Privacy Policy

Last updated: 2 October 2026

This Privacy Policy explains what data Amplify Factor S.A. (“we”, the data controller) collects when you use the Tiger.com application, the dex.tiger.com website and the Tiger.com Telegram bot (the “Service”), why we collect it and what your choices are.

1. What we collect

Telegram account data — your Telegram ID, name, username, language, profile photo and whether you have Telegram Premium, received from Telegram when you sign in with Telegram or open the app inside it.
Where you opened the app from — when you open the app from a link in a Telegram chat, Telegram tells us the type of that chat (channel, group or private chat) and an identifier of the chat that is neither its name nor its Telegram ID; it gives us no access to the chat or its messages. We store them with your sign-up and use them, in aggregate, to see which channels and shared links bring new users.
Passkey data — if you sign in with a passkey: its public key, identifier, the device name and the time it was last used. The passkey's private part and your biometrics never leave your device; an account created with a passkey has no name, phone number or e-mail attached.
Wallet addresses — the public addresses of the wallet and the trading keys created in the app. Addresses are public on the blockchain; we link them to your account to show balances, positions and history.
Device and session data — browser or Telegram client type and the Mini App version it supports, operating system, IP address and the approximate country derived from it, session identifiers and the times you signed in. Used for security (for example, notifying you about a sign-in from a new device or spotting several accounts created from one device to collect referral rewards), to fix problems specific to a device and, in aggregate, to see which countries our ads actually reach.
Activity — orders, trades, deposits, withdrawals, bot configurations and events, app settings, referral attribution and notification history.
Onboarding answers — what you tell us when you start: your trading experience, the asset classes you are interested in and how you plan to fund your account. We use them to tailor the app, for example which markets and which screen to show first.
Advertising attribution — if you arrive from one of our ads: the campaign code, the click identifier the ad network adds to the link (for example, X’s twclid) and a random visitor ID. They are stored in your browser and linked to your account when you sign up, so that we know which ad brought you.
Fiat payments — the amount, currency, method and status of purchases or sales made through payment partners, and the payout details you enter for a sale.
Support messages — what you write to us in Telegram or by e-mail.

2. What we do not collect

We never receive your seed phrase, private keys or PIN. They are generated and stored on your device, encrypted. When you create a wallet, the app also stores an encrypted backup of it on our servers so that you can restore it on another device. By default the backup is encrypted with a device secret that is never sent to us, and we cannot read it. If you set a PIN, the backup is protected by your PIN together with a key stored on our servers: we cannot read it without your PIN, but a short PIN could be guessed by someone with full access to our systems. We do not collect government ID or bank details — payment partners collect what they need under their own policies.

3. Why we use your data

To provide the Service: sign you in, show your wallet and positions, submit your orders to the DEX, run your bots, send the notifications you enabled (performance of our agreement with you).
To keep the Service secure and prevent fraud, abuse and unauthorised access (our legitimate interests).
To comply with legal obligations, including sanctions screening and responding to lawful requests.
To understand how the Service is used and improve it, using aggregated or pseudonymised data (our legitimate interests).
To measure our advertising: which ads bring new users, and to report a sign-up or first deposit back to the ad network whose ad you clicked (our legitimate interests).

4. Blockchain data is public

Trades, positions, deposits and withdrawals are recorded on a public blockchain and by the DEX. Anyone can see them by address. We cannot delete or change blockchain data.

The DEX and blockchain networks — your addresses and orders, which is inherent to trading.
Payment partners — the details of a fiat purchase or sale you start.
Telegram — messages and notifications are delivered through Telegram’s platform.
Advertising networks (currently X) — if you signed up after clicking their ad: the fact of the sign-up or of your first deposit and its amount, linked to that ad’s click identifier and a pseudonymous event ID. We do not send them your name, Telegram ID, contact details or wallet address.
AI service providers that write explanations, bot reports and, where used, support replies on our behalf. For explanations and reports they receive the market, bot settings and results needed for the text, without your name, Telegram ID or wallet address; for a support reply, the text of your messages in the conversation and, if the question is about your account, the account details needed for the answer (for example, your positions, transfers, bots or rewards), with wallet addresses shortened.
Infrastructure providers (hosting, databases, monitoring) that process data on our behalf under contract.
Authorities, where required by law or to protect our rights and users.

We do not sell your personal data.

6. Retention

Account and activity data are kept while your account exists and for up to 5 years afterwards where required for accounting, legal or security purposes. Session records are kept for up to 90 days after the session ends, and app event logs for up to 90 days. Aggregated statistics may be kept indefinitely.

7. Security

Data in transit is encrypted (TLS). Keys are encrypted on your device; wallet backups are encrypted as described in section 2. Access to production systems is restricted and logged. No system is perfectly secure — keep your Telegram account, devices and seed phrase safe.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to complain to a supervisory authority. To exercise these rights, contact us at dex.support@tiger.com. You can turn notifications on or off in Settings at any time.

9. Cookies and local storage

We use a session cookie to keep you signed in and a cookie for your language. The app stores your encrypted wallet, settings and cached market data in your browser or Telegram client storage. If you arrive from one of our ads, the website also keeps the campaign code, the ad click identifier and a random visitor ID in your browser’s local storage for advertising attribution (sections 1 and 5). We do not use advertising cookies or third-party tracking scripts.

10. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from children.

11. International transfers

Our servers and providers may be located in countries other than yours. Where required, we rely on appropriate safeguards for such transfers.

12. Changes

We may update this Policy. The current version is always available in the app and at dex.tiger.com/legal/privacy. Material changes are announced in the app.

13. Contact

Amplify Factor S.A., registration No. 155758692-2-2024, Bloc Office Hub, Fifth Floor, Santa Maria Business District, Panama, Republic of Panama; P.O. Box 0816-02884, Panama, Republic of Panama. Privacy requests: dex.support@tiger.com.