Privacy Policy

Last updated: October 2026

1. Introduction and Privacy Principles

1.1. This Privacy Policy ("Policy") explains how Rexmo Technologies OÜ ("Rexmo", "we", "us" or "our"), operator of the Kute application and website, processes personal data in connection with Kute.

1.2. Kute is designed according to principles of privacy by design, data minimisation and self-custody. Our objective is to collect and retain only the information reasonably necessary to operate, secure and improve Kute, to provide functionalities requested by users and to account for the fees and referral rewards described in the Terms of Use and the Affiliate Terms.

1.3. As a non-custodial wallet, Kute is designed so that users retain control over their private keys, recovery credentials and crypto-assets. Rexmo does not require access to those credentials to operate the wallet.

1.4. This Policy applies to personal data processed by Rexmo through:

• the Kute mobile application;
• the Kute website;
• customer support channels;
• the Kute Affiliate Program; and
• other services operated by Rexmo that expressly refer to this Policy.

1.5. Certain functionalities available through Kute are provided through independent third-party services. Those providers may process personal data independently under their own privacy policies, as described in Section 7.

2. Non-Custodial Architecture and Data Stored on Your Device

2.1. Kute operates on a self-custody model.

2.2. Private keys and recovery credentials are generated and stored on the user's device, on a paired hardware signer, or, for passkey wallets, derived from a passkey credential that the device platform (for example iCloud Keychain or Android Credential Manager) stores and syncs. In every case they remain under the user's control.

2.3. Rexmo does not collect or store users' private keys or recovery phrases and cannot use those credentials to independently access, transfer, freeze, recover or otherwise dispose of users' crypto-assets.

2.4. Transaction authorisation and signing occur using credentials controlled by the user.

2.5. Certain wallet information may be stored locally on the user's device in order to provide Kute functionality. Locally stored information is not automatically transmitted to Rexmo merely because it is displayed through the application.

2.6. Users are responsible for protecting their devices and recovery credentials. Loss of recovery credentials may result in permanent loss of access to the wallet because Rexmo may not possess the information necessary to restore access.

3. Personal Data We Process

3.1. Device and Technical Information

3.1.1. Kute may process limited technical information necessary to operate, secure and improve the application, including:

• operating system;
• device model;
• application version and build number;
• platform;
• language;
• interface preferences, such as theme and preferred display currency; and
• technical information relating to application performance and compatibility.

3.2. Pseudonymous Device Identifier

3.2.1. The Kute mobile application generates a random identifier (UUID) on first launch ("Device ID") and stores it in the device's secure storage. It is sent to Rexmo's backend with each request in the X-Kute-Device-Id header.

3.2.2. The Device ID is used to distinguish application installations for purposes such as analytics, feature configuration, rate limiting, security and troubleshooting.

3.2.3. The Device ID is never the IMEI, the advertising identifier or any other hardware or operating-system identifier. Rexmo does not intentionally associate the Device ID with a user's name, email address, private keys, recovery phrase or wallet balance.

3.2.4. Because a persistent identifier may distinguish one device or installation from another, Rexmo treats the Device ID as pseudonymous personal data where required under applicable law.

3.3. Usage, Product Analytics and Attribution

3.3.1. Rexmo may process limited information about how Kute is used, including feature usage, navigation, application interactions, configuration information and technical events necessary to understand, maintain and improve the Platform.

3.3.2. Rexmo uses PostHog for product analytics and feature configuration. Such data is processed through PostHog's European Union infrastructure. Session replay is not used. Product analytics are on by default in the app. The app has an analytics switch, but the current version does not show it (see Section 6.3).

3.3.3. Product analytics include the details of the money actions a user takes in Kute, so that Rexmo can understand how each product is used: the type of action (for example a send, receive, conversion, prediction or investing order), the asset, network and venue, the amount and its US-dollar value, fees shown to the user, and for trading the market, side, order type, leverage and margin mode. The types of wallets a user adds (for example hot, hardware or watch-only) are also recorded. These events are linked to the pseudonymous analytics identifier described in Section 6.2.

3.3.4. Product analytics never include private keys, recovery phrases, wallet passwords, extended public keys (xpubs), wallet or deposit addresses, transaction or order identifiers or payment invoices. The app and Rexmo's backend remove these values from analytics events, including error reports, before they are sent. Because amounts and times recorded on public blockchains can sometimes be matched to transactions, users who prefer not to share this information can ask Rexmo to delete it (Section 13).

3.3.4a. Balances. To understand how people hold money across Bitcoin, Dollars, Predictions and Investing, the app sends a balance summary for the spending wallet: the US-dollar value of each of these balances, rounded to the cent. The app sends it at most once per app session and at most once every six hours. It is never sent for hardware, watch-only or tracked wallets, and it contains no addresses, identifiers or keys.

3.3.5. Rexmo uses AppsFlyer for install and referral attribution, to understand how users discover and install Kute and to measure the effectiveness of distribution channels. The app reports install and attribution events to AppsFlyer, and Rexmo's backend additionally sends AppsFlyer server-side purchase events for completed provider orders. These server-side events carry the provider, an order reference, the referral code involved, the order's US-dollar volume and Rexmo's revenue from that order, keyed to the AppsFlyer identifier of the install. They do not include wallet addresses, balances or keys.

3.4. Transaction and Order Records

3.4.1. When a user completes certain operations through Kute, Rexmo's backend keeps a record of the order in order to calculate Kute fees, account for referral rewards, pay affiliates, reconcile provider payouts and investigate problems.

3.4.2. Such records may include:

• the provider involved (for example Orchestra, Polymarket or Hyperliquid) and the provider's order identifier;
• the assets and amounts on both legs of a conversion, deposit or send, and the order status;
• the BTC/USD rate at completion and Rexmo's earnings from the order;
• for Orchestra orders, the order reference and settlement status;
• for Polymarket, which wallet placed each order carrying Kute's builder code, so that builder fees can be attributed to a referral;
• for Hyperliquid, builder-fee revenue attributed to each wallet; and
• the referral code that the wallet is bound to, where applicable.

3.4.3. These records are linked to the wallet's affiliate identity (its public key and Lightning address, see Section 3.8), not to a name or email address. Rexmo does not maintain a custodial account ledger and does not record individual on-chain, Lightning or Spark sends and receives that do not pass through a provider; the app reports only a running count of such transactions, used for referral statistics. Rexmo does, however, keep a wallet-level record of provider orders as described in this Section, and users should not assume that activity through Orchestra, Polymarket or Hyperliquid is unknown to Rexmo.

3.5. Network and Security Information

3.5.1. When a device communicates with Rexmo or its technical service providers, network information such as an IP address is necessarily transmitted as part of the communication.

3.5.2. Rexmo may process limited network and security information for purposes such as security, abuse prevention, rate limiting, service operation and troubleshooting. The client IP address may appear in error logs.

3.5.3. Where IP addresses or similar identifiers are not required to be retained, Rexmo seeks to minimise or shorten their retention.

3.6. Crash and Error Data

3.6.1. Rexmo uses Firebase Crashlytics (Google) to receive crash reports from the app. A crash report contains the error type, a stack trace and device and app-version information. Before a report is sent, the app strips addresses, invoices, amounts and similar values from the error message.

3.6.2. Crash reporting is separate from product analytics and is not turned off by the analytics switch. It is disabled in debug builds.

3.6.3. Rexmo's backend also keeps server-side logs of failed requests, which may include the Device ID, the client IP address and the error returned by an upstream provider.

3.7. Customer Support

3.7.1. If you contact Rexmo for support, we process the information you choose to provide, which may include:

• your contact information;
• messages and support history;
• attachments; and
• technical information necessary to investigate your request.

3.7.2. Kute uses Crisp to provide customer support chat in the app and on the website.

3.7.3. Users should not send private keys, recovery phrases or other wallet credentials through customer support channels. Rexmo will never need your recovery phrase to provide ordinary customer support.

3.8. Affiliate Program and Wallet Identity

3.8.1. Every wallet is enrolled in the Affiliate Program when it is created. Authentication does not use Telegram or any social login. The app proves control of the wallet by signing a challenge with the wallet's key (the "kute-auth-v2" scheme); Rexmo never receives the key itself.

3.8.2. In connection with the Affiliate Program, Rexmo processes:

• the wallet's public key;
• the wallet's Lightning address in the form [email protected], which is also the payout address;
• the wallet's own referral code and, where entered, the referrer's code and the time it was entered;
• the AppsFlyer identifier and platform reported by the app;
• the commission rate, earnings accrued, payouts made and their Lightning payment identifiers; and
• information reasonably necessary to detect self-referral, duplicate or fabricated referrals.

3.8.3. Rexmo does not process a name, email address or phone number for the Affiliate Program unless the participant provides one, for example as a Partner under a separate written agreement or in a support conversation.

3.9. Website Information

3.9.1. When users access the Kute website, Rexmo may process limited technical data, such as:

• browser and device information;
• page views;
• referrer information;
• campaign parameters;
• website interactions; and
• technical errors.

3.9.2. Where users voluntarily submit forms, join a waitlist or otherwise provide information through the website, Rexmo also processes the information submitted by the user.

3.10. Ask Sal (AI Assistant)

3.10.1. When a user asks Ask Sal a question, the app sends the typed question, the earlier messages of that chat and, where relevant, public market identifiers (for example a Polymarket market slug or a Hyperliquid coin) to Rexmo's backend, which forwards them to xAI's API (api.x.ai) to generate an answer. Where Rexmo enables live web research, xAI may also run web searches for the question.

3.10.2. Balances, addresses, positions, keys, the Device ID and the wallet's identity are not sent to xAI. The backend instructs the model not to request or infer such information and instructs xAI not to store the conversation.

3.10.3. The daily question limit (five questions per wallet) is enforced with a hashed wallet identifier held by Rexmo's backend.

3.11. Approximate Location

3.11.1. Kute does not use GPS or request the device's location permission.

3.11.2. Rexmo's backend derives an approximate country from the IP address of the connection (or from a country header supplied by Rexmo's edge provider where configured) in order to decide whether new trading, deposits or other regulated features may be offered to that connection. The country is used for that decision and for aggregate statistics; the IP address itself is handled as described in Section 3.5. Venues run their own, independent location checks.

3.12. Push Notifications

3.12.1. Where the user enables notifications, the app registers a push token with Firebase Cloud Messaging (Google) so that Rexmo can deliver notifications such as incoming payments or order updates. The token identifies the app installation, not the person.

4. Data We Do Not Collect

4.1. The non-custodial architecture of Kute is designed to minimise Rexmo's access to sensitive wallet information.

4.2. Rexmo does not collect or store, as part of the operation of the non-custodial wallet itself:

• users' private cryptographic keys, passkeys or seed material;
• wallet recovery phrases or seed phrases;
• wallet passwords or PINs stored locally on the device;
• biometric templates used by the device for local authentication;
• the IMEI or any hardware identifier;
• GPS or other precise location data;
• users' device contact lists;
• personal photos or unrelated device content; or
• browsing history outside Kute.

4.3. Rexmo does not require users to provide identity documents merely to create or operate the non-custodial Kute wallet.

4.4. A third-party service accessed through Kute may independently require identity verification or other information under its own terms, compliance procedures or applicable law. Such data is processed according to the arrangements applicable to that third-party service.

4.5. Rexmo does not sell or rent personal data to third parties for advertising or data-broker purposes. Attribution data shared with AppsFlyer (Section 3.3.5) is used to measure Rexmo's own acquisition channels.

5. Purposes and Legal Bases for Processing

5.1. Rexmo processes personal data only where there is an appropriate legal basis under applicable law.

5.2. Providing Kute and Requested Services

5.2.1. Rexmo processes data necessary to provide functionality requested by users, calculate and collect Kute fees, administer the Affiliate Program and respond to service-related requests.

5.2.2. The legal basis for such processing is generally the performance of a contract or steps taken at the user's request before entering into a contract.

5.3. Security, Fraud Prevention and Service Integrity

5.3.1. Rexmo may process limited technical, device and network information to protect Kute, users and Rexmo's infrastructure against security threats, fraud, abuse and unauthorised access, and to enforce regional restrictions applicable to particular features.

5.3.2. Where applicable, this processing is based on Rexmo's legitimate interests in maintaining the security and integrity of the Platform and complying with the restrictions of integrated providers.

5.4. Product Improvement, Analytics and Attribution

5.4.1. Rexmo may use limited usage, attribution and performance data to understand application functionality, diagnose errors, improve user experience, measure acquisition channels and develop Kute.

5.4.2. Depending on the nature of the technology used and applicable law, such processing may be based on consent or Rexmo's legitimate interests, subject to the applicable legal requirements.

5.4.3. Where consent is legally required for non-essential analytics or similar technologies, Rexmo will seek consent before enabling such processing.

5.5. Customer Support

5.5.1. Support data may be processed where necessary to perform our contractual obligations, respond to a user's request or pursue Rexmo's legitimate interest in providing customer support and resolving technical issues.

5.6. Legal and Regulatory Compliance

5.6.1. Rexmo may process information where necessary to comply with a legal obligation, respond to lawful requests, establish or defend legal claims or comply with applicable regulatory requirements.

5.7. Communications

5.7.1. Rexmo may send operational communications relating to Kute, including security alerts, service notices and material changes to the Platform or relevant policies.

5.7.2. Marketing communications will be sent only where permitted by applicable law and, where required, on the basis of the user's consent.

6. Analytics and Privacy Controls

6.1. Rexmo seeks to limit analytics to the information reasonably necessary to understand and improve the performance and use of Kute.

6.2. Analytics identifiers are designed to be pseudonymous and are not intended to identify users by name.

6.3. The app includes an analytics switch, but the current version does not show it, so product analytics are on for all users. When the switch is shown and turned off, it stops PostHog product analytics and AppsFlyer attribution. It does not stop Crashlytics crash reports (Section 3.6) or the order records that Rexmo needs for fee and referral accounting (Section 3.4). Until the switch is shown, users can object to product analytics or ask Rexmo to delete the analytics data linked to their identifier by contacting [email protected] (Section 13).

6.4. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

6.5. Certain strictly necessary technical processing may continue where required to operate, secure or troubleshoot the application and where another lawful basis applies.

7. Third-Party Services and Recipients

7.1. Rexmo uses third parties for certain technical and operational functions and also integrates independent third-party services into Kute.

7.2. Depending on the service concerned, a third party may process personal data:

• on Rexmo's behalf as a service provider or processor; or
• independently for its own purposes and under its own privacy policy.

7.3. Technical Service Providers

7.3.1. Technical recipients that receive data from the app or from Rexmo's backend are:

• PostHog (EU infrastructure): product analytics and feature configuration, subject to the analytics switch once the app shows it (Section 6.3);
• AppsFlyer: install and referral attribution, and server-side purchase events carrying order revenue and volume;
• Google Firebase: Crashlytics crash reports and Cloud Messaging push tokens;
• Crisp: customer support chat;
• xAI: generation of Ask Sal answers from the question text, chat history and public market identifiers; and
• hosting, edge, database and other infrastructure providers necessary to operate Kute's backend.

7.4. Integrated Third-Party Services

7.4.1. Kute provides access to independently operated third-party services. Most of them are contacted directly by the app on the user's device, so the provider sees the device's IP address and whatever the request contains, without passing through Rexmo. They are:

• Breez / Spark: Lightning, on-chain and Spark operations, and the passkey relying party keys.breez.technology for passkey wallets;
• Orchestra: USDB conversions through the Orchestra AMM, Orchestra cross-chain routing, bitcoin purchases through Cash App and rewards endpoints; Orchestra learns the source and destination addresses of each routed order;
• Polymarket: market data (gamma-api), order placement (clob), wallet deployment and approvals (relayer), live prices (ws-live-v2) and Polymarket's own region check (polymarket.com); Polymarket sees the user's Polygon address and signed orders;
• Hyperliquid (api.hyperliquid.xyz): market data, orders, positions and the HLP vault; Hyperliquid sees the user's trading address and signed orders;
• Circle CCTP contracts and Polygon RPC providers (PublicNode, dRPC): on-chain reads and transaction broadcasts for funding Venues;
• CoinGecko and Binance public market-data endpoints: prices and charts, with no wallet information sent; and
• the Bitcoin data provider the user selects in Settings (presets: Blockstream, Mempool, Bull Bitcoin, ACINQ, BlueWallet, Hodlister, or a custom server). If the selected provider is unreachable the app falls back to the next preset for about fifteen minutes. The provider in use learns the wallet's addresses or extended public key together with the device's IP address.

7.4.2. Polymarket browse feeds (the lists of events and markets shown in the Predictions tab) are fetched through Rexmo's backend rather than directly. The backend caches these public feeds briefly and logs only upstream failures; it does not record which markets a wallet browses.

7.4.3. When a user chooses to use an independent third-party service, the relevant provider receives the information necessary to provide or operate that service and processes it according to its own terms, privacy notice and applicable legal obligations. Users should review the relevant provider's privacy information before using an integrated service.

7.4.4. Where an integrated provider acts as an independent controller, Rexmo does not determine the purposes and means of that provider's independent processing. Such processing is governed by the provider's own privacy notice and applicable law.

8. Public Blockchain Information

8.1. Blockchain networks are public or distributed systems that operate independently from Rexmo.

8.2. Information recorded on a public blockchain may include transaction addresses, transaction amounts, timestamps, transaction identifiers and other blockchain data. This includes Polygon transactions related to Polymarket positions and Hyperliquid deposits and withdrawals.

8.3. Once information has been recorded on a public blockchain, Rexmo generally cannot alter, delete or erase that record.

8.4. The public availability of blockchain information exists independently from whether Rexmo stores the same information on its own systems.

8.5. Users should therefore understand that the use of a non-custodial wallet does not necessarily make blockchain activity anonymous.

9. Cookies and Website Analytics

9.1. The Kute website uses cookies or similar technologies necessary for website operation.

9.2. Rexmo may also use analytics technologies, including PostHog, to understand website usage and improve the website.

9.3. Where prior consent is required by applicable law, non-essential analytics technologies will not be activated until the user has provided the required consent.

9.4. Website analytics may include:

• a pseudonymous visitor identifier;
• page views and navigation information;
• time on page and interaction events;
• browser language;
• screen and device information;
• referrer information and campaign parameters; and
• website errors and performance information.

9.5. Rexmo does not use advertising cookies or third-party advertising trackers unless this Policy and the applicable consent interface are updated accordingly.

10. Data Retention

10.1. Rexmo retains personal data only for as long as reasonably necessary for the purposes for which it was collected, including applicable contractual, legal, accounting, security and dispute-resolution requirements.

10.2. Where possible, Rexmo applies specific retention periods and deletes or anonymises data after those periods expire.

10.3. Current retention practices may include:

• website technical logs: generally up to 30 days, unless longer retention is reasonably required for security investigation;
• backend operational and error logs: generally up to 90 days, unless a longer period is required for security, legal or dispute-resolution purposes;
• provider order records used for fee and referral accounting: retained for as long as the wallet is enrolled in the Affiliate Program and thereafter for the period required by accounting and tax law;
• records evidencing consent: retained for the period reasonably necessary to demonstrate the consent relied upon and comply with applicable legal obligations;
• inactive Affiliate Program records with no earnings: generally up to 2 years after the last activity, subject to applicable legal requirements;
• active Affiliate Program information: retained for the duration of participation in the program and thereafter for the period reasonably necessary to comply with accounting, contractual, tax or legal obligations; and
• customer support records: retained for the period reasonably necessary to resolve the request and protect legitimate legal interests.

10.4. Rexmo may retain data for a longer period where required by law, necessary to establish or defend legal claims or reasonably necessary to investigate fraud or security incidents.

11. Data Security

11.1. Rexmo applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.

11.2. Measures may include, as appropriate:

• encryption in transit;
• access controls;
• pseudonymisation;
• minimisation of data collected;
• restriction of internal access according to need;
• security monitoring; and
• periodic review of security practices.

11.3. No electronic system can be guaranteed to be completely secure. Users are also responsible for protecting their own devices and credentials.

11.4. Rexmo's security measures relating to personal data are separate from the user's responsibility for safeguarding private keys and recovery credentials that Rexmo does not possess.

12. International Data Transfers

12.1. Rexmo seeks to use European Economic Area ("EEA") data infrastructure where reasonably available and appropriate.

12.2. Certain technical or independent third-party providers, including AppsFlyer, Google, Crisp, xAI and the integrated venues, may process personal data outside the EEA.

12.3. Where Rexmo transfers personal data to a country outside the EEA and applicable law requires a transfer mechanism, Rexmo uses an appropriate legal basis for the transfer, which may include:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses approved by the European Commission; or
• another transfer mechanism permitted under applicable data protection law.

12.4. Independent third-party controllers are responsible for providing information regarding the international transfers they conduct under their own privacy policies.

13. Your Data Protection Rights

13.1. Subject to the conditions and limitations established by applicable law, users may have the right to:

• access personal data processed about them;
• rectify inaccurate or incomplete personal data;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain personal data in a structured, commonly used and machine-readable format and request data portability;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a competent data protection supervisory authority.

13.2. To exercise a privacy right, users may contact Rexmo at: [email protected]

13.3. Rexmo may need to verify the identity of the requester before responding where reasonably necessary to protect personal data. Because Rexmo holds no name or email for most wallets, verification may take the form of a message signed with the wallet's key.

13.4. Rexmo will respond to valid requests within the period required by applicable law. Under the GDPR, this is generally within one month of receipt, subject to lawful extensions where requests are complex or numerous.

13.5. The exercise of a data protection right is generally free of charge, although applicable law may permit a reasonable fee or refusal in cases of manifestly unfounded or excessive requests.

13.6. Supervisory Authority

13.6.1. Rexmo is established in Estonia. The Estonian data protection supervisory authority is:

Andmekaitse Inspektsioon
Estonian Data Protection Inspectorate

13.6.2. Users may also have the right to lodge a complaint with another competent supervisory authority, including in the EEA country of their habitual residence, place of work or the location of an alleged infringement, as provided by applicable law.

14. Affiliate Program Privacy Controls

14.1. Affiliates may request a copy of the information associated with their wallet, or deletion of that information, by contacting Rexmo through the support chat or the address in Section 13.2.

14.2. Where deletion is requested, Rexmo will remove or anonymise information that is no longer required, subject to any data that must be retained for legal, accounting, fraud-prevention or dispute-resolution purposes.

14.3. Information necessary to preserve legitimate accounting, referral, payment, fraud-prevention or legal records may be retained in anonymised, pseudonymised or otherwise minimised form where appropriate and permitted by law.

15. Children

15.1. Kute is intended for users who are 18 years of age or older.

15.2. Rexmo does not knowingly collect personal data from persons under 18 in connection with use of the Platform.

15.3. If Rexmo becomes aware that personal data has been collected from a person under 18 contrary to this Policy or applicable law, Rexmo will take reasonable steps to delete or otherwise appropriately address the information.

16. Changes to This Policy

16.1. Rexmo may update this Policy to reflect changes in Kute, data-processing practices, technology, service providers or applicable law.

16.2. The current version of this Policy and its effective date will be made available through the Kute application or website.

16.3. Where a change materially affects how personal data is processed, Rexmo will provide appropriate notice where required by applicable law.

16.4. Where a new processing activity requires consent, Rexmo will obtain that consent rather than treating continued use of Kute as consent to the new processing.

17. Contact

17.1. For questions, concerns, or requests regarding this Privacy Policy or data protection, please contact:

Rexmo Technologies OÜ
Tallinn, Estonia
[email protected]