Privacy Policy
Last updated 28 September 2026
Prow keeps as little as it needs to run the app. We never receive your private keys, we do not sell your data, and we do not use advertising or analytics trackers.
1.Who we are
Prow is responsible for the personal data described here (the “controller”). Contact us about privacy at support@prowdex.com. This policy is part of our Terms of Service.
2.What we collect and why
| Data | Where it comes from | Why we use it |
|---|---|---|
| Prow account id (your Privy user id), sign-up date, last-seen time | Created when you sign in | Run your account |
| Email address | From Privy, if you sign in with email, Google or Apple | Identify your account, answer support requests |
| Wallet addresses linked to your sign-in | Privy, when you connect a wallet | Prove you own the venue account you connect |
| Venue account address, trading key public address and expiry, network, connection method, fee approval status | You, when you connect a venue; checked against the venue | Show your venues, check trading keys, run alerts |
| Public trading activity of your connected venue accounts (positions, fills, funding, transfers) | Read from the venue's public API; not stored except what an alert needs | Show your portfolio and send the notifications you switch on |
| Aster position snapshots (market, side, size, leverage, margin mode, liquidation and mark price, time read) | The app on your device while it is open. For accounts that approved the Prow builder fee, the alerts service also reads positions from Aster's builder view without storing them | Send Aster liquidation alerts; only the latest snapshot per account is kept |
| App settings, price alerts and risk alert rules, notification history | You | Apply your preferences and deliver alerts |
| Push subscription (endpoint and encryption keys issued by your browser) and your browser's user agent | Your browser, when you turn on notifications | Send push notifications to that device |
| Terms acceptance: version, time, country (from IP) and browser user agent | When you tick the confirmation box | Keep a record that you accepted the Terms and confirmed your eligibility |
| IP address and country (from IP) | Every request | Block restricted regions (checked on each request and not stored by us), security and abuse prevention. Our hosting provider keeps short-lived request logs that include IP addresses. |
Legal bases, where the law requires one: performing our contract with you (account, venues, settings, alerts), our legitimate interests (security, abuse prevention, records of acceptance), legal obligations (sanctions and geographic restrictions) and your consent (push notifications, which you can turn off at any time).
3.What we never collect
- Private keys and seed phrases. Trading keys are created in your browser and stored encrypted on your device only. Withdrawals are always signed by your own wallet.
- Passwords (sign-in is by email code, Google, Apple, wallet or passkey through Privy).
- Identity documents, payment card or bank details.
- Advertising identifiers or analytics tracking data.
4.Data kept only on your device
Your encrypted trading keys, display preferences (theme, chart and market settings, favourites), pending deposit tracking and cached app files are stored in your browser and are not sent to us. See the Cookie Policy for the full list. Signing out can remove them; clearing your browser data removes them permanently.
5.Service providers we use
These providers process data for us under their own terms and security controls:
- Privy (sign-in and wallet connection): your login identifiers (email, Google or Apple account, wallet addresses, passkeys), plus device and IP data for security.
- Supabase (database and background jobs): the account data listed above.
- Vercel (hosting): serves the app, provides IP-based country detection and keeps request logs.
- WalletConnect / Reown (connecting mobile and desktop wallets): relays connection messages between Prow and your wallet and may collect connection telemetry.
- Push services run by your browser vendor (Apple, Google, Mozilla, Microsoft): deliver encrypted notifications to your device.
- Cloudflare Turnstile (loaded by Privy): bot protection during sign-in.
Your browser also talks directly to public services to trade and move funds: the venue's API (Hyperliquid), the Arbitrum network and Circle's attestation service for USDC transfers. Those services see your IP address and the public addresses involved, and transactions on public blockchains are visible to everyone and cannot be deleted.
We may also disclose data when the law requires it, to protect our rights or users, or as part of a merger or sale of the business under this policy. We do not sell or rent personal data, and we do not share it for advertising.
6.How long we keep it
- Account, venue, settings, alert, push and Terms acceptance records: until you delete your account or ask us to.
- Notification history: 90 days. Internal alert de-duplication records: 30 days.
- A push subscription: until you turn off notifications, the browser revokes it, or you delete your account.
- Hosting request logs: kept by Vercel for a limited period under its retention settings.
When you delete your account, we delete these records, except where we must keep something to meet a legal obligation or to establish or defend legal claims.
7.Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. To use any of these rights, or to delete your account, email support@prowdex.com from the email address on your account, or tell us the wallet address linked to it (we may ask you to sign a message to prove you own it). We reply within 30 days. You can also complain to your local data protection authority.
You can turn off push notifications in Settings or in your browser, remove trading keys from a device when you sign out, and revoke trading keys from your wallet at any time.
8.International transfers
Our service providers may process data in the United States and other countries whose data protection laws differ from yours. Where required, we rely on appropriate safeguards such as standard contractual clauses.
9.Security
Data is encrypted in transit. The database is not reachable from the browser; every request is checked against your sign-in and only returns your own records. Trading keys never leave your device. No system is perfectly secure, so keep your devices and wallet safe.
10.Children
Prow is only for people aged 18 or older. We do not knowingly collect data from children. If you think a child has an account, email support@prowdex.com and we will delete it.
11.Changes to this policy
We will update this page when our practices change and show the new date at the top. For material changes we will ask you to confirm again before you trade.
12.Contact
Privacy questions and requests: support@prowdex.com
Not available to residents of the US, UK, EU, UAE, Ontario and sanctioned regions. Questions: support@prowdex.com