privacy policy

scope

copy is operated by polycool llc, a delaware limited liability company. this policy covers the web app at copy.top, including its account pages (/export, /fund, /security, /fund-instant), and the copy ios app. using copy also means accepting our terms of use. copy is the web app of copyfomo: it shares its accounts, wallets and copy engine with copyfomo on telegram, @copyfomo_bot, whose own use is described in the copyfomo privacy policy. copyfomo is operated independently and is not affiliated with fomo.

sign-in is handled by privy, our authentication and wallet provider. we never see a password.

with telegram. telegram's login confirms your account to privy, which passes us your telegram profile (user id, username, first name); we keep the id and the username. if you already use @copyfomo_bot with the same telegram account, the web opens that same account: same wallet, same copies.
with google (when it is offered). google shares your email address and your name with privy. we read them from privy to show which account you are signed in with; our database keeps your privy account id, not your email.
with apple (in the ios app). apple shares with privy the email you choose to share (it can be a private relay address) and, the first time, your name. as with google, our database keeps your privy account id, not your email.

privy keeps your sign-in session in your browser. each request to our server carries a short-lived privy token that we verify; we do not keep it.

your wallets

no wallet is created when you sign in. when you choose to deposit, our server asks privy to create your wallets for your account:

an evm wallet and the smart account it controls: the smart account is your deposit and trading address on evm networks;
a solana wallet.

the private keys live with privy; we never see or store them. when the wallets are created, our service is added as an authorized signer (delegated signing): that is how copy can place the trades you set up while you are away. it uses that permission to carry out what you ask for: copying the traders you follow, your orders, sales, take profit and stop loss, moving your deposits between the networks you trade on, the fees described in the docs, and the withdrawals you confirm. a withdrawal from copy.top asks for your signature and your authenticator code (2fa is turned on before the first one). you can export your private key at any time from /export; the key is shown by privy, in your browser, and never passes through our servers.

what we store

our database (hosted by supabase) keeps what the service needs to work:

your account: internal id, privy account id, telegram id and username (telegram sign-in), referral code, sign-up date and last activity;
your wallet addresses and their on-chain activity: deposits, trades, positions, withdrawals;
what you do on the web: the traders you copy and their settings (size, filters, take profit, stop loss), your buy orders (market and limit), your sell requests, your withdrawal requests and their 2fa challenges, and the notifications we send you.

on-chain transactions are public by nature. copy does not add any personal information to them.

cookies and browser storage

one cookie of ours: copy_s=1, set after you sign in and removed when you sign out (30 days). it only tells our server to load the version of the app that can sign in. it carries no identifier.
invite links: when you open a friend's invite link (copy.top/r/…), we keep their invite code for 30 days, in a cookie (copy_ref) and in your browser storage, so they get credited if you sign up. it holds the code, nothing about you.
browser storage: privy's session, and a few display preferences (your discover filters, the last notification you saw). they stay in your browser.
google ads: copy.top loads the google tag (gtag.js) to measure which of our ads bring visits and sign-ups. google sets its own cookies on copy.top (such as _gcl_au, and _gcl_aw when you arrive from an ad) and receives the page you open, the ad click id and your browser details. google handles this data under its own policy: how google uses information from sites that use its services.
no other analytics. the funding pages (card, apple pay) embed their providers' widgets, which follow their own privacy policies.

server logs

the app runs on railway. like any web server it logs requests (ip address, time, page) for operations and security. when the app crashes in your browser, it sends us the error and the page it happened on, so we can fix it. your ip address is also used, in memory only, to limit how fast one visitor can call our api.

when you use the copy ios app, we also use your ip address to tell which country you connect from, so we can apply the country restrictions in our terms of use. the lookup runs on our own servers against a local database: your ip address is not sent anywhere for it. IP Geolocation by DB-IP (licensed under cc by 4.0).

trader data shown

the traders on copy are public wallets. their statistics come from public on-chain and fomo data; an x account is shown next to a trader only when it is linked from their public fomo profile or from public wallet data. names, handles and photos belong to their owners; a trader who wants a page removed can contact us and it will be taken down. token prices and logos come from public market data; logos load from the image servers of those providers (for example dexscreener).

we do not sell personal data. we do not transfer it to third parties for purposes unrelated to the service, and we do not use it for credit or lending. it is shared only with the providers that run the service, bound by their own terms: privy (sign-in, wallets, 2fa), supabase (database), railway (hosting), telegram (sign-in with telegram, and our telegram messages), google (sign-in with google, and measuring our google ads), the funding providers you choose to use (card: moonpay; apple pay: unifold), which receive your deposit address, an account reference and what you enter in their widget, and the blockchain networks and node providers that read balances and carry transactions.

retention and deletion

account data is kept for as long as your account is active. you can delete your account at any time: in the ios app (account › delete account), or by asking us on telegram or by email (below). deleting your account removes your sign-in at privy, your wallet links, your copies and their settings, and your sign-in details from our database; a copy of the deleted records is kept for 30 days, so a mistake can be investigated, and then erased. we keep the trades, deposits and withdrawals already made (without your identity) for accounting and legal reasons. on-chain history cannot be deleted: it lives on public blockchains. your wallets stay yours: export your key before deleting your account if funds are still on them.

contact

polycool llc · questions or deletion requests: huylisse2@gmail.com, t.me/copyfomo_bot, or @copytop_ on x.