Your data. Your choices.

This policy covers Exfil: Solana Arena and exfil.fun, operated by Dreamers and Doers IT Solutions Private Limited. Effective November 3, 2026.

Information used by Exfil

Account information: your email address, account ID, authentication and session information, and embedded wallet address. Privy handles email verification, sign-in and wallet infrastructure.
Wallet and transaction information: public wallet addresses, balances, token holdings, transaction inputs and signatures needed to display balances, prepare transactions, submit transactions you sign and check their status.
Market requests: token searches, selected markets and requested wallet or transaction details are sent to our servers and market-data providers to return the information you request.
Technical information: hosting and service providers process IP addresses, IP-derived approximate location, request metadata, device or SDK information and operational diagnostics to deliver the service, prevent abuse, analyze service usage and troubleshoot failures.
Visitor counts: before you sign in, the app sends a random code it made for this install, which app it is (iPhone, Android or web), whether a shared link or an invite brought you, and how far you got: opening the app, seeing a coin, opening Search, tapping Buy, and starting or finishing sign-in. It never includes your email, wallet or the coins you look at. We keep daily counts; the code and your IP address are kept only as one-way codes, for two days, so each install counts once a day.
Browsing and sharing counts: signed in or not, each time the app leaves your screen it sends the same random install code, which app it is, whether you were signed in, how long it was on screen, how many coins it showed and how many times you moved to the next coin. When you share a card (an Extract, a closed trade, a held bag, the 100× race, the Rat Pyramid, an invite or an achievement), it sends which card, whether it was shared, and whether it went as a post with words and a link. It never includes your email, wallet or the coins you look at. We keep daily counts, with time on screen and coins only in ranges; the code and your IP address are kept only as one-way codes, for two days, so each install counts once a day.
Where your funds came from: after your first trade in Exfil, we read your wallet’s public transaction history once to see where its first deposits came from: another app such as Fomo, an exchange or similar service, or another wallet. We keep daily counts of each kind, also split by whether the trade was made with the arena on or off, never your wallet. Under a one-way code for your account, we keep which kind it was, so it is read only once and can be compared with how the app is used, such as whether the arena is on.
Push alerts (optional): if you turn on alerts, the app sends your device push token, wallet address, held tokens, entry prices calculated from your Exfil trades, any price alert levels you set on a bag, the public wallet addresses of any rats you tag along with (with each one’s balance when you tagged it and the name shown on it), the public wallet addresses of a bag’s top 10 holders when you set a top 10 alert on it (with each one’s balance then) and your alert choices. If you also turn on changes since you entered, it sends when each bag was first bought in Exfil and the public wallet addresses that held the most of it, or were linked to each other, just before you bought. While alerts are on, we also keep each trade or withdrawal you submit for up to an hour so we can tell you whether it landed, and we read your wallet’s public transaction history to notice deposits, and the public balances of the rats you tag along with and of the top 10 holders you set alerts on, to notice when they sell. When a top 10 alert fires we keep the coin, the time and the alert’s settings, without your account or wallet, to measure whether these alerts help. We store them with our database provider to decide when to notify you, and Apple delivers the notifications. Turning alerts off, signing out or deleting your account removes this record; it also expires when Apple reports the token is no longer valid.
Leaderboards and trader profiles: we keep confirmed Exfil swaps on Solana (coin, side, dollar and token amounts, time, transaction signature and verified costs) under your wallet address. Up Only ranks estimated portfolio growth adjusted for deposits and withdrawals; Jeet Elite ranks realised profit; Bag Lords ranks unrealised profit; Serial Winners ranks qualifying wins. Portfolio reconciliation stores timestamped balances, values and verified transfers for about 40 days. Visible trader profiles show these metrics, recent trades and tracked open positions. Signed-in users can find a visible trader in Search by rat name or wallet address, and Search’s Consistent list shows visible traders who won at least 40% of 10 or more trades closed in the last 30 days, with that record. Signed-in users can follow a trader’s confirmed buys and sells and choose either alert type. You can also follow any Solana wallet that isn’t an Exfil trader: we keep its public address, any name you give it and your alert choices under your account, and read its public transactions every minute to tell you when it buys or sells. Opening such a wallet shows its latest trades, read from its public transactions; we keep that read for 90 seconds so anyone who opens it then sees the same one. Other players don’t see which outside wallets you follow, and unfollowing stops the reading. We store following relationships and up to 100 recent alerts for 30 days, and use Apple for optional iOS push delivery. Unfollowing stops alerts; account deletion removes these subscriptions and the new profile records. Turn off Show me to other players in Profile to hide your profile and rankings and stop future follower alerts. Historical trade records are kept for about 13 months; prior app versions may still display the weekly leagues.
PnL history: while you hold a coin you bought in Exfil, every 15 minutes we read your wallet’s public balances and keep, under your public wallet address, how much of each coin you traded in Exfil it holds and what that was worth at the market price. Profile uses it to chart your PnL with open bags; only you see it. Each record expires after about 90 days.
Exfil players: while you’re signed in, the app tells us your wallet belongs to an Exfil user. We keep that with your public wallet address and a one-way code for your account (never your email) until 90 days after you last open the app. Other signed-in Exfil users then see your rat drawn as an Exfil player, with the EXFIL bag, in the arena of any coin your wallet holds. Turn off Show me to other players in Profile to stop that; within a minute your rat shows in arenas like any other holder’s, without the look or name you share. Deleting your account removes the record.
X connection (optional): when you choose Connect X, Privy links your authorized X account to your Exfil account. Exfil reads the verified username and stores it with your wallet address and an account reference so signed-in players can open your X profile. Exfil does not store X OAuth tokens. Turn off Show me to other players to hide the public link. Disconnecting X or deleting your account removes the saved link.
Rat names (optional): if you name your rat and choose to show the name, we keep it with your public wallet address and when you set it. Other Exfil users see it on your rat in their arenas, on the leaderboards, in trader search and on the pioneer seats; turning off Show me to other players hides it from all of them, arenas included. A name stays for 30 days before you can pick another; you can hide it at any time, and it stays reserved for you until those 30 days end. If someone reports your name, we keep the report and the reporter’s account reference so we can review it, and we may take a name down. Deleting your account removes your name. Names you don’t show stay on your phone.
Takes (optional): when you post a take or a reply on a coin, we keep the words, when you posted, the wallet you posted from, a one-way code for your account, and that wallet’s holding in the coin then (share of supply and dollar value), which we re-read later to show whether it sold or added. Votes are kept with the same code and whether you held the coin. Other signed-in Exfil users see your takes and replies with your rat name and look, the wallet and its holding. Turn off Show me to other players in Profile and they see only the words, the votes and whether a take was posted with a bag, never your wallet, name, look or holding; you still see your own in full. If someone reports a take, we keep the report and the reporter’s account reference so we can review it; if you block someone, we keep that under your account code. A take is kept until 180 days after its coin’s takes were last read, and a reply for 180 days. Deleting your account removes your words and their link to you and your wallet.
Pioneers: the first 100 wallets to trade in Exfil each keep a numbered seat. We keep your seat number, public wallet address, when you took the seat and the signature of that trade. Anyone can see the seat list, with each wallet address and how its rat is dressed. Turn off Show me to other players in Profile to hide your wallet address from it; your seat number stays taken. Seats don’t expire.
Invites: if you enter an invite code, we keep the code, your wallet address, when your first buy started the invite, and where your wallet’s first funds came from, to stop people inviting themselves. Whoever invited you sees how many people they invited and how many are in their first 90 days, never your wallet or your trades. We also keep a history of the $EXFIL each wallet earns from the fee. Invite records don’t expire. Entering a code also follows the trader who shared it (see Leaderboards and trader profiles), once, if they show to other players; unfollowing stops it. Their invite page then shows their rat name, if they show one. We count visits to each invite page per day, never who visited.
Your bot (optional): if you make a bot key in Profile & wallet, we keep a one-way code of the key (never the key itself), your wallet address, when the key was made and last used, and the trades your bot suggests, for 15 minutes each. Whoever holds the key, such as an AI agent you paste it into, can read the coins in Exfil and your balances and send you suggested trades. If you turn on Let it trade by itself, Privy adds Exfil’s signer to your wallet, and Exfil signs the trades your bot asks for: only buys and sells it built from your wallet’s own quote, never a withdrawal. Those trades are kept like any other (see Leaderboards and trader profiles). Turning bot trading or the key off stops Exfil signing at once.
Exfil Bot on Telegram: when you ask Exfil Bot for a scan, it reads the message you sent it or replied to, scans the token in it and answers in that chat. For each group it is in, we keep the group’s ID, name and public username, its member count, who added the bot, any invite code set there, when it was added or removed and when it last scanned. We count scans and taps on its Trade on Exfil button per day, by group under a one-way code, and keep each person who asked for a scan that day only as a one-way code of their Telegram ID, never the ID or their name. Daily counts are kept for 35 days.
Call-in questions: when you call in a rat, a family or the holders of a coin, the app sends your question, the facts on that sheet and the thread’s last few turns to our server, which has Anthropic’s Claude (directly or through OpenRouter) write the answer. We don’t store the question, the answer or the wallet; the thread stays on your phone. We keep daily counts for 30 days: which suggested question was asked or that one was typed, whether it followed an earlier one and how it ended, and how many people asked, from a one-way code of your account that can’t be read back. To keep each person to a daily limit, we count your questions under your account for two days.
Support messages: information you choose to send when requesting help or account deletion.

On your device

The app stores session information through Privy, and uses device secure storage for preferences, cached balances, unresolved transaction recovery and up to 100 local transaction receipts per wallet. The website stores sound preferences and recent arenas in browser storage. These records help restore your experience; cached prices and balances are not executable quotes.

Why we use it

We use this information to authenticate you, provide wallet and market features, process actions you request, recover unresolved transactions, keep the service secure, respond to support requests and meet applicable legal obligations. Exfil does not use an advertising SDK or sell personal information. We do not use your data for cross-app advertising tracking.

Providers and public networks

We use Privy for authentication and embedded wallets, Vercel for hosting, Upstash for optional alert records, Apple Push Notification service for alert delivery, Jupiter for swap routing and market data, Solana RPC services for blockchain access, and market-data providers including Birdeye and Bubblemaps for public activity and wallet connections. Providers receive information needed for their services and may use and retain security, service analytics and operational records under their own policies. Services may process information outside your country.

Transactions you authorize are submitted to Solana. Wallet addresses and confirmed transaction records are public and may be copied by anyone. Exfil cannot erase or reverse blockchain records. Following a link to an explorer or other service is subject to that service’s own privacy practices.

Retention and deletion

Your account information is maintained while your Exfil account is active. You can request account deletion using the account-deletion page. After ownership verification, the Exfil sign-in account is deleted through Privy. In-app deletion also clears this device’s saved wallet balances and transaction records. Clear app or browser storage on other devices to remove their local copies.

Privy disassociates and archives embedded wallets rather than destroying them, for asset security. Recovery is not guaranteed. Public blockchain data remains indefinitely. Provider security logs, support correspondence and information needed to comply with law, prevent fraud or resolve disputes may remain for those purposes; deletion does not override legally required retention or providers’ own retention policies.

Your choices

You may request access, correction or deletion of personal information by contacting us. We verify ownership before changing or deleting an account. You may also clear local storage, stop using the service, or withdraw supported assets to another wallet. Protect your email account and never send us a seed phrase, private key or login code.

Security and age

We use encrypted connections, authentication and device secure storage. No service can guarantee absolute security. Exfil is not directed to children under 18. Contact us if you believe a child has provided personal information.

Contact and updates

For privacy questions or requests, email abhilashi.iiith@gmail.com. We may update this policy as the service changes and will publish the effective date here.