Privacy Policy

Crucible Labs Mobile App Privacy Policy

Effective Date: Please click here to view the previous version of our Privacy Notice.

This Privacy Policy describes how Crucible Labs, Inc. (“Crucible Labs,” “we,” “us,” or “our”) processes personal information in connection with: our website at www.cruciblelabs.com; our mobile applications distributed through the Apple App Store and Google Play Store (the “Mobile Apps”); our browser extension and other wallet software; our self-custodial wallet software used to access the Bittensor ecosystem and compatible digital assets (the “Wallet Software”); and any other online or offline offerings that link to or reference this Privacy Policy (collectively, the “Services”).

NOTICE TO EUROPEAN USERS: Please see the Notice to European users section for additional information for individuals located in the European Economic Area (which we refer to as “Europe”, and “European” should be understood accordingly) below.

The Wallet Software is non-custodial This means: your private keys, seed phrases, and recovery mnemonics are generated on your device, stored in your device’s secure storage, and never transmitted to us; we do not hold custody of your digital assets at any time; we do not require you to create a Crucible Labs account to use the Wallet Software; and we cannot recover your keys, seed phrase, or assets if you lose them. Crucible Labs acts as a data controller for the personal information described in this Policy. By using the Services, you acknowledge that you have read and understood this Privacy Policy.

1. Updates to This Privacy PolicyWe may update this Privacy Policy from time to time. If we do, we will notify you by posting the updated Policy on our website, within the Services, or through other communications as appropriate, and we will update the dates above. Where changes are material, we will provide additional notice as required by applicable law. Your continued use of the Services after an update takes effect constitutes acceptance of the revised Policy, except where applicable law requires your consent.

2. Personal Information We CollectWe collect personal information that you provide directly, personal information collected automatically when you use the Services, and limited personal information from third parties.

Before describing what we collect, it is important to state what we do not collect: • We do not collect or receive your private keys, seed phrases, or recovery mnemonics.

• We do not collect biometric data (Face ID, Touch ID, or fingerprints). Biometric authentication is performed entirely by your device’s operating system; Crucible Labs never receives, stores, or has access to this data.

• We do not perform identity verification (KYC) within the Wallet Software itself. If you use an optional fiat-to-crypto on-ramp or other regulated third-party integration, that third party may perform its own verification independently.

• We do not collect, store, or track your wallet address for analytics, advertising, or profiling, and we do not associate it with the other personal information we hold. The Wallet Software uses your public wallet address locally on your device to display balances and build transactions, and transmits it to public blockchain nodes to provide the Services; once recorded on-chain, that information is public and outside our control (see Section 5).

Personal information you provide to us • Support communications. If you contact support, we collect your email address, the contents of your message, and any information you choose to share.

• Newsletter and product updates. If you subscribe to our communications, we collect your email address and stated preferences.

• Optional product account. If you create an optional Crucible Labs product account (for example, for beta programs or to save preferences across devices), we collect your email address, the authentication credentials you choose for that product account, and any optional profile information. This product account is separate from your on-chain wallet, which Crucible Labs does not access or control.

• Events, promotions, and surveys. Information you provide when you participate in events, promotions, contests, or surveys.

• Business and job inquiries. Information you provide in connection with partnership, investment, or employment inquiries, including resumes or CVs.

Personal information collected automatically When you use the Services, we may automatically collect: IP address; browser type and version; operating system and version; device identifiers provided by your browser or operating system; application version; usage activity (such as screens viewed, features used, and interaction patterns); referring URLs; crash reports and diagnostics; timestamps; and approximate (city- or region-level) location derived from IP address. We do not collect precise GPS location.

Mobile application information When you use our Mobile Apps, we may additionally collect device model and manufacturer, mobile network information, push-notification tokens (to deliver notifications you have enabled), language and timezone settings, and app-interaction analytics. Depending on your settings and the features you use, the Mobile Apps may request permission to access: the device camera (for QR-code scanning of wallet addresses); the device photo library (only if you choose to import or export wallet data via image); biometric authentication (for app unlock; processed locally on your device only); push-notification permissions; and local device storage. You may modify these permissions in your device settings; disabling them may limit certain functionality.

Analytics identifier To measure feature usage and product quality, we associate analytics data with a randomly generated identifier that is created on your device and is not derived from, and is not linked to, your wallet address. We do not collect, log, or track your wallet address for analytics, and we do not share this identifier with advertisers or use it for cross-context behavioral advertising.

Cookies, SDKs, and similar technologies We and our service providers may use cookies, SDKs, pixels, local storage, and similar technologies to operate and improve the Services, analyze usage, maintain security, and measure the effectiveness of communications. We do not use these technologies for cross-context behavioral advertising within the Wallet Software or Mobile Apps. You may manage cookies and tracking preferences through your browser or device settings. See Section 6 for Do Not Track and Global Privacy Control.

Information from third parties We may receive information from public blockchain networks (information observed from on-chain activity, as described in Section 5); analytics and crash-reporting providers; authentication providers, only when you choose to use them; business partners (limited to information necessary to provide a joint product or service you request); and publicly available sources.

3. How We Use Personal Information

Provide the Services To provide access to functionality and features; communicate with you about your use of the Services; provide customer support; send transactional and service-related communications; authenticate access to optional product accounts; and diagnose and resolve technical issues.

Operate and improve the Services To monitor and analyze usage trends in aggregate; diagnose crashes and improve performance; develop and test new features; and maintain security and detect fraud, abuse, or unauthorized activity.

Comply with legal obligations To respond to lawful requests from authorities; enforce our terms and policies; and protect the rights, safety, and security of users and the Services.

Communicate with you To send product updates, newsletters, and marketing communications where you have opted in, and to notify you of material changes to the Services or our policies.

Aggregated and de-identified information We may aggregate or de-identify personal information so that it can no longer reasonably be used to identify you, and may use such information for any lawful purpose, including improving product quality, conducting research, and informing product strategy.

Model and system improvement We may use aggregated, anonymized usage statistics (such as feature-interaction counts, crash patterns, and performance metrics) to improve fraud detection, performance, and product quality. We do not use the contents of your support communications, your wallet activity, or other personal information to train general-purpose artificial-intelligence or machine-learning models.

Automated processing and the Smart Allocator Certain optional features, including the Smart Allocator, apply preset, rules-based logic that you activate and can disable. The Smart Allocator operates within your self-custodial wallet to deploy rewards according to rules described in the App; you choose whether to enable it, and transactions are effected through your wallet. We do not use these features to make decisions about you that produce legal or similarly significant effects without your activation and control, and we do not engage in profiling for those purposes. Where applicable law gives you rights regarding automated decision-making, you may contact us as described in Section 17.

4. How We Share Personal InformationWE DO NOT SELL PERSONAL INFORMATION FOR MONETARY CONSIDERATION, AND WE DO NOT SHARE PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING, AS THOSE TERMS ARE DEFINED UNDER U.S. STATE PRIVACY LAWS.

Service providers We share personal information with third-party service providers that help us operate the Services under contractual data-protection terms, such as cloud hosting and infrastructure, analytics, crash and error reporting, customer support, email and communications, and security and fraud-prevention providers. Service providers are contractually restricted from using personal information for any purpose other than providing services to us.

Third-party services you choose to use The Services may integrate with optional third-party services such as fiat-to-crypto on-ramp providers, hardware-wallet providers (such as Ledger), and authentication providers. When you choose to use one of these integrations, the third party operates independently as a separate data controller and collects information directly from you under its own privacy policy. We are not responsible for the privacy practices of these third parties. Identity verification (KYC), where required, is performed by the third party, not by Crucible Labs.

App store and platform providers Our Mobile Apps are distributed through the Apple App Store and Google Play Store. Your use of those platforms is subject to the applicable provider’s terms and privacy policies, and we are not responsible for the privacy practices of Apple, Google, or other platform providers.

Legal and compliance disclosures We may disclose personal information if we believe in good faith that disclosure is required to comply with applicable law or legal process; respond to lawful requests from public authorities; protect the rights, safety, or property of Crucible Labs, our users, or others; detect, prevent, or address fraud, security, or technical issues; or enforce our terms and policies.

Business transfers If Crucible Labs is involved in a merger, acquisition, financing, asset sale, bankruptcy, or similar transaction, personal information may be transferred as part of that transaction. We will provide notice where required by law.

Aggregated and de-identified information We may share aggregated or de-identified information that cannot reasonably be used to identify you.

5. Blockchain Data and the Limits of Our ControlThe Wallet Software is an interface to the Bittensor blockchain, a public, decentralized, and immutable ledger operated by a global network of independent participants. Crucible Labs does not own, operate, or control the Bittensor blockchain. Because of the technical nature of public blockchains, the following information, once recorded, is permanent and outside our ability to modify or remove: wallet addresses; transaction amounts, types, timestamps, and counterparties; staking, delegation, and unstaking activity; on-chain interactions and extrinsics; and any other data you choose to record on-chain. This information is publicly visible and can be read, copied, archived, indexed, and analyzed by third parties – including blockchain-analytics firms, researchers, journalists, and law enforcement – without our involvement or knowledge.

Implications for your privacy rights.Where applicable law gives you the right to deletion, rectification, restriction, or erasure, those rights extend only to personal information we process on our own systems (for example, support tickets, email subscriptions, or a pseudonymous analytics identifier). We cannot delete, rectify, restrict, or anonymize information that resides on the Bittensor blockchain or on third-party systems we do not control.

RPC and node communication.When the Wallet Software queries blockchain state or broadcasts a signed transaction, it communicates with public Bittensor nodes. Those nodes can observe the IP address from which a request originates and the content of the request.

Reducing your on-chain footprint.You can take steps such as using separate wallet addresses for different purposes, avoiding the association of wallet addresses with identifying information on public forums, and considering the privacy implications of any transaction before signing it.

6. Your Privacy Choices and RightsDepending on your jurisdiction, you may have rights to access the personal information we hold about you; correct inaccurate information; request deletion (subject to the blockchain limitations in Section 5 and to legal retention requirements); object to or restrict certain processing; withdraw consent where processing is based on consent; request portability; and lodge a complaint with your local data protection authority. To exercise any of these rights, contact us at privacy@cruciblelabs.com. We will respond within the timeframe required by applicable law. We may need to verify your identity by asking you to confirm information we already hold, or by other reasonable means proportionate to the sensitivity of the request.

Marketing communications You may opt out of marketing at any time using the unsubscribe link in any marketing email, by adjusting notification settings in our Mobile Apps, or by contacting privacy@cruciblelabs.com. You will continue to receive transactional and service-related communications.

Push notifications You may opt out of push notifications through your device settings or in-app notification preferences.

Do Not Track Do Not Track (“DNT”) is a preference you can set in certain browsers. There is no industry-standard response to DNT signals; at this time, we do not respond to or honor DNT signals or similar mechanisms.

Third parties may collect personal information about your online activities over time and across third-party websites when you use our website, as described in this Policy.

Global Privacy Control Where our website supports it, we treat a Global Privacy Control (GPC) signal from a supporting browser as a valid request to opt out of any “sale” or “sharing” of personal information as those terms are defined under U.S. state privacy laws.

7. International Transfers of Personal InformationYour information may be transferred to and processed in countries other than where you reside, including the United States, where Crucible Labs and many of our service providers are located, and which may have data-protection laws different from yours. For our relationships with service providers in countries without an EU adequacy decision (such as the United States), we rely on appropriate safeguards including the European Commission’s 2021 Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and, for UK transfers, the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs. These mechanisms primarily govern our relationships with the sub-processors that help us deliver the Services. Where we transfer personal information from other jurisdictions with cross-border restrictions (such as Brazil or Korea), we rely on the applicable lawful transfer mechanism, including consent where required and appropriate contractual safeguards.

8. Retention of Personal InformationWe retain personal information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. We determine retention periods based on the category and sensitivity of the information, the purpose for which it is processed, the existence of a legal or contractual obligation to retain it, and whether the purpose can be achieved through shorter retention. The general approach by category is: • Support communications: retained for the period necessary to resolve your inquiry and a reasonable period thereafter for quality and dispute-resolution purposes.

• Optional product account information: retained while the account is active, plus a reasonable period for account-recovery and dispute-resolution after closure.

• Analytics and diagnostics data: retained for the period needed for product-quality and security purposes, then deleted or aggregated.

• Job applications: retained for the period required by applicable employment law and our records-management practices.

• Information retained for legal, compliance, or fraud-prevention purposes: retained as long as required by applicable law or a documented retention obligation.

You may request deletion of your personal information at any time by contacting privacy@cruciblelabs.com, subject to the blockchain limitations in Section 5 and to legal retention requirements.

9. SecurityWe maintain administrative, technical, and physical safeguards designed to protect personal information against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use. These include encryption in transit (TLS) between your device and our services; encryption at rest for personal information stored on our infrastructure; access controls and authentication for personnel who handle personal information; vendor due diligence and contractual data-protection terms; and procedures for responding to security incidents. No security system is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the security of your devices, seed phrase, private keys, and authentication credentials, and for backing up your seed phrase offline. Crucible Labs does not store private keys or seed phrases for the non-custodial Wallet Software and cannot recover them.

10. Children’s PrivacyThe Services are intended only for adults and are not directed to anyone under 18 years of age. We do not knowingly collect personal information from anyone under 18, and in no event do we knowingly collect personal information from children under 13 (or under 16 where applicable law sets a higher threshold for processing children’s data). If you are a parent or guardian and believe a child has provided personal information to us, please contact privacy@cruciblelabs.com and we will take steps to delete it.

11. Supplemental Notice for the EU/UK (GDPR)This supplemental notice applies to processing subject to the EU or UK General Data Protection Regulation. References to “personal information” in this Privacy Policy to European Users should be understood to include a reference to “personal data” (as defined in the GDPR) – i.e., information about individuals from whom they are either directly identified or can be identified.

• Controller. Crucible Labs, Inc. is the controller in respect of the processing of your personal information covered by this Privacy Policy for purposes of European data protection legislation (“GDPR”). See the ‘Contact us’ section below for our contact detailsOur GDPR Representatives. Our EU representative appointed under the EU GDPR is EDPO. You can contact them by using EDPO’s online request form available at https://edpo.com/ or by postal mail to Avenue Huart Hamoir 71, 1030 Brussels, Belgium

Legal bases for processingWe rely on: performance of a contract (Art. 6(1)(b)) to provide the Services you request; legitimate interests (Art. 6(1)(f)) for security, fraud prevention, abuse detection, and anonymized/aggregated service improvement; legal obligation (Art. 6(1)(c)) for compliance and lawful requests; and consent (Art. 6(1)(a)) for marketing, which is opt-in in the EU/UK. Job-application processing relies on pre-contractual measures (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)).

Your rights In addition to the rights in Section 6, you have the rights to access and obtain a copy; rectification; erasure (subject to the Section 5 blockchain limitations); restriction; portability; objection to processing based on legitimate interests, including direct marketing; withdrawal of consent without affecting prior lawful processing; and to lodge a complaint with your supervisory authority (for example, the CNIL, the BfDI, the AEPD, the Garante, or the ICO). We will respond to verifiable requests within one month, extendable by two further months for complex requests.

12. Supplemental Notice for California (CCPA/CPRA)This supplemental notice applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. In the preceding 12 months, we have collected the categories of personal information summarized below.

CCPA Category Examples Collected?

A. IdentifiersIP address, pseudonymous analytics identifier Yes

B. Customer recordsName (if voluntarily provided), email address Voluntary only

C. ProtectedNone No classifications

D. CommercialRecords of product interactions and feature usage Limited information

E. Biometric informationNone. Biometric authentication is device-only No

F. Internet/networkWebsite browsing, interactions with the Wallet Yes activity Software

G. Geolocation dataApproximate (city/region) location from IP address Yes

H. Sensory dataNone No

I.Information from job applicants Voluntary only Professional/employment

J. Education informationNone No

K. InferencesLimited inferences from usage data for product Limited improvement

L. Sensitive personalNone No information We collect personal information from you directly, automatically through your use of the Services, from the public Bittensor blockchain, and from our service providers, for the purposes described in Section 3. We have disclosed Categories A, B, F, and G to service providers in the preceding 12 months for the business purposes described in this Policy. We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

Your California rights California residents have the rights to know, delete (subject to the Section 5 blockchain limitations), and correct personal information; to opt out of sale/sharing (although we do not sell or share as defined); to limit the use of sensitive personal information (which we do not use in ways that would require this right); and to non-discrimination for exercising any right. To exercise these rights, contact privacy@cruciblelabs.com; you may also use a Global Privacy Control signal as described in Section 6. We will verify your identity using information we already hold. We will respond within 45 days; if we deny a request, you may appeal by replying to our denial, and we will respond to appeals within 60 days. You may use an authorized agent with proof of authorization.

Shine the Light California Civil Code Section 1798.83 permits California residents to request information about our disclosure of personal information to third parties for those third parties’ direct-marketing purposes. We do not disclose personal information to third parties for their direct-marketing purposes.

13. Other JurisdictionsIf you reside in a jurisdiction with data-protection laws not specifically addressed above, you may have additional rights under local law, including rights to access, correct, delete, restrict, or object to processing. To exercise these rights or obtain information about how we comply with local law, contact privacy@cruciblelabs.com. You may also lodge a complaint with your local data-protection authority.

14. Mobile Platform Privacy DisclosuresAdditional information about data collection, sharing, and retention for our Mobile Apps is disclosed through Apple App Store privacy labels, Google Play Data Safety disclosures, and in-app privacy notices. These disclosures supplement this Policy. In the event of any inconsistency between this Policy and the platform-specific disclosures, this Policy controls.

15. Contact UsIf you have questions about this Policy or our privacy practices, or wish to exercise your rights, contact us at:

Crucible Labs, Inc.

• Mailing Address: 11 E Coeur D Alene Ave, Ste E, Coeur D Alene, ID, 83815Email: privacy@cruciblelabs.comWebsite: www.cruciblelabs.com