Privacy Notice

1. SCOPE

This Privacy Notice ("Notice") applies specifically to the use of the website and leaderboard operated by Pyth Data Association with registered office at Grabenstrasse 25, 6340 Baar, Switzerland ("Association", "we", "our") at https://www.letsrally.xyz/ ("Site"). It describes how personal data of Users, as defined in the Terms of Use, is collected, processed, and protected in connection with the operation of the Site.

This Notice supplements, and does not replace, the Association's Privacy Policy. To the extent of any inconsistency, this Notice governs in relation to the Site and related services.

This Notice should be read together with the Terms of Use of the Site, which set out the contractual framework, defined terms (including "User", "Account", "Wallet", and "Leaderboard"), and other important conditions applicable to your use of the Site.

2. CONTROLLER

The Controller responsible for the processing of personal data in connection with the Site and the Leaderboard is the Association, privacy@pyth.network.

3. VOLUNTARY DATA; UPDATES & DELETION

Providing personal data for the Leaderboard is voluntary. Users may: (a) create an Account; (b) choose a public username; (c) link a Gmail address for sign-in and communications; and (d) optionally submit a public Wallet address and social media identifiers (e.g., Twitter/X, Discord) to enable matching of activity metrics. Users may update or delete these data at any time via Account settings; certain features (including ranking accuracy/availability) may not function without such data.

4. PURPOSES OF PROCESSING

We process personal data solely for the following purposes:

• Account & Authentication: account creation, sign-in, session management, security (e.g., fraud prevention, abuse prevention);
• Attribution & Ranking: attributing on-chain trading activity to submitted wallet addresses and off-chain engagement statistics to submitted social identifiers; generating, sorting, and displaying aggregated statistics on the Leaderboard;
• Operations & Security: operating, maintaining, troubleshooting and securing the Site and the Leaderboard (including logs, telemetry, and incident response); and
• User Communications: contacting Users regarding Account or Leaderboard (email communications are sent to the Gmail address used to create the Account).

5. PUBLIC VS. NON-PUBLIC DATA

Publicly displayed (visible to all Site visitors): your chosen username together with aggregated statistical outputs that the Leaderboard generates (e.g., trading volumes, engagement scores, relative rankings). These elements are openly accessible on the Site and may be viewed, sorted, or shared by third parties. Choose your username with care; it functions as your public identifier on the Leaderboard.

Not publicly displayed (backend only): your Gmail address, the Wallet address you submit, and any social media identifiers (e.g., Twitter/X handle, Discord username). These are not published on the Leaderboard and are processed solely in the backend to attribute and compute aggregated statistics. Association does not request or store private keys, seed phrases, or transaction authorization data. For clarity, third parties will never see your Gmail address, Wallet address, or social media identifiers through the Site; they will only see aggregated results linked to your chosen username.

6. PROCESSORS

Association engages the following service providers under data processing agreements; they process personal data exclusively on our instructions for the purposes stated below:

Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA (Account & Identity). Clerk, Inc. provides sign-in, authentication (incl. social login), session, MFA, and user account management. Processed data typically include: Gmail/email address, internal user IDs, chosen username (if stored as an attribute), and authentication/security metadata (e.g., IP address, device/browser information, timestamps, session tokens, login outcome). Clerk may use standard analytics/telemetry to secure and improve its services, without using User data for independent marketing to Users. For further information, please see Clerk Privacy Notice / DPA.

Convex Systems, Inc., 548 Market St, PMB 73135, San Francisco, California 94104-5401, USA (Backend/Leaderboard Infrastructure). Convex Systems, Inc. provides database and real-time infrastructure for storing and synchronizing Leaderboard data. Processed data typically include: public username, internally stored mapping references for Wallet and social identifiers (non-public), aggregated/derived statistics, and operational/security logs (e.g., IP address, timestamps, user-agent) as technically necessary. Where permitted by law, Convex may use de-identified/aggregated data to improve service quality and detect security incidents as described in its DPA.

Google (Gmail Login). If Users choose Gmail to sign in, Google (as identity provider) shares limited profile data (typically name and email) with Association and Clerk upon the User's consent to complete authentication. We do not receive Google account passwords or email contents. Processing by Google is governed by Google's own privacy notice.

7. LEGAL BASIS

Processing is carried out under Swiss data protection law. Depending on context, the legal bases (where required) include contract performance (Account and Leaderboard provision) and our overriding interests in secure operation, fraud prevention, and accurate attribution and ranking. Where applicable, consent is obtained (e.g., to initiate Gmail login).

8. INTERNATIONAL TRANSFERS

Personal data may be processed in or transferred to jurisdictions outside Switzerland/EU/EEA (notably the United States) by Clerk and Convex. These providers implement appropriate safeguards, including participation in the Swiss-U.S. Data Privacy Framework (Clerk) and/or Standard Contractual Clauses and comparable measures (Clerk/Convex), to ensure an adequate level of data protection.

9. RETENTION & DELETION

We retain personal data only as long as necessary for the operation of the Leaderboard and the User's Account. Upon account deletion or request, associated personal data are deleted or irreversibly anonymized within up to 90 days, subject to longer retention where required by law or for legitimate interests (e.g., security logs, fraud prevention). Backups may persist for limited periods and are then purged according to provider schedules.

10. SECURITY

We and our processors implement appropriate technical and organizational measures to protect personal data, including access controls, encryption in transit (and at rest where supported), and logging. No system is 100% secure; we will notify Users of data breaches as required by applicable law.

11. NO SALE; NO AUTOMATED DECISIONS

We do not sell Users' personal data and do not conduct automated individual decision-making producing legal or similarly significant effects for Users in the context of the Leaderboard.

12. UPDATES TO THIS PRIVACY NOTICE

This Notice constitutes a supplemental privacy notice specific to the Leaderboard. It may be updated to reflect changes in processing or providers. Material changes will be communicated by email to the Gmail address associated with the Account and/or via in-product notice. The latest version applies upon publication.