Legal

Privacy Policy

Effective 9 September 2026 · Version 1.0

This Policy explains how Bomba Labs, Inc., a corporation incorporated in the State of Delaware, United States (“Bomba”, “we”, “us”), collects, uses and protects personal data when you use the Bomba mobile application and this website (the “Service”). Bomba Labs, Inc. is the controller of that data.

1. The short version

We collect as little as we can. We never hold your private keys. We never receive or process your payment card or bank details — those go directly to the licensed payment provider you choose. We do not sell personal data and we do not share it for advertising.

2. What we collect

Account data. An email address or other identifier you use to sign in, and the public address of the wallet created for or connected by you.
Device and technical data. Device model, operating system version, app version, language and region settings, IP address, crash reports and diagnostic logs.
Usage data. Which screens you open and which features you use, so we can find defects and improve the product.
Support data. The contents of any message you send us.
Public blockchain data. Transactions you sign are recorded on public blockchains by design. We read that public data to show you your positions. We do not control it and it cannot be deleted or altered by us or by you.

3. What we never collect

Private keys, seed phrases or recovery secrets. The wallet is self-custodial; key material is handled by our third-party wallet infrastructure provider and by you. We cannot access it.
Payment credentials. Card numbers, bank details and the identity documents required for a payment provider’s own verification are submitted directly to that provider and are never received or stored by us.
Special-category data. We do not seek data about health, beliefs, political opinions, biometrics or similar.

4. Why we use it, and on what legal basis

To provide the Service — to create your account, display your positions and let you submit transactions. Basis: performance of a contract with you.
To keep the Service secure and working — to detect abuse, prevent fraud, diagnose crashes and fix defects. Basis: our legitimate interests in a secure, functioning product.
To communicate with you — service messages, security notices and replies to your support requests. Basis: contract and legitimate interests.
To comply with law — where a legal or regulatory obligation applies to us. Basis: legal obligation.

We do not use your personal data for automated decision-making that produces legal effects for you, and we do not use it for behavioural advertising.

5. Who we share it with

We share personal data only with service providers who process it on our behalf under contract, and only as far as needed:

Wallet infrastructure — to create and secure your self-custodial wallet.
Payment providers — where you choose to fund your wallet, you deal with the provider directly under its own privacy policy and its own terms; we may receive the status of a transaction, but not your payment credentials.
Cloud hosting, error monitoring and product analytics — to run and maintain the Service.
App distribution — Apple, in connection with distributing and installing the application.
Professional advisers, and authorities where we are legally required to disclose, or where disclosure is necessary to establish or defend legal claims.

If Bomba is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy.

We do not sell personal data and we do not share it with third parties for their own marketing.

6. International transfers

We are established in the United States and our service providers may process data in the United States, the European Economic Area and elsewhere. Where data is transferred out of the EEA, the United Kingdom or Mexico, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

7. How long we keep it

We keep personal data only as long as needed for the purposes above: account data for as long as your account is active and for a reasonable period afterwards; technical and usage logs typically for up to 24 months; support correspondence for up to 24 months after the matter is closed. We keep data longer only where a law requires it or where it is needed for a legal claim.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict our processing of it, to receive a portable copy, and to withdraw consent where processing is based on consent. Users in Mexico have the ARCO rights (access, rectification, cancellation and opposition) under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares.

To exercise a right, write to hello@trybomba.xyz. We will respond within the period required by the law that applies to you. You also have the right to complain to your local data protection authority.

Please note that we cannot delete data recorded on a public blockchain, and we cannot delete data held by a third-party payment provider — those requests must go to that provider.

9. Security

We use encryption in transit, access controls and the principle of least privilege, and we limit the personal data we collect in the first place. No system is perfectly secure. If a breach affects your personal data and the law requires it, we will notify you and the relevant authority.

10. Children

The Service is not directed to anyone under 18 and we do not knowingly collect personal data from children. If we learn that we have, we will delete it.

11. Cookies and this website

This website uses no advertising cookies and no third-party tracking. It loads a web font from Google Fonts, which involves a request to Google’s servers from your browser.

12. Changes

We may update this Policy. The current version is always published at this address with its effective date, and we will notify you of material changes in the application or by email where we hold your address.

13. Contact

Bomba Labs, Inc.
hello@trybomba.xyz