PaceSeeker Privacy Policy

Your data stays on your device

Last Updated: September 4, 2026

1. Overview

PaceSeeker is built with a privacy-first, self-custodial architecture. StealthLynk does not centrally collect, store, or process your personal data. All sensitive information remains on your device.

2. Data Stored Locally on Your Device

All sensitive data is stored locally on your device using Android Keystore or iOS Keychain via Expo SecureStore:

• Session keypairs (encrypted; generated sessions expire after 24 hours, imported and hardware wallet sessions persist until revoked)
• CEX API keys (if you choose to enter them for CEX LIVE trading)
• App settings and trading preferences (per-strategy configuration, risk parameters)
• Local trade history (simulated and real, CSV exportable by you)
• Wallet addresses (public keys only, for on-chain queries)
• Bot position state (DCA position tracking, average entry price, trade markers)
• Risk Disclosure and Terms acceptance flags

StealthLynk cannot access this data. If you uninstall the App, this data is permanently deleted.

3. Data We Do NOT Collect

We do not collect, transmit to our servers, store on our infrastructure, or share with third parties:

• Your Solana private keys or seed phrases (they never leave your device)
• Personally identifiable information (name, email, phone number, address)
• Location data
• Device identifiers for tracking
• Usage analytics, telemetry, or behavioral data
• CEX API keys or credentials on our servers
• Photos, contacts, or device media

PaceSeeker does not include any third-party analytics SDK, advertising SDK, crash reporter with upload, or tracking pixel.

4. Permissions and Device Access

4.1 Camera

The App requests camera permission solely for scanning QR codes (wallet addresses, payment codes). The camera is never used to record, store, or transmit images or video. Camera access is only activated when you explicitly choose to scan a QR code.

4.2 Biometric Authentication

The App uses biometric authentication (fingerprint or face recognition) to authorize sensitive actions such as enabling LIVE mode or authorizing session keys. Biometric data is processed exclusively by the operating system's secure hardware (Android Keystore / iOS Secure Enclave). PaceSeeker never accesses, stores, or transmits your biometric data.

4.3 Notifications

If you enable notifications, they are scheduled locally on your device (alerts for bot status, halts, or pauses). No data is sent to any server to deliver these notifications.

4.4 Foreground Service

The App uses a foreground service to keep the trading bot running when the app is in the background. This does not collect or transmit any data — it only maintains the bot's polling loop.

5. Blockchain Interactions

When you enable LIVE mode, transactions are submitted directly to public Solana RPC nodes. Your public wallet address is transmitted to RPC endpoints to query on-chain balances and submit signed transactions. These interactions are pseudonymous but publicly visible on the blockchain, as is true for all Solana transactions. StealthLynk does not operate these RPC nodes and has no special visibility into your on-chain activity.

6. CEX API Key Handling

If you enter CEX API keys for live trading:

• API keys and secrets are stored exclusively in device secure storage (Android Keystore or iOS Keychain via Expo SecureStore). They are never synced, backed up, or transmitted to StealthLynk.
• The App communicates only with official exchange API endpoints. There is no intermediary proxy or StealthLynk relay server.
• Your API secret is never sent over the network. The App uses HMAC-SHA256 signing locally and transmits only the resulting signature.
• API keys are used only for balance reads and market order placement. The App never initiates withdrawals unless you explicitly grant Withdraw permission for auto-rebalance.
• Keys are immediately deleted from secure storage when you tap Remove in the App.

7. Server Interactions

The App contacts PaceSeeker infrastructure for the following purposes:

• Remote configuration — fetched on startup from a PaceSeeker endpoint. Contains RPC URLs, Jupiter API keys, feature flags, and update checks. The response is verified via Ed25519 signature or SHA-256 hash before use. No user data is transmitted.
• Subscription payment verification — when you purchase a subscription, the on-chain payment memo is verified by querying the Solana blockchain. No wallet addresses or personal data are sent to PaceSeeker servers.
• Invite code redemption — when you unlock LIVE mode, the invite code is sent to a lightweight PaceSeeker endpoint to count redemptions; the server stores only a SHA-256 hash of the code, never the raw code. No wallet addresses, trading history, or personal data are transmitted.

8. AI Federation Data Sharing (Opt-In)

PaceSeeker includes an optional AI Federation feature that shares anonymized AI learning data with StealthLynk to improve future app releases. This feature is enabled by default but can be turned off at any time via Tune > DCA Settings > Data Sharing > Share AI Data.

8.1 What is Shared

When the AI Federation feature is enabled and you have closed at least one LIVE trade, the app periodically (every 6 hours) uploads the following anonymized learning data to StealthLynk servers:

• Learned indicator weights (relative numeric values for RSI, MACD, Bollinger Bands, etc.)
• Pattern memory entries (anonymized market condition snapshots with outcome labels — no trade amounts)
• Anonymized trade outcome records (per-trade outcome labels such as win/loss, action type, and order type — never amounts, prices, timestamps, or any identifier)
• Learning parameters (dynamic thresholds, exit learning, safety order learning, regime transition learning, streak multipliers)
• Token mint address and symbol (public on-chain identifiers, used to organize data per-token)
• App version code (integer, for tracking learning progress across releases)

8.2 What is NOT Shared

• Wallet addresses — neither your owner wallet, session wallet, nor any Solana address is transmitted
• Private keys or seed phrases — never leave your device
• Trade amounts — no USD, USDC, SOL, or token amounts are included
• Transaction signatures or hashes — no on-chain transaction identifiers
• IP addresses — not collected or stored by the AI Federation system
• Device identifiers — no device ID, advertising ID, or hardware fingerprint
• Personally identifiable information — no name, email, phone, location, or any other PII

8.3 How Data is Stored and Used

Uploaded data is stored on StealthLynk servers in per-token directories (identified by a SHA-256 hash of the token mint address). The server performs a second sanitization pass on all incoming data to ensure no PII is stored. Data is aggregated across all users using trade-count-weighted averaging to produce pre-trained AI bundles that are bundled into future app releases, giving new users a crowd-trained AI starting point.

8.4 Opting Out

You can disable AI Federation data sharing at any time by toggling Share AI Data OFF in Tune > DCA Settings > Data Sharing. When disabled, no data is uploaded. Previously uploaded anonymized data remains on the server but is not associated with your identity or wallet.

9. External Services

The App queries the following external services for market data and trade execution. No personally identifiable data is included in any request; only your public wallet address is transmitted when required for on-chain queries:

• Solana RPC endpoints — for on-chain state, balance queries, and transaction submission
• Jupiter Aggregator API — for DEX swap quotes and routing
• Jito Block Engine — for transaction bundle submission
• Birdeye API — for token metadata and OHLCV candle data (if configured)
• Public CEX APIs (Bybit, OKX, MEXC, Gate.io, KuCoin, BingX, Bitget) — for price feeds (no authentication required for public data)
• CEX authenticated APIs — only if you enable CEX LIVE and provide API keys, the App sends signed balance and order requests directly from your device to the exchange

These services may log IP addresses and request data according to their own privacy policies. StealthLynk does not control their data practices. Your use of these endpoints is subject to the respective provider's privacy policies.

10. Analytics and Telemetry

PaceSeeker does not include third-party analytics, crash reporters, or advertising SDKs. Error logs remain on your device unless you manually share them with StealthLynk for support.

11. Data Retention and Deletion

StealthLynk does not centrally collect your private keys, wallet addresses, balances, or trading history. Invite code redemption records and remote config access logs are the only server-side data; they contain no personally identifying information.

To delete all PaceSeeker data from your device:

• Use Revoke in the Vault tab's wallet section to destroy the session key and sweep funds back to your owner wallet, OR
• Go to Android Settings > Apps > PaceSeeker > Storage > Clear Data, OR
• Uninstall the App.

There is no server-side account or data to delete. Uninstalling the App permanently erases all local data.

12. Children's Privacy

PaceSeeker is intended for users 18 years or older only, as described in the Terms of Service. The App involves financial trading and is not designed for or directed at children. We do not knowingly collect data from minors. If you believe a minor has provided information to us, please contact us and we will take appropriate action.

13. Your Privacy Rights

Depending on your jurisdiction (e.g., EU/EEA/UK GDPR, California CCPA), you may have the following rights regarding your personal data:

• Access — request information about data we hold about you
• Deletion — request erasure of your personal data
• Rectification — request correction of inaccurate data
• Portability — request a copy of your data in a portable format
• Objection — object to certain processing of your data

Since PaceSeeker stores all data locally on your device and does not maintain server-side user accounts, you can exercise these rights directly by managing or deleting data on your device. For any server-side data (invite code redemptions), contact us at [email protected].

14. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by the "Last Updated" date at the top. Continued use after changes constitutes acceptance of the updated policy.

15. Contact

For privacy questions or concerns, contact [email protected].

Last Updated: September 4, 2026