Privacy policy

Draft, pending legal review. Last updated 20 October 2026. Craft is in development on Derive testnet; this policy describes the app as designed for its public release and will be reviewed before launch.

Who we are

Craft is developed by BondHive Ltd., a company incorporated in the British Virgin Islands ("we"). We are responsible for the personal data described here. Contact: [email protected].

What Craft is, and what we never hold

Craft is a self-custodial app for trading options on Derive. Your wallet is created on your device by our wallet provider, Privy. We never receive your private key or seed phrase, and we cannot move your funds. Orders and withdrawals are signed on your device and sent to Derive directly.

Data we process

• Account. Your email address, or your Google account's email if you sign in with Google, and your wallet's public address.
• Consents. Which documents you accepted (risk disclosure, terms, residence and age confirmations), their version, the time, and the country derived from your IP address at that moment.
• Trading data. Your Derive subaccount, balances, positions, orders and history. With your permission, our servers read them from Derive with a read-only key that cannot trade, transfer or withdraw, to show your history and send notifications. You can switch this off in Settings.
• Exit levels and preferences. The exit levels you set on your tickets, your notification settings and whether amounts may appear in notifications.
• Device. A random identifier for this installation, used for the Sandbox before you sign in, and a push notification token if you allow notifications.
• Sandbox. Your simulated balance, tickets and results. Sandbox accounts that were never linked to a signed-in account are deleted after 30 days without use.
• Search. The X post link or text you submit (up to 2,000 characters) and the summary produced from it. The text is sent to Anthropic to produce the summary, and only after you agree to this in the app. Your own notes on an analysis are stored and never sent to the model.
• Diagnostics and usage. Crash reports, and product events such as "ticket confirmed" or "analysis failed". These never include wallet addresses, amounts, post links, pasted text or your notes.

Why we process it

To provide the app you asked for (sign-in, balances, tickets, history, notifications, Search), to keep a record of the documents you accepted, to keep the service secure and working, and to meet legal obligations. We do not sell personal data and do not use it for advertising.

Who processes it for us

• Privy: sign-in and the wallet on your device.
• Amazon Web Services: hosting of our servers and databases, in the United States.
• Anthropic: summaries in Search, only for the text you submit.
• Sentry: crash reports. PostHog: product events.
• Apple and Google: delivery of push notifications.
• Cloudflare: delivery of this website.

Derive, the exchange where orders are matched and settled, receives your orders and wallet address from your device under its own terms. Activity on a blockchain is public and cannot be deleted by us or by anyone else.

How long we keep it

We keep account, consent and trading data while your account exists, and records of accepted documents for as long as the law requires. Deleting your account in Settings removes the data we hold about you and destroys the read-only key; we offer you the export of your wallet key first, because we cannot recover it for you.

Your rights

You can ask for a copy of your data, its correction or deletion, or object to its processing, by writing to [email protected]. Depending on where you live, you may also complain to your data protection authority.

Age

Craft is for adults. You must confirm you are 18 or older to use it.

This website

This website sets no cookies and runs no analytics. Cloudflare processes technical data, such as IP addresses, to deliver and protect it.

Changes

We will publish changes here with a new date, and tell you in the app when a change affects how your data is used.