

MemeTrader is a product of Qara, operated by Jura Capital LLC — support@memetrader.fun.