What we collect
- Account: email, username, profile details, sign-in methods (passkeys are stored as public keys only).
- Identity and tax: legal name, date of birth, address, country, ID verification results and tax forms. Tax ID numbers are encrypted at rest.
- Money and trading: deposits, withdrawals, wallet addresses, orders, holdings and royalty payments.
- Device and security: IP address, browser and device, sign-in sessions.
- Music connections (optional): if you connect Spotify or Apple Music we fetch your listening live to suggest songs. We store access tokens, not your listening history.
Why
To run your account, pay royalties, meet legal duties (identity checks, sanctions screening, tax reporting, anti-money-laundering monitoring), keep the market fair, secure your account and improve the product.
Who we share it with
Service providers who process data for us (identity verification, payments and on-ramp, email, hosting), our regulated partners, and authorities when the law requires. We don't sell personal data. Your public profile, posts and, if you choose, your portfolio are visible to other users.
Your choices
- Make your portfolio private, turn email and push notifications on or off, and disconnect music services in Settings.
- See and sign out your devices in Settings → Security.
- Ask for a copy of your data, a correction, or deletion. Some records (trades, tax, identity checks) must be kept for several years by law.
Retention and security
We keep data as long as your account is open and as long as the law requires afterwards. Sensitive actions require a recent passkey or authenticator check, and admin access is logged.
Contact
tjtags@penncareylaw.upenn.edu or tulioclaw@gmail.com