Privacy Policy

Scope and responsibility

MARTIN PAGA LLC operates Leap and is responsible for the personal information described in this policy, including as controller where applicable data protection law uses that term. This policy covers leap.trade and app.leap.trade, including accounts, managed wallets, funding, trading and rewards. It also covers related service communications. Third-party websites, wallets and networks have their own privacy practices. Our Terms of Service govern use of Leap.

Personal information we collect

Information depends on the features and sign-in methods you use.

Account and identity. Name, username, email address, sign-in provider identifiers, verification status and linked wallet addresses. Email-password accounts store a password hash.

Wallets and activity. Managed-wallet addresses and encrypted private keys; balances, orders, fills, deposits, withdrawals, transaction identifiers, copy-trading settings, referrals and rewards records.

Technical and security. IP address, browser user agent, session records, authentication challenges, request and error logs, security events and account audit records.

Communications. Information you provide in questions, support correspondence or privacy requests, and records needed to respond.

Where information comes from

Information comes directly from you, automatically from your use of Leap, and from services you interact with through Leap. Sources include Google sign-in, connected wallets, exchange and blockchain providers, and public transaction records. We create account, managed-wallet, security and rewards records while providing the service.

Google sign-in and Google user data

Google sign-in is optional. If you choose to sign in with Google, Leap accesses only the Google account information necessary to create or link your Leap account and authenticate you.

Depending on the permissions requested during Google sign-in, Leap may receive:

• Name, which is used to create and display your Leap account profile.
• Email address, which is used to create or link your Leap account, authenticate your account, and send account-related and security communications.
• Google account identifier, which is used to identify your Google account and associate it with your Leap account.

Leap does not request access to Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, or other Google services as part of its standard Google sign-in flow.

How Google user data is used

Google user data is used only as necessary to:

1. create or link your Leap account;
2. authenticate you when you sign in with Google;
3. maintain your Leap account and profile;
4. protect your account and detect unauthorized access; and
5. send necessary account and security communications.

Leap does not use Google user data for advertising or targeted advertising. Leap does not use Google user data to determine your eligibility for advertising or to create advertising profiles.

Google authentication credentials

We validate your sign-in with Google and use the credentials or tokens provided through the Google sign-in process only as necessary to authenticate your account and obtain the Google account information described in this section.

We do not retain Google OAuth credentials longer than reasonably necessary for the authentication process. We do not use Google credentials to access Google services or information that you have not authorized.

We do not request refresh-token access or access to Gmail, Drive, contacts, calendars, or other Google services as part of our standard Google sign-in flow.

Google processes its sign-in flow under its Privacy Policy.

Storage and retention of Google user data

Leap may store the Google account identifier, name and email address associated with your Leap account as part of your account records.

This information may remain associated with your Leap account for as long as reasonably necessary to provide the service, maintain account security, prevent fraud and abuse, comply with legal obligations, resolve disputes, maintain necessary business records, and enforce our agreements, subject to applicable law and your privacy rights.

Signing out of Google does not automatically delete information previously stored in your Leap account.

If you close your Leap account or request deletion, we will handle Google-derived account information in accordance with the deletion and retention provisions of this Privacy Policy and applicable law.

Sharing and transfer of Google user data

Leap does not sell Google user data.

Leap does not share Google user data with third parties for their own advertising, targeted advertising, or marketing purposes.

Leap may disclose Google-derived information to service providers acting on our behalf when reasonably necessary to provide or secure Leap. For example, our email delivery provider, Resend, may receive your email address when necessary to send an account or security email.

Service providers receive only information reasonably necessary to perform their functions and are subject to contractual or other appropriate restrictions where required by applicable law.

Google-derived account information is not provided to blockchain, exchange, wallet, bridge, or market-data providers merely because you use those services through Leap. Those providers may separately receive wallet addresses, transaction information, or other information necessary for the particular feature you use, as described elsewhere in this Privacy Policy.

We may also disclose information when required by law, legal process, or governmental request, or when reasonably necessary to investigate abuse, prevent fraud, protect users or the service, resolve disputes, or enforce our agreements.

Google Limited Use

Leap's access to and use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Google user data is used only for the purposes described in this Privacy Policy and is not sold or used for advertising purposes.

Leap does not transfer Google user data to third parties except as permitted by the Google API Services User Data Policy and as necessary to provide or secure the service, comply with law, or otherwise as described in this Privacy Policy.

If our use of Google user data changes, we will update this Privacy Policy before the new use takes effect where required and will provide any additional notice or obtain any consent required by applicable law or Google's requirements.

Purposes and legal bases

We process information to authenticate accounts, provide managed wallets, execute authorized instructions, display activity, administer rewards and answer requests. Where applicable, this supports performance of our agreement with you. Security checks, fraud prevention, service reliability and dispute handling support legitimate interests, subject to applicable law and your rights. We also process information to meet applicable legal obligations and rely on consent where required. Consent can be withdrawn without affecting earlier lawful processing. Information needed for an account or transaction must be available for us to provide that feature.

Service providers and other disclosures

Operational providers include Railway for hosting, Google for its sign-in component, Resend for service emails, Hyperliquid for exchange activity, RPC providers for blockchain access, Across and Circle for supported deposits and cross-chain transfers, and WalletConnect or LI.FI for wallet and bridge features. GoldRush may provide market data when enabled. These services receive information relevant to their functions, such as email recipients, wallet addresses or transaction details. Third-party services may process information under their own policies. We may also disclose relevant records when required by law or needed to investigate abuse, resolve disputes or protect users and the service.

Information visible to others

Rewards leaderboards can show your username or, if none is set, your managed-wallet address, together with rank and points. Your referrer can see your username, managed-wallet address, joining date and referral qualification status. Consider this visibility before choosing a username or using a referral code.

Public blockchain and exchange records can reveal wallet addresses and financial activity. Combining them with other information may identify you. Leap cannot erase or alter records held on independent public networks, even after account deletion.

Cookies and browser storage

Cookies and browser storage support sign-in, interface preferences and recovery of pending verification, funding or bridge requests. Protected sign-in cookies and temporary session tokens help secure accounts. You can clear or block storage through browser settings, but doing so may interrupt sign-in and pending actions. Google, wallet providers and other components may use their own storage when loaded or used. Their privacy policies explain those practices.

How long information is kept

Retention depends on the record's purpose, account activity, unsettled transactions, security needs, disputes and applicable obligations. Expired authentication records are periodically removed. Signing out does not delete account or trading history. Account closure and deletion requests require review of the records concerned; some may need to remain for legitimate operational or legal reasons. Public network records remain outside our deletion control. Contact us about retention of particular information.

Your rights and choices

Depending on applicable law, you may request access to or a copy of information, correction, deletion, portability, restriction of processing, or objection to certain uses. You may withdraw consent where processing relies on it and complain to the relevant data protection authority. Rights and exceptions vary by location.

Send requests to the contact below. We may verify ownership without asking for passwords or private keys. The app has no self-service account deletion control. Account closure may require separate arrangements for open positions or wallet balances; this does not remove applicable privacy rights. Disconnecting Google in your Google account settings does not erase existing Leap records and may affect future sign-in.

Security and managed-wallet custody

Leap generates managed-wallet keys, stores them encrypted and can decrypt them to sign authorized actions. Managed wallets are custodial. An externally connected wallet is separate; connecting it does not require its seed phrase. Safeguards include encryption, password hashing, session controls and authorization checks. No safeguard eliminates every risk. Protect your devices and credentials, and never include keys or seed phrases in correspondence.

International processing

MARTIN PAGA LLC is based in the United States. Hosting and service providers may process information in other countries, whose privacy laws may differ from those where you live. Where applicable, we use appropriate safeguards and comply with applicable requirements for international transfers of personal information. Contact us for questions about the processing of your information.

Children's privacy

Leap is intended for people aged 18 or older. It is not directed to children. If you believe a child has supplied personal information to Leap, contact us so we can investigate and take appropriate action.

In-product privacy notice

Leap provides privacy information within the product so that users can understand how personal information and Google user data are used. When Google sign-in is offered, Leap may display a notice explaining that Google provides Leap with your name, email address and Google account identifier for account creation, authentication, account maintenance, security and related communications. Users can access this Privacy Policy from the Leap website and within the product.

Changes to this policy

We keep this policy current as Leap, our data practices and applicable requirements change. The current version and its revision date will be published here. We will provide additional notice or request consent where required before using information for a new purpose.

Before any material change to how we access, use, store or share Google user data takes effect, we will update this policy and notify you through a prominent notice in Leap or by email, explaining the change and when it will take effect.

Before accessing additional types of Google user data or using Google user data for a new or materially different purpose than previously disclosed, we will provide the applicable notice and obtain consent where required.

Contact and privacy requests

Send privacy questions, complaints or requests by email or post. Include a reply address and enough information to identify your account and request, without account secrets.

Email: privacy@leap.trade