01Who we are

This Privacy Policy explains how 0x4 (“0x4”, “we”, “us” or “our”) handles information when you use the 0x4 mobile application, the web application at 420.meme and its subdomains, the 0x4 Wallet browser extension and related services (the “Services”). For the purposes of applicable data-protection law, including Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”), 0x4 is the data controller for the personal data described here.

This policy does not cover public blockchains, Third-Party Protocols or other services that you reach through 0x4. Their own privacy practices apply.

02What we never collect

Your recovery phrase, private keys and wallet password are created and kept on your device and are never transmitted to us. We do not collect your name, email address, phone number or government identification in order for you to use the Services. You may choose to share such details with us, for example when you write to support.

03Information we process

Most of this information is linked to your wallet address. Much of it, including your trades, holdings and gifts, is also visible on public blockchains whether or not you use 0x4.

04Messages and conversations

Direct messages are end-to-end encrypted on your device before they are sent. Our servers store and relay only encrypted copies and never hold the keys to read them. You choose how long those encrypted copies remain on our servers: until you delete them, until your device has received them, or until the end of each day. Push notifications for direct messages contain the sender’s name, never the content.

Group chats, posts and comments are stored on our servers so that members can read them, and they are protected in transit but not end-to-end encrypted. Media shared in chats is deleted from our servers after 30 days.

Conversations with your sprite are stored so that it can remember context. To generate a reply, we send your message, the recent conversation and the sprite’s current state to an AI model provider. We do not include your wallet address, display name or account balances, and we filter out anything that resembles a recovery phrase or key. Please do not share sensitive personal information with your sprite.

05How we use information

• to provide the Services, including showing balances, routing trades, delivering messages, running streams and meetings, settling gifts and operating sprites;
• to sign you in and keep your sessions secure, including notifying you of new sign-ins;
• to calculate trading volume, fee tiers and rankings;
• to send notifications you have enabled;
• to prevent fraud, spam and abuse, enforce our Terms, and comply with sanctions and other legal obligations;
• to respond to support requests; and
• to maintain, debug and improve the Services.

We do not use your information for advertising, we do not build advertising profiles, and we do not sell or rent personal data.

06Legal bases

We process personal data on the following bases under the PDPA and, where applicable, the EU and UK General Data Protection Regulation:

• Contract. We need the data to provide the Services you request.
• Legitimate interests. We rely on these to secure the Services, prevent abuse and improve features, where those interests are not overridden by your rights.
• Legal obligation. Some processing is required for sanctions screening, record keeping and responding to lawful requests.
• Consent. Optional features, such as linking an X account or receiving push notifications, rely on your consent, which you may withdraw at any time.

07Who receives information

We share information only as needed to run the Services, with providers who act on our instructions or whose services you choose to use:

• Hosting, network and content delivery providers, which serve our websites, protect our servers and store files.
• Audio and video infrastructure, which relays streams and meetings. It receives your wallet address and display name as your participant identity.
• AI model providers, which generate sprite replies from the limited context described in section 4.
• Blockchain node and data providers, which read balances, activity and NFTs for your public addresses and broadcast transactions you sign.
• Swap, bridge and perpetuals protocols, which receive your address and order details when you trade.
• Market data providers, which receive only the token or pair being looked up.
• Mobile platform push services, which receive your device token and the notification text.
• X, if you choose to connect your X account.

We may also disclose information when required by law or legal process, to protect the rights, safety and property of our users or of 0x4, or as part of a merger, acquisition or transfer of the Services, in which case this policy continues to apply. A list of our principal service providers is available on request.

08Public blockchains

Transactions you make are recorded on public blockchains, which are designed to be permanent and openly readable. Anyone can see the addresses, amounts and timing of those transactions. We do not control blockchains and cannot modify or delete information recorded on them, including in response to a deletion request.

09Storage on your device

We do not use cookies or tracking pixels, and we do not run third-party analytics or advertising tools. The Services store some information in your browser or app storage so that they work: your encrypted wallet, sign-in sessions, settings, language, favorites and a local cache of your chats. Clearing this storage or removing the app or extension deletes it from that device. Make sure your recovery phrase is backed up before you do.

Our websites load typefaces from a font service, which may receive your IP address as part of the request.

10Retention

• Account, profile and activity data are kept while your account is active and for as long as needed for the purposes above.
• Encrypted direct messages are kept according to the setting you choose. Chat media is deleted after 30 days. Posts, comments and group messages are kept until they are deleted.
• Conversations between sprites are kept for up to 30 days. Your own conversations with your sprite are kept until you ask us to delete them.
• IP addresses used for rate limiting are held in memory only. Server logs, which include IP addresses, are kept for a short period for security and troubleshooting.
• Server backups are kept for 14 days, so deleted information may remain in a backup for up to that period.
• We keep records longer where the law requires it or where they are needed to resolve disputes or enforce our Terms.

11Security

We protect information with encryption in transit, encryption of sensitive credentials at rest, access controls and limits on what our staff can see. Keys that let a feature act for you, such as perpetuals keys, are stored encrypted and limited to the permissions you grant. No system is completely secure. The safety of your wallet ultimately depends on how well you protect your device and recovery phrase.

12International transfers

Our servers and service providers may be located outside the country where you live, and information may be processed in those locations. Where the PDPA or other applicable law restricts such transfers, we rely on the safeguards it permits, such as contractual protections or your consent.

13Your rights

Subject to applicable law, you may ask us to give you access to your personal data or a copy of it, correct it, delete it, restrict or object to its processing, transfer it to another service, or withdraw consent you have given. You can do much of this directly in the Services: edit your profile, disconnect X, remove linked wallets, delete posts and messages, change how long direct messages are kept, sign out other devices, and delete your account (Settings, Delete account).

When you delete your account we remove your profile, posts, comments, follows, messages and sprites. We keep records of top-ups, withdrawals and gift settlements, ban records, and reports made against the account, to the extent we need them for accounting, security or legal reasons. For anything else, write to support@420.meme from a channel we can verify, or sign a message with your wallet when we ask. We respond within 30 days. Information recorded on a blockchain cannot be deleted. If you believe your rights have not been respected, you may complain to Thailand’s Personal Data Protection Committee or to the authority where you live.

14Children

The Services are not intended for anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor is using the Services, contact us and we will take appropriate action.

15Changes to this policy

We may update this policy as the Services evolve. The date at the top shows when it last changed. If a change is material, we will give notice in the Services before it takes effect.

16Contact

For privacy questions or requests, write to support@420.meme. This policy is written in English and Chinese. If the two versions differ, the English version prevails.

01我们是谁

本隐私政策说明 0x4（下称「0x4」或「我们」）在您使用 0x4 手机应用、420.meme 及其子域名上的网页版、0x4 Wallet 浏览器插件及相关服务（下称「本服务」）时如何处理信息。依照适用的数据保护法律，包括泰国《个人数据保护法》（B.E. 2562，2019 年，下称「PDPA」），0x4 是本政策所述个人数据的数据控制者。

您经由 0x4 访问的公开区块链、第三方协议及其他服务，不适用本政策，而适用其各自的隐私规则。

02我们从不收集的信息

您的助记词、私钥和钱包密码在您的设备上生成和保存，从不传输给我们。使用本服务时，我们不收集您的姓名、邮箱、手机号或身份证件。您可以主动向我们提供这些信息，例如联系客服时。

03我们处理的信息

上述信息大多与您的钱包地址关联，其中许多内容（包括交易、持仓与礼物）无论您是否使用 0x4，本来就能在公开区块链上查到。

04消息与对话

私信在发送前即在您的设备上完成端到端加密。我们的服务器只存储和转发加密副本，从不持有解密密钥。加密副本在服务器上保留多久由您选择：直到您删除、直到您的设备收到，或每天结束时删除。私信的推送通知只显示发送者名字，不含消息内容。

群聊、动态与评论保存在我们的服务器上，以便成员阅读。它们在传输过程中受到加密保护，但不是端到端加密。聊天中分享的媒体文件会在 30 天后从服务器删除。

您与小精灵的对话会被保存，以便它记住上下文。生成回复时，我们会把您的这句话、最近的对话以及小精灵当前的状态发送给 AI 模型服务商。我们不发送您的钱包地址、昵称或账户金额，并会过滤任何疑似助记词或密钥的内容。请不要在与小精灵的对话中透露敏感个人信息。

05信息的用途

• 提供本服务，包括显示余额、选择交易路径、投递消息、运行直播与会议、结算礼物、运行小精灵；
• 为您登录并保障会话安全，包括在有新设备登录时通知您；
• 计算交易量、手续费等级与排名；
• 发送您已开启的通知；
• 防范欺诈、垃圾信息与滥用，执行我们的服务条款，履行制裁合规及其他法律义务；
• 处理客服请求；
• 维护、排查和改进本服务。

我们不将您的信息用于广告，不建立广告画像，也不出售或出租个人数据。

06处理依据

依照 PDPA，以及在适用时依照欧盟和英国《通用数据保护条例》，我们基于以下依据处理个人数据：

• 履行合同：提供您所请求的服务需要这些数据。
• 正当利益：保障本服务安全、防止滥用、改进功能，且该利益不凌驾于您的权利之上。
• 法定义务：制裁筛查、记录留存及回应合法要求所必需的处理。
• 您的同意：绑定 X 账号、接收推送通知等可选功能，以您的同意为依据，您可随时撤回。

07信息的接收方

我们只在运营本服务所必需的范围内共享信息，接收方是按我们指示处理数据的服务商，或您自己选择使用的服务：

• 托管、网络与内容分发服务商：提供网站服务、保护服务器、存储文件。
• 音视频基础设施：中转直播与会议，并以您的钱包地址和昵称作为参会身份。
• AI 模型服务商：依据第 4 节所述的有限上下文生成小精灵的回复。
• 区块链节点与数据服务商：读取您公开地址的余额、记录与 NFT，并广播您签署的交易。
• 兑换、跨链与永续合约协议：在您交易时接收您的地址与订单信息。
• 行情数据服务商：只接收所查询的代币或交易对。
• 手机系统推送服务：接收您的设备令牌与通知文字。
• X：仅在您选择绑定 X 账号时。

此外，在法律或法律程序要求时、为保护用户或 0x4 的权利、安全与财产时，或在本服务发生合并、收购或转让时，我们也可能披露信息；发生转让的，本政策继续适用。我们的主要服务商名单可应要求提供。

08公开区块链

您的交易记录在公开区块链上。区块链的设计是永久保存、公开可读，任何人都能看到这些交易的地址、金额与时间。我们不控制区块链，无法修改或删除链上记录，包括在收到删除请求时。

09设备上的存储

我们不使用 Cookie 或追踪像素，不运行第三方统计或广告工具。为了正常运行，本服务会在您的浏览器或应用存储中保存部分信息：加密后的钱包、登录会话、设置、语言、收藏以及聊天记录的本地缓存。清除这些存储或删除应用、插件，即会从该设备上删除这些信息。操作前请确认已备份助记词。

我们的网站从字体服务加载字体，该服务可能在请求中获得您的 IP 地址。

10保存期限

• 账户、资料与活动数据在您的账户存续期间保存，并在实现上述用途所需的期限内保存。
• 加密私信按您选择的设置保存；聊天媒体在 30 天后删除；动态、评论与群聊消息保存至被删除为止。
• 小精灵之间的对话最多保存 30 天；您与自己小精灵的对话保存至您要求删除为止。
• 用于限流的 IP 地址只保存在内存中；含有 IP 地址的服务器日志为安全与排查短期保存。
• 服务器备份保存 14 天，因此已删除的信息可能在该期限内仍存在于备份中。
• 法律要求保留，或为解决争议、执行服务条款所需时，我们会保存更长时间。

11安全

我们以传输加密、敏感凭证的存储加密、访问控制以及对工作人员可见范围的限制来保护信息。代您执行某项功能的密钥，例如永续合约密钥，均加密保存，并且只具有您所授予的权限。任何系统都无法做到绝对安全，钱包的安全最终取决于您对设备与助记词的保护。

12跨境传输

我们的服务器与服务商可能位于您居住国家或地区以外，信息可能在这些地方处理。PDPA 或其他适用法律对此类传输有限制的，我们依照法律允许的保障措施进行，例如合同保护或您的同意。

13您的权利

在适用法律范围内，您可以要求查阅或获取您的个人数据副本，要求更正、删除、限制处理或反对处理，要求将数据转移至其他服务，或撤回已作出的同意。其中许多操作您可以在本服务内直接完成：编辑资料、解除 X 绑定、移除关联钱包、删除动态与消息、调整私信保留方式、让其他设备下线、注销账户（设置 → 注销账号）。

注销账户后，我们会删除您的资料、动态、评论、关注关系、消息与小精灵；充值、提现、打赏结算等资金记录，封禁记录，以及他人对该账户的举报记录，会在记账、安全或法律需要的范围内保留。其他请求，请从可供我们核实的渠道写信至 support@420.meme，或在我们要求时用您的钱包签名确认。我们会在 30 日内答复。写入区块链的信息无法删除。如您认为自己的权利未获尊重，可以向泰国个人数据保护委员会或您所在地的主管机构投诉。

14未成年人

本服务不面向未满 18 周岁的人士，我们不会在知情的情况下收集未成年人的个人数据。如您认为有未成年人在使用本服务，请联系我们，我们会采取相应措施。

15政策变更

我们可能随本服务的发展更新本政策，页首日期显示最近一次更新的时间。如属重大变更，我们会在生效前于本服务内通知您。

16联系我们

隐私相关的问题与请求，请写信至 support@420.meme。本政策以英文和中文书就，两种文本如有不一致，以英文文本为准。