Updated

October 2026

Privacy Policy

Effective Date: October 9, 2026

Bullpen Labs, Inc. (“Bullpen”, “we”, “us” or “our”) provides the Bullpen websites, including https://bullpen.fi (the “Site”), the Bullpen mobile application and related software services (collectively, the “Services”). This Privacy Policy (“Policy”) describes how we collect, use, retain and disclose personal information when you sign in, use wallet, trading or social features, or contact support.

By visiting the Site, or using any of the Functionality, you agree that your user data (including your personal data and personally identifiable information (“personal information”) will be handled as described in this Policy. Your use of the Site or the Functionality, and any dispute over privacy, is subject to this Policy (including any applicable changes) and an applicable Terms of Use, including its applicable limitations on damages and provisions for the resolution of disputes.

Overview

Bullpen supports passwordless sign-in through Apple, Google or email with a one-time passcode. Account information and product analytics can be linked to your account.
Profiles, published social content and positions are visible to other users through the social and trading features. Bullpen does not display your wallet address to other users. Public blockchain records remain independently accessible.
Bullpen does not store raw IP addresses. Country or region information may be processed for geographic feature-availability controls.
Submitted text and images may be screened through OpenAI for content safety, including submissions that are rejected and never published.
Product analytics remains enabled. Bullpen does not currently offer an in-app analytics opt-out. PostHog session recording is not used in the current mobile application.
You can initiate account deletion in the app and request deletion of personal information by emailing [email protected]. See the retention and rights sections below.

How We Protect Your Privacy

Protect your sign-in account, device and wallet-access credentials. Do not disclose private keys, recovery credentials or sign-in codes to someone claiming to provide support. Funding providers may request payment or identity information within the checkout you choose; review the provider and its notice before providing information. Contact [email protected] about suspicious communications.

Because we value your privacy, Bullpen uses industry standard measures to protect against unauthorized access to, or unauthorized alteration, disclosure or destruction of data which is stored in our records. These measures include internal reviews of our data collection, storage and processing practices and standard measures, sensitive information is transmitted via Secure Socket Layer (SSL) technology, making our systems accessible only by those authorized with special access rights to such systems, and are required to keep the information confidential.

Nonetheless, we cannot guarantee perfect and absolute security of your personal information, as no method of transmission over the Internet and/or electronic storage is perfectly secure or invulnerable. However, should we become aware of a security breach, we will notify any affected user, so that they can take appropriate protective steps. Such notifications shall be issued by Bullpen in accordance with the applicable (local) laws and regulations, as well as Bullpen’s internal policies

The Information We Collect

We collect information about you directly from you and from third parties, as well as automatically through your use of our Site or Functionality.

Information We Collect Directly From You

You may browse the Site without registering with us or providing personal information, however certain information is collected from you as described below and for the purposes set out below.

Account and profile information. Account identifiers and email information received through Apple, Google or email OTP sign-in; your Bullpen account ID; and profile information such as your handle, display name, biography and avatar. Where legacy Telegram functionality is used, we may also process the Telegram handle needed for that feature.
Wallet, transaction and portfolio information. Wallet addresses and relevant public blockchain, venue, transaction and position information used to provide wallet access, trading, funding and portfolio features. Bullpen may receive route, transaction or funding-status information from the providers involved in your selected feature.
Social information. Theses, comments, replies and images you submit; follow relationships; user reports and blocks; and related content and metadata. Submitted content may be processed even when it is rejected and never published.
Support and communications. Messages, contact information, attachments, survey responses and other information you provide when contacting us or choosing to participate in communications or promotions.
Third-party funding information. Payment, identity-verification and other information requested by the funding provider for the checkout you select is handled under that provider’s notice. The information Bullpen receives depends on the feature and integration.
User-selected images. If you choose to upload an avatar or social image, we process the image you select. This does not mean that Bullpen accesses your entire photo library.

In addition, if you are providing personal information of third parties to us for specific purposes, you are responsible for ensuring that you have all required permissions and consents (including express consent from such third parties) to provide such personal information to us for such purposes and that our use of such personal information does not violate any applicable law, rule, regulation or order. If the third party withdraws their consent, you agree to notify us immediately.

Information We Collect Automatically

Usage and diagnostic information. Account and device/session identifiers; product interactions, searches and activity associated with use of the Services; browser, app, device and release information; and crash and performance information. Some information is linked to your account.
Country or region information used for geographic feature availability and related controls. Bullpen does not store raw IP addresses.

For additional information related to Bullpen’s use of cookies and other tracking technology please see the section “Our Use of Cookies and Other Tracking Mechanisms” below for more information.

How We Use The Information We Collect

We use the information we collect for the following purposes:

Provide our services

We use information to create and secure accounts; provide wallet, transaction, funding, portfolio, discovery and social features; display positions and published content through social/trading features; communicate about the Services; and respond to support inquiries.

Current and future personalization

Feeds are not currently personalized to individual users. We plan to introduce personalization and will update the applicable disclosures and obtain any required permissions before introducing new uses of personal information.

Improve and develop our services

We use product interactions and diagnostic information to understand how the Services are used, measure performance, diagnose problems, improve the Services and develop features. Analytics may be account-linked and is not all anonymous. Bullpen does not use stored raw IP addresses for research or analytics.

Offer promotions

If you subscribe to newsletters or choose to participate in promotional communications, we may use the information you provide to send relevant news, offers, promotions or event information. Marketing choices are described below. Any additional advertising or marketing use remains subject to applicable notice and permission requirements.

Other Uses

We may use your information to enforce any applicable Terms of Use, comply with the law, legal process or legal or regulatory obligations, exercise or defend legal claims, detect, prevent or address fraud, comply with law enforcement, regulatory and tax authority related requests (whether from the United States or from overseas), security or technical issues, or otherwise protect our property, legal rights, or that of others.

How We Share The Information We Collect

We may share the information we collect as follows:

Consent or direction. We may disclose information as described when you consent or direct us to do so, including information needed for a transaction or funding route you select.
Public social information. Profiles, published content and positions are visible to other users through the Services. Bullpen does not display your wallet address to other users. Public blockchain addresses and transactions may be viewed independently and associated with other information.
Service providers. We use providers for authentication, wallet infrastructure, transaction and funding routes, hosting, support, email delivery, analytics, diagnostics and content safety. Information shared depends on the provider’s function and the feature you use. Providers acting on our behalf are authorized to process information for those functions and applicable legal obligations. Independent transaction and funding providers may process information under their own terms and privacy notices.
Content moderation. We use OpenAI’s Moderation API to screen submitted profile text, avatars and social text/images before publication. Submitted content can contain personal information. Rejected text, reasons and related context may be retained by Bullpen; rejected avatars may be retained in private storage for safety and enforcement. This processing is distinct from publication and from OpenAI’s own handling of API requests.
Business transfers. We may disclose information in connection with an acquisition, merger, asset transfer, financing, bankruptcy or negotiations concerning such a transaction, subject to applicable protections.
Legal process and protection. We may disclose information when required by law or legal process, or to address fraud, threats, security incidents, violations of the Terms or legal claims.
Aggregated or de-identified information. We may use or disclose information that does not identify you for lawful purposes such as research and product improvement.
Except as described in this Policy or with your consent, we do not disclose personal information to third parties for their own direct marketing.

Our Use of Cookies and Other Tracking Mechanisms

We and our service providers may use cookies, local storage and similar technologies to support the Site and understand usage. Browser cookie settings apply to browser technologies and do not necessarily stop analytics collected by the mobile application. Our systems do not currently respond to browser “do-not-track” signals.

Cookies are alphanumeric identifiers that we transfer to your computer’s hard drive through your web browser for record-keeping purposes. Some cookies allow us to make it easier for you to navigate our Site and avail of the Functionality, while others are used to enable a faster log-in process or to allow us to track your activities. There are two types of cookies: session and persistent cookies.

Session Cookies

Persistent Cookies. Persistent cookies remain on your computer after you have closed your browser or turned off your computer. We use persistent cookies to track aggregate and statistical information about user activity.

Disabling Cookies

Most web browsers automatically accept cookies, but if you prefer, you can edit your browser options to block them in the future. The Help portion of the toolbar on most browsers will tell you how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. Visitors to our Site who disable cookies will not be able to browse certain areas of the Site or use the Functionality.

Third Party Analytics

We use PostHog for product analytics. It may receive your Bullpen account ID, profile name or handle and email, together with device/session identifiers and product events. These analytics help us understand usage and improve the Services. The current mobile application does not use PostHog session recording; product analytics remains enabled. There is currently no in-app analytics opt-out.

Third-Party Links

Our Site and the Functionality may contain links to third-party websites. Any access to and use of such linked websites is not governed by this Policy, but instead is governed by the privacy policies of those third party websites. We are not responsible for the information practices of such third party websites.

Personal Information

Security of My Personal Information

We have implemented commercially reasonable precautions to protect the information (including your personal information) we collect from loss, misuse, or unauthorized access, disclosure, alteration, or destruction. Please be aware that despite our efforts, no data security measures can guarantee 100% security.

Take steps to prevent unauthorized access to the Apple, Google or email account and device you use for passwordless sign-in, and to protect your wallet-access and recovery credentials. We are not responsible for losses caused by compromised credentials, subject to applicable law.

Data Retention and Deletion

We generally retain information associated with your account and use of the Services unless you delete it through available controls or request data or account deletion. We do not currently apply an automatic deletion schedule. This includes submitted content, support and service records, analytics and diagnostics, and safety records such as rejected submissions.

You can initiate account deletion at your profile → Settings → Legal and privacy → Delete account. You may also request deletion of personal information by emailing [email protected]. Before deleting your account, follow the wallet instructions available in the app to preserve access to assets you intend to keep. Public blockchain records cannot be erased by Bullpen. Some records may be retained where required by law or otherwise lawfully needed for security, fraud prevention or legal claims. Deletion requests are processed subject to applicable law and identity verification.

What Rights Do I Have Regarding My Personal Information

You may request access, a copy, correction or deletion of personal information by contacting [email protected]. Depending on your location and applicable law, you may also have rights to object to or restrict processing, obtain a portable copy, withdraw consent, opt out of specified uses or appeal a decision concerning your request. We may request information to verify your identity or authority before responding. We will use reasonable efforts to accommodate requests as required by law and explain any applicable retention or other exception. Copies may remain temporarily in backups, caches or archives subject to applicable requirements; public blockchain records and copies independently made by others are outside Bullpen’s control.

What Choices Do I Have Regarding Use of My Personal Information for Marketing?

We may send periodic promotional or informational emails to you. You may opt-out of such communications by following the opt-out instructions contained in the e-mail. Please note that it may take up to 10 business days for us to process opt-out requests. If you opt-out of receiving marketing emails about recommendations or other information we think may interest you, we may still send you non-marketing related e-mails.

Location of Information

Bullpen is based in the United States. Bullpen and its service providers may process information in the United States or other countries where they operate. Those countries may have different privacy protections from your country of residence. Applicable legal requirements and safeguards govern international transfers; this Policy does not represent that every provider stores all information only in the United States.

Children Under 13

The Services are intended for users who meet the legal-age and eligibility requirements in the Terms of Service and are not designed for children under 13. If we discover that a child under 13 has provided personal information, we will take steps to delete it as required by applicable law. Contact [email protected] if you believe a child has provided information.

If you have questions about our approach to privacy or would like to make a complaint, please contact us at [email protected].

Changes to this Policy

This Policy is current as of the Effective Date set forth above. We may change this Policy from time to time and will post any changes to this Policy on the Site. Your continued use of the Site and the Functionality after the posting of a modified Policy indicates your acceptance of these updated terms.

CALIFORNIA PRIVACY NOTICE

In addition, under California Civil Code §1798.83, California residents who have provided personal information to Bullpen Labs, Inc. may obtain information regarding Bullpen Labs, Inc.’s disclosures, if any, of personal information to third parties for third-party direct marketing purposes. Requests must be submitted to the following address: [email protected]. Within 30 days of receiving such a request, we will provide a California Privacy Disclosure, which will include a list of certain categories of personal information disclosed during the preceding calendar year to third parties for their direct marketing purposes, along with the names and addresses of the third parties. This request may be made no more than once per calendar year.