Privacy Policy
Last updated October 29, 2026
This policy explains what personal data noct collects, what we do with it, who we share it with, and your choices. The short version: we never hold your keys or your money, your trades and posts are public by design, and we don’t sell your data.
1. Who we are
We run noct and decide how the personal data described here is used. You can reach us about privacy at privacy@noct.trade.
2. What we collect
When you sign in. Through Privy, our sign-in provider: your Privy account id, your wallet address, and the sign-in methods you link (your email address, your Google email, your X username, or that you use a passkey). Privy holds these too, under its own policy.
Your profile. Your username, name, bio, avatar and banner (pictures you choose or upload).
The private beta. When you joined, your place on the waitlist, who brought you, the invite code you used, and when and how you were let in (or had access taken away).
What you do socially. Your posts, replies, likes and reposts, who you follow, the share links you create, who referred you and who you referred, and your notifications.
Your trades. We read your fills, positions and their results from the venues’ public trade history (Derive, by your wallet’s subaccounts; Hyperliquid, by your wallet, including stock markets on trade.xyz; Polymarket, by your Predict wallet), and keep them to show your positions, profile, P&L and the leaderboard, and to keep the fee and rewards ledger. When you place a trade, the app also tells us which trade it is and which link it came from.
Auto-copy and auto-collect. When you turn on auto-copy, we keep who you copy and your settings, every trade we copied or skipped for you and why, and the key your wallet authorised for it, encrypted. Auto-collect uses the same key to collect your settled Predict winnings, and we keep a record of each collection. We destroy our copy of the key when you stop auto-copy, revoke it, or delete your account. Our backups keep it, still encrypted, for up to 30 days after that, and then it's gone from them too.
Rewards and points. The rewards and cashback you earn, your claims and their payments, and your points by season and how you earned them.
Money in and out of your balance. We read the USDC transfers to and from your wallet on Arbitrum (public on that chain) to notify you of deposits, withdrawals, moves to and from Perps and rewards paid.
Your past usernames. When your username changes we keep the old one against your account, so links you shared under it keep crediting you and nobody else can take it.
Where you are. The country your requests come from, as Cloudflare (which sits in front of noct) reports it from your IP address, and the country you tell us you live in. We use these to decide what you can trade, and the country also helps us run the waitlist. We don’t keep your IP address in our database.
When you were last here. The last time you used noct, to the nearest few minutes, so we read your trades more often while you're active and can see who's waiting on the waitlist.
Technical data. Cloudflare and our servers keep standard request logs (IP address, browser, pages, times) for a short period for security and debugging.
Reports and moderation. Reports you send about posts or people, and a log of anything our team does to your account or content (for example removing a post, suspending an account, or giving or taking away access).
Your email address. The email you sign in with (or your Google account's), kept with your account so we can tell you when you're let in from the waitlist. We send it through Resend, our email provider. We don't send marketing to it.
Push notifications. If you turn them on, the push address your browser gives us for that device, so we can send notifications to it. Turn them off in Notifications, or in your browser, and we delete it.
On your device only. Your trading session key, your sound, display and layout preferences, your watchlist, price alerts and the wallets you track, and a small cookie that remembers you were signed in are kept in your browser. The session key never leaves your device; we never receive it. A picture you put behind your P&L card is drawn in your browser and never uploaded.
What we never collect: your wallet’s private key or recovery phrase, and your card or bank details (those go only to the payment provider you choose).
3. How we use it, and why we’re allowed to
- To provide noct: sign you in, build and route your trades, show your portfolio, run the feed, profiles, share links and notifications. (Necessary to perform our contract with you.)
- To tell you you're in: one email when you're let in from the waitlist. (Necessary to perform our contract with you.)
- To keep the fee and rewards ledger and pay referral and sharing rewards. (Contract, and our legal obligation to keep accounting records.)
- To apply the law: decide which products are available where you are, and comply with sanctions and other legal requirements. (Legal obligation and legitimate interests.)
- To keep noct safe: prevent fraud, abuse of the rewards program and attacks, and fix problems. (Legitimate interests.)
- To improve noct, using aggregated information about how it’s used. (Legitimate interests.)
4. What is public
noct is a social trading app. Your username, name, avatar, bio, trades, their results, your P&L, your rank, your followers and your posts are public: anyone can see them on noct and in share cards, including people who aren’t signed in. Your email address, sign-in methods and declared country are never shown.
Your wallet address and your trades are also public on the venues (Derive, Hyperliquid, Polymarket) and on the blockchains they settle to, independently of noct.
5. Who we share it with
We don’t sell your personal data or use it for advertising. We share it only with:
- Privy, for sign-in and your wallet.
- Derive, Hyperliquid and Polymarket, the venues, which receive your signed trading requests through noct, with your wallet address. When you claim rewards, noct sends them to your wallet’s address on Arbitrum, a public transaction.
- Relay, which receives your wallet address, the amount, and the destination address and chain when you add money from another chain (noct’s server asks Relay for your deposit address, always for your own wallet), move money between your balance and a venue, or withdraw to another chain or token. Your balance, the USDC in your wallet on Arbitrum, is public on that chain, as any wallet is.
- Live price feeds: for live prices your browser connects directly to Hyperliquid and Polymarket (and Derive), which see your IP address as any website does.
- Payment providers, when you buy USDC with a card, Apple Pay or Google Pay; they collect what they need under their own policies.
- Cloudflare, which delivers noct and hosts these documents and the guides, protects it from attacks and reports the country your requests come from.
- Vultr, which runs our servers and database, in Japan.
- X, when you choose to post a trade there.
- Resend, which sends our emails, with your email address and the message.
- Your browser’s push service (Apple, Google or Mozilla), which delivers the notifications you turn on.
- Authorities, when the law requires it, and a buyer or successor if noct’s business is transferred, under this policy.
6. International transfers
noct's servers and database are in Japan, and our providers process data in several other countries, including the United States. Where the law requires it, transfers are covered by appropriate safeguards such as the European Commission’s standard contractual clauses.
7. How long we keep it
- Your profile and social activity: until you delete your account.
- Your trades and the fee and rewards ledger: as long as accounting and legal obligations require, usually up to 7 years, even after you delete your account (kept against your bare account number, with your profile removed).
- Request logs: up to 30 days.
- Waitlist and access records: until you delete your account.
- Reports and the moderation log: as long as needed to keep noct safe, up to 2 years.
8. Your rights and choices
Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another service. You can also complain to your data protection authority.
Delete your account from your profile settings. That removes your profile, posts, replies, likes, follows and notifications at once, and removes your name, avatar and wallet from anything kept for accounting. It doesn’t delete what’s on the venues or on-chain, which we don’t control, and it doesn’t close your positions: close them and withdraw first.
For anything else, write to privacy@noct.trade. We’ll answer within a month. We don’t discriminate against anyone for using these rights.
9. Security
We protect data with encryption in transit, access controls and providers with strong security practices. noct is built so that we never hold your keys or your funds. No system is perfectly secure; if a breach affects you, we’ll tell you and the authorities as the law requires.
10. Children
noct is only for people 18 and over. We don’t knowingly collect data about anyone younger; if we learn we have, we delete it.
11. Changes to this policy
We may update this policy. If a change is significant, we’ll tell you in the app before it takes effect. The date at the top shows when it last changed.
12. Contact
Privacy questions and requests: privacy@noct.trade.
See also our Terms of Use.