Privacy Policy

This policy applies to information processed through the Service. It does not apply to third-party services you interact with through the Service, including the Derive Protocol and the Derive application operated by Lyra Technologies Corp, embedded-wallet and authentication providers, fiat on-ramp providers, blockchain networks, or wallet software. Each of those parties maintains its own privacy practices, and we encourage you to review them.

a. Information you provide to third parties through the Service.

To create an account and an embedded wallet, you may authenticate through our authentication and embedded-wallet provider (Privy) using a Google account, an Apple ID, an X (Twitter) account, or an email address. These providers may collect your email address, social account identifier, device information, and authentication metadata, and they provision a self-custodial embedded wallet on your behalf. Boom receives a limited set of this data (such as your email or a user identifier and your public wallet address) to operate your session.

b. Wallet and on-chain information.

When you connect or are issued a wallet, we process your public wallet address and publicly available on-chain data associated with it, including your Derive smart-contract wallet address, subaccount identifiers, balances, deposits, bridge transactions, orders, fills, and settled positions. This information is recorded on public blockchains (including Ethereum mainnet and the Derive Chain) and is not private.

c. Payment / on-ramp information.

If you fund your wallet using a third-party fiat on-ramp (such as MoonPay), you transact directly with that provider. The provider collects and processes your payment details and identity-verification (KYC) information under its own terms and privacy policy. Boom does not receive or store your full payment card numbers, bank details, or government identification. We may receive limited transaction status information (for example, that a purchase to a given wallet address succeeded or failed).

d. Usage and device data.

We and our analytics tools may automatically collect technical and usage data such as a device or session identifier, app version, platform, pages and features used, approximate (non-precise) location derived from IP address, timestamps, and event data relating to ticket purchases (for example, round identifiers, order identifiers, and aggregate purchase metrics). We use this to operate, secure, and improve the Service.

e. Communications.

If you contact us (for example, by email or via X), we collect the information you choose to provide.

• To provide, operate, and maintain the Service and your session;
• To facilitate your interactions with the Derive Protocol, including bridging USDC, creating subaccounts, registering session keys, and submitting orders you initiate;
• To display your balances, positions, and ticket history;
• To detect, investigate, and prevent fraud, abuse, security incidents, and prohibited or unlawful activity;
• To comply with applicable legal obligations and enforce our Terms of Service, including geographic and sanctions-related access controls;
• To analyze and improve the performance, usability, and features of the Service.

Where the EU/UK General Data Protection Regulation applies, we process personal data on the bases of: performance of a contract (to provide the Service you request); our legitimate interests (to secure, operate, and improve the Service); compliance with legal obligations; and, where required, your consent (which you may withdraw at any time).

We do not sell your personal information. We share information only as follows:

• Service providers and infrastructure: our authentication and embedded-wallet provider, analytics and hosting providers, and similar processors that help us run the Service.
• On-ramp providers: when you choose to buy crypto, your wallet address is shared with the on-ramp provider so funds can be delivered.
• Blockchain networks and the Derive Protocol: transactions you initiate are broadcast to public blockchains and to the Derive Protocol's off-chain orderbook and on-chain settlement contracts. This data is inherently public.
• Legal and safety: to comply with law, regulation, legal process, or governmental request, and to protect the rights, property, and safety of Convallax, our users, and others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets.

The Service uses cookies, local storage, and similar technologies to keep you signed in, remember your authentication mode, cache your linked-wallet information, and measure usage. You can control cookies through your browser settings; disabling them may impair core functionality such as maintaining your session.

We retain information for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. On-chain data cannot be modified or deleted by us because it resides on public, immutable blockchains.

We implement reasonable administrative, technical, and organizational measures designed to protect information. However, no method of transmission or storage is completely secure. Because wallets are self-custodial, you are solely responsible for safeguarding your login credentials, recovery methods, devices, and any exported keys. Anyone with access to your wallet can move your funds.

We and our service providers may process information in countries other than where you reside. Where required, we use appropriate safeguards for cross-border transfers.

Depending on your jurisdiction, you may have rights to access, correct, delete, or port certain personal data, to object to or restrict processing, and to withdraw consent. To exercise these rights, contact us via our official X account @boomfunnn. We may need to verify your identity. Note that requests cannot extend to immutable on-chain data or to data held independently by third parties such as on-ramp or authentication providers.

The Service is not directed to, and may not be used by, anyone under 18 years of age (or the age of majority in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it.

Access to the Service and to the Derive Protocol is restricted in certain jurisdictions and for certain persons (including sanctioned or restricted persons). We may process coarse location and network information to enforce these restrictions, as further described in our Terms of Service.

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last updated” date. Material changes will be highlighted where appropriate. Your continued use of the Service after an update constitutes acceptance of the revised policy.

Questions about this Privacy Policy or our data practices can be directed to Convallax, Inc. via our official X account @boomfunnn.