Your data. Your choices.

This policy covers Exfil: Solana Arena and exfil.fun, operated by Dreamers and Doers IT Solutions Private Limited. Effective October 13, 2026.

Information used by Exfil

Account information: your email address, account ID, authentication and session information, and embedded wallet address. Privy handles email verification, sign-in and wallet infrastructure.
Wallet and transaction information: public wallet addresses, balances, token holdings, transaction inputs and signatures needed to display balances, prepare transactions, submit transactions you sign and check their status.
Market requests: token searches, selected markets and requested wallet or transaction details are sent to our servers and market-data providers to return the information you request.
Technical information: hosting and service providers process IP addresses, IP-derived approximate location, request metadata, device or SDK information and operational diagnostics to deliver the service, prevent abuse, analyze service usage and troubleshoot failures.
Push alerts (optional): if you turn on alerts, the app sends your device push token, wallet address, held tokens, entry prices calculated from your Exfil trades, any price alert levels you set on a bag, the public wallet addresses of any rats you tag along with (with each one’s balance when you tagged it and the name shown on it) and your alert choices. If you also turn on changes since you entered, it sends when each bag was first bought in Exfil and the public wallet addresses that held the most of it, or were linked to each other, just before you bought. While alerts are on, we also keep each trade or withdrawal you submit for up to an hour so we can tell you whether it landed, and we read your wallet’s public transaction history to notice deposits, and the public balances of the rats you tag along with to notice when they sell. We store them with our database provider to decide when to notify you, and Apple delivers the notifications. Turning alerts off, signing out or deleting your account removes this record; it also expires when Apple reports the token is no longer valid.
Leagues: we keep each swap you confirm in Exfil (coin, side, dollar amount and token amount) under your public wallet address to work out your weekly win rate and league. While you’re in the Rooftop or Skyline league (this week’s, or last week’s until you’re placed again), other Exfil users see your league, wins and trades for the week, and a pennant on your rat in arenas, beside your wallet address and your rat’s name if you show one. In the Alley or Sewer league, or before you’re placed, they see only how many traders are in each league, never you. Turn off Show me to other players in Profile (Show me in leagues in earlier versions) to hide you from everyone else in any league. The records expire after about 13 months.
PnL history: while you hold a coin you bought in Exfil, every 15 minutes we read your wallet’s public balances and keep, under your public wallet address, how much of each coin you traded in Exfil it holds and what that was worth at the market price. Profile uses it to chart your PnL with open bags; only you see it. Each record expires after about 90 days.
Exfil players: while you’re signed in, the app tells us your wallet belongs to an Exfil user. We keep that with your public wallet address and a one-way code for your account (never your email) until 90 days after you last open the app. Other signed-in Exfil users then see your rat drawn as an Exfil player, with the EXFIL bag, in the arena of any coin your wallet holds. Turn off Show me to other players in Profile to stop that at once; a look or name you choose to share still shows. Deleting your account removes the record.
Rat names (optional): if you name your rat and choose to show the name, we keep it with your public wallet address and when you set it. Other Exfil users see it on your rat in their arenas, on the league board and on the pioneer seats; Show me to other players doesn’t hide it from arenas. A name stays for 30 days before you can pick another; you can hide it at any time, and it stays reserved for you until those 30 days end. If someone reports your name, we keep the report and the reporter’s account reference so we can review it, and we may take a name down. Deleting your account removes your name. Names you don’t show stay on your phone.
Pioneers: the first 100 wallets to trade in Exfil each keep a numbered seat. We keep your seat number, public wallet address, when you took the seat and the signature of that trade. Anyone can see the seat list, with each wallet address and how its rat is dressed. Turn off Show me to other players in Profile to hide your wallet address from it; your seat number stays taken. Seats don’t expire.
Invites: if you enter an invite code, we keep the code, your wallet address, when your first Drop in started the invite, and where your wallet’s first funds came from, to stop people inviting themselves. Whoever invited you sees how many people they invited and how many are in their first 90 days, never your wallet or your trades. We also keep a history of the $EXFIL each wallet earns from the fee. Invite records don’t expire.
Support messages: information you choose to send when requesting help or account deletion.

On your device

The app stores session information through Privy, and uses device secure storage for preferences, cached balances, unresolved transaction recovery and up to 100 local transaction receipts per wallet. The website stores sound preferences and recent arenas in browser storage. These records help restore your experience; cached prices and balances are not executable quotes.

Why we use it

We use this information to authenticate you, provide wallet and market features, process actions you request, recover unresolved transactions, keep the service secure, respond to support requests and meet applicable legal obligations. Exfil does not use an advertising SDK or sell personal information. We do not use your data for cross-app advertising tracking.

Providers and public networks

We use Privy for authentication and embedded wallets, Vercel for hosting, Upstash for optional alert records, Apple Push Notification service for alert delivery, Jupiter for swap routing and market data, Solana RPC services for blockchain access, and market-data providers including Birdeye and Bubblemaps for public activity and wallet connections. Providers receive information needed for their services and may use and retain security, service analytics and operational records under their own policies. Services may process information outside your country.

Transactions you authorize are submitted to Solana. Wallet addresses and confirmed transaction records are public and may be copied by anyone. Exfil cannot erase or reverse blockchain records. Following a link to an explorer or other service is subject to that service’s own privacy practices.

Retention and deletion

Your account information is maintained while your Exfil account is active. You can request account deletion using the account-deletion page. After ownership verification, the Exfil sign-in account is deleted through Privy. In-app deletion also clears this device’s saved wallet balances and transaction records. Clear app or browser storage on other devices to remove their local copies.

Privy disassociates and archives embedded wallets rather than destroying them, for asset security. Recovery is not guaranteed. Public blockchain data remains indefinitely. Provider security logs, support correspondence and information needed to comply with law, prevent fraud or resolve disputes may remain for those purposes; deletion does not override legally required retention or providers’ own retention policies.

Your choices

You may request access, correction or deletion of personal information by contacting us. We verify ownership before changing or deleting an account. You may also clear local storage, stop using the service, or withdraw supported assets to another wallet. Protect your email account and never send us a seed phrase, private key or login code.

Security and age

We use encrypted connections, authentication and device secure storage. No service can guarantee absolute security. Exfil is not directed to children under 18. Contact us if you believe a child has provided personal information.

Contact and updates

For privacy questions or requests, email abhilashi.iiith@gmail.com. We may update this policy as the service changes and will publish the effective date here.