Privacy Policy.

This Privacy Policy (the "Policy") applies to the Pantheon interface at pantheonfi.com, app.pantheonfi.com, our mobile and desktop clients, and any APIs or developer tools we publish (collectively, the "Interface"). It describes the practices of Pantheon ("we," "us," "our"). Capitalized terms not defined here have the meanings given in our Terms of Use.

1. Summary

• We are non-custodial. We never hold your private keys, seed phrase, or funds.
• We don't require KYC. We don't collect government IDs, selfies, passports, tax IDs, or bank-account information from regular Users.
• We do log technical and usage data (wallet address, IP address, device fingerprint, events in the Interface) to operate the service, enforce restricted-jurisdiction rules, prevent abuse, and improve the product.
• Blockchains are public. When you trade on Hyperliquid, your wallet address and on-chain activity are visible on-chain and to anyone who looks.
• You have rights. If you live somewhere that grants access, deletion, or portability rights, you can exercise them via the contact page — select the Privacy category.

2. Information We Collect

2.1 Information you provide

• Wallet address. When you connect a self-custodial wallet, we receive the public wallet address and any signed authentication messages necessary to confirm that you control it.
• Profile information. If you create a Pantheon profile, the optional email address, handle, and any display name you add.
• Journal and notes. Any trade notes, tags, checklists, or journal content you write inside the Interface.
• Support communications. The content of messages you send us by email, Discord, or support form.

2.2 Information we collect automatically

• Device and connection. IP address, approximate location derived from IP, browser type and version, operating system, device type, language preference, and referring URL.
• Usage events. Pages and routes you visit, buttons you tap, features you use, session duration, performance and error telemetry.
• On-chain context. Public on-chain data associated with your connected wallet (positions, balances, order history), to the extent the Interface needs to display it to you.
• Cookies and similar technologies. See Section 5.

2.3 Information we deliberately do not collect

• Government-issued identification or photos of your face.
• Social-security numbers, taxpayer identification numbers, or national-ID numbers.
• Bank-account numbers, credit-card numbers, or similar fiat-rail data.
• Proof-of-address documents.
• Your private keys, seed phrase, or wallet password.

If we are ever required to begin collecting any of this data (for example, because a material change in applicable law requires it), we will update this Policy and give you notice before doing so.

3. How We Use Information

We use the information described above to:

• operate, maintain, and improve the Interface;
• authenticate you, maintain sessions, and remember your preferences;
• enforce access restrictions, including Restricted Jurisdiction and sanctions rules (see our Terms);
• detect, prevent, and investigate fraud, market manipulation, and other abuse;
• personalize journaling, analytics, and AI-coaching features;
• send you transactional messages (security alerts, legal notices, and major product changes);
• respond to support requests;
• comply with legal obligations, respond to lawful government requests, and enforce our Terms; and
• analyze aggregate patterns to understand what to build next.

4. How We Share Information

We share information in the following categories:

• Service providers. Vendors that host infrastructure (cloud compute, CDNs, databases), process analytics, deliver email, provide customer-support tooling, manage authentication, or perform chain-analytics screening. We only share what they need, and we require them to handle data consistent with this Policy.
• Third-party integrations you choose to use. For example, the charting library provided by TradingView, or any wallet or identity provider you connect.
• Blockchains and the Protocol. When you sign a transaction, it is broadcast to public blockchain networks and to the Hyperliquid protocol. We cannot restrict who can read or index that on-chain data.
• Law and safety. We may disclose information if we reasonably believe disclosure is required to comply with law, to respond to a valid legal process, to enforce our Terms, to protect the security of our Users, or to protect rights, property, or safety.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of the deal, subject to confidentiality commitments.
• With your direction. Anywhere you specifically ask us to share information on your behalf.

We do not sell your personal information for money. We do not share your personal information for cross-context behavioral advertising.

5. Cookies and Tracking Technologies

We use cookies, local storage, and similar technologies to keep you signed in, remember preferences, secure sessions, and measure how the Interface is used. Some of these technologies are strictly necessary for the Interface to work and cannot be disabled.

You can control non-essential cookies via your browser settings or, where offered, in-product controls. Disabling cookies may break parts of the Interface. Because the Interface does not rely on third-party advertising networks, we do not place ad-tech trackers on the site.

6. Third-Party Services

The Interface integrates with a small set of third-party services. Each has its own privacy policy, and when data is shared with them (e.g., charting interactions shared with TradingView, authentication shared with our identity provider, emails routed through our email provider), that policy applies in addition to this one. Notable integrations currently include:

• TradingView — charting library and market-data widgets.
• Hyperliquid — the decentralized derivatives protocol to which we route orders. On-chain data is public.
• Identity, wallet, and hosting providers — to operate the Interface.
• Analytics and error-monitoring providers — to understand usage and fix bugs. Where possible, we use privacy- preserving configurations.

7. Data Retention

We retain personal information only as long as reasonably necessary to operate the Interface, comply with legal obligations, resolve disputes, and enforce our Terms. Technical logs (IP, device, security events) are generally retained for a shorter period than content you created (like journal entries). On-chain data is permanent by nature — we cannot delete it.

8. Security

We use administrative, technical, and physical safeguards designed to protect information — including encryption in transit, encryption at rest for sensitive stores, access controls, audit logging, dependency scanning, and regular reviews. No system is perfectly secure. You are responsible for securing your wallet, your email account, and any credentials used to access the Interface.

9. Children

The Interface is not intended for, and we do not knowingly collect information from, anyone under 18 years of age (or the age of majority in their jurisdiction, if higher). If you believe a minor has provided information to us, contact us via the contact page (choose the Privacy category) and we will delete it.

10. International Users and Transfers

The Interface is operated globally. Information we collect may be processed and stored in jurisdictions other than the one in which you live, which may have different data-protection laws. Where required, we rely on standard contractual clauses, adequacy decisions, or other lawful transfer mechanisms. By using the Interface, you acknowledge that your information may be transferred to and processed in such jurisdictions.

11. Your Rights

Depending on where you live, you may have rights to:

• access the personal information we hold about you;
• correct information that is inaccurate or out of date;
• delete personal information, subject to legal and operational exceptions;
• portability — receive a copy of your information in a structured, machine-readable format;
• object to or restrict certain processing; and
• withdraw consent where we rely on consent as the legal basis for processing.

To exercise any of these rights, submit a request through the contact page using the Privacy category, from the email address associated with your profile. We may need to verify your control of the relevant wallet or account before acting on a request. If you are in the European Economic Area, the United Kingdom, or another jurisdiction with a dedicated data-protection authority, you also have the right to lodge a complaint with that authority.

We do not discriminate against Users who exercise their privacy rights.

12. "Do Not Track" and Global Privacy Control

Most browsers offer a "Do Not Track" setting. Because there is no common industry standard for how to respond to it, we do not respond to DNT signals. We do honor Global Privacy Control (GPC) signals where required by applicable law.

13. Changes to This Policy

We may update this Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page and, for material changes, give additional notice (for example, an in-product banner or email to the address associated with your profile). Your continued use of the Interface after the update constitutes acceptance of the updated Policy.

14. Contact

Questions, requests, and complaints about privacy can be sent via the contact page — select the Privacy category and a member of the team will respond.