Privacy Policy Even | Toxic Flow Labs Pte Ltd | geteven.xyz | info@geteven.xyz Privacy Policy Effective Date: 12 June 2026 This Privacy Policy explains how Toxic Flow Labs Pte Ltd, a company incorporated in Singapore ("Toxic Flow Labs", "we", "us" or "our"), collects, uses, stores, shares and protects information in connection with the Even mobile application, website located at geteven.xyz, related software, notifications, content, communications, features and services (collectively, the "Service"). Even is a software interface and mobile frontend that helps users discover, view, track and access third-party prediction market information and services, including markets made available through Polymarket or other third-party protocols, applications, websites, APIs, smart contracts, wallet infrastructure, analytics tools, data providers and service providers. We do not operate the underlying prediction markets, do not create or list market outcomes unless expressly stated, do not custody user funds, do not hold user assets on behalf of users, do not guarantee market availability, accuracy, liquidity, settlement, pricing, resolution or user returns, and do not provide financial, investment, betting, legal, tax or regulated advice. Information We Collect. Depending on how you use the Service, we may collect information that you provide directly, information generated through your use of the Service, and information received from third parties. This may include name or display name, username, email address, support messages, wallet addresses, public blockchain information, trade-related and market-interaction information visible to or made available through third-party services, watchlists, saved markets, alert preferences, notification permissions and tokens, device information, browser and app information, operating system, app version, device identifiers, IP address, approximate location derived from IP address or device settings, referral or campaign information, reward or promotional eligibility information, crash logs, diagnostics, analytics events, session recordings or product usage data, pages or screens viewed, buttons tapped, search terms, interactions with notifications, timestamps, language, country or region settings, and other information that is reasonably necessary for operating, securing, improving, personalising, supporting and promoting the Service. We may use PostHog for analytics and product insights, and we may use Privy or similar wallet and authentication infrastructure for embedded or user-controlled wallets. Privy wallets and related third-party wallet services are provided by third parties and are subject to their own terms and privacy practices. We do not collect or store private keys or seed phrases, and users are responsible for safeguarding wallet credentials, devices and access methods. How We Use Information. We use information to provide, maintain, troubleshoot, secure, improve and personalise the Service; to create and manage accounts or sessions; to display markets, positions, wallet-related information and other data made available through third parties; to enable alerts, notifications and watchlists; to send price alerts, market alerts, match or event alerts, lineup or news alerts, movement alerts, PnL alerts, watchlist alerts, new-market alerts, trade nudges, promotional messages, rewards-related messages and service communications; to process support requests; to detect, investigate and prevent fraud, abuse, misuse, security incidents, prohibited activity and violations of our Terms; to comply with applicable laws, sanctions, court orders, regulatory requests and legal processes; to measure performance, diagnose issues, test features, conduct research, understand usage patterns, improve onboarding and retention, administer credits, rewards, campaigns or promotions, and protect our rights, users and third parties. We may aggregate or de-identify information so that it does not reasonably identify a particular user, and we may use such information for any lawful purpose. Notifications and Communications. By enabling notifications, you agree that we may send push notifications, in-app messages, emails or other communications relating to the Service, markets, events, trading activity, price movements, account activity, rewards, promotions, security, product updates and support. You can usually control push notifications through your device settings and email communications through unsubscribe links or by contacting us. Some service, security or legal communications may still be sent where necessary. Sharing of Information. We may share information with service providers, infrastructure providers, analytics providers, wallet and authentication providers, notification providers, hosting providers, security vendors, customer support tools, professional advisers, auditors, insurers, payment, reward or campaign partners, third-party market or protocol providers, blockchain infrastructure providers, affiliates, business transferees, regulators, law enforcement, courts or other authorities where reasonably necessary. We may share wallet addresses, public blockchain data, analytics data, device data, diagnostic data, account data, support data or aggregated/de-identified data as required to operate and improve the Service. We do not sell personal information in the ordinary sense of exchanging it for money. Some privacy laws define certain analytics, advertising or tracking activities as a "sale", "share" or targeted advertising; where those laws apply, users may have rights to opt out as described below or by contacting us. Third-Party Services and Public Blockchains. The Service may display, link to, embed, route to or interoperate with third-party websites, applications, APIs, wallets, protocols, blockchains, prediction markets, market creators, data providers, smart contracts, bridges, on-ramps, off-ramps, identity tools, analytics tools and other services. Your use of such third-party services is governed by their own terms, privacy policies and risk disclosures. Public blockchains are transparent and immutable, and wallet addresses, transactions, positions and related activity may be public, permanent and independently analysed by anyone. We are not responsible for third-party privacy practices, third-party security, smart contract behaviour, protocol changes, market resolutions, execution, liquidity, errors, outages, indexing delays, or information made public through third-party services or blockchains. Legal Bases Where Required. Where applicable law requires a legal basis for processing personal information, we may process information because it is necessary to perform a contract with you, because we have legitimate interests in operating, improving, securing, marketing and supporting the Service, because processing is necessary to comply with legal obligations, because processing is necessary to protect vital interests, or because you have provided consent. You may withdraw consent where processing is based on consent, but withdrawal will not affect processing already carried out or processing based on another lawful ground. Retention. We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, maintain records, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud or abuse, support audits, and protect our rights and users. Public blockchain data may be permanent and outside our ability to delete. We may retain aggregated, anonymised or de-identified data indefinitely. Security. We use reasonable administrative, technical and organisational measures designed to protect information. However, no system, network, wallet, blockchain, protocol, software, transmission or storage method is completely secure. You are responsible for securing your devices, accounts, wallets, recovery methods, passwords, passkeys and access credentials. We are not responsible for unauthorised access caused by user error, compromised devices, compromised credentials, third-party wallet issues, phishing, malware, social engineering, blockchain finality, smart contract risk or third-party service failures. International Transfers. We operate from Singapore and may process information in Singapore and other countries where we, our affiliates, service providers or partners operate. These countries may have data protection laws different from those in your jurisdiction. By using the Service, you understand that information may be transferred to and processed in such countries, subject to safeguards where required by law. Your Choices and Rights. Depending on your location, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, opt-out of certain processing, or lodge a complaint with a data protection authority. These rights may be limited by law, security needs, blockchain immutability, fraud prevention, legal obligations, confidential information, third-party rights, technical feasibility or our legitimate interests. To exercise rights, contact info@geteven.xyz. We may need to verify your identity and may decline requests where permitted by law. Children. The Service is not intended for children or for anyone under the minimum legal age required to use prediction markets, crypto wallets, financial applications or similar services in their jurisdiction. In all cases, the Service is intended only for users who are at least 18 years old or the age of majority in their jurisdiction, whichever is higher. We do not knowingly collect information from children. If you believe a child has provided information to us, contact info@geteven.xyz. Eligibility, Restricted Jurisdictions and Compliance. The Service may not be available in all countries, regions or jurisdictions. You are responsible for ensuring that your access to and use of the Service and any third-party market, wallet, protocol, token, promotion, reward or transaction is lawful in your jurisdiction. If any country, region, person, market, product, feature, promotion or activity is blocked, restricted, prohibited or subject to legal, regulatory, sanctions, app-store, third-party provider or internal compliance limitations, we may restrict, suspend, geo-block, disable or terminate access. You must not access or attempt to access the Service using VPNs, proxies, false information or any other method to evade restrictions. Rewards and Promotions. We may offer credits, rewards, referrals, campaigns, reimbursements, incentives or promotional benefits from time to time. Such programmes may be subject to eligibility conditions, limits, exclusions, verification, availability, anti-abuse checks, local law restrictions, third-party rules and separate terms. We may modify, withhold, reverse, expire, deny or discontinue rewards or promotions at any time where permitted by law, including where we suspect abuse, fraud, ineligibility, technical error, regulatory risk or violation of our Terms. Changes to This Privacy Policy. We may update this Privacy Policy from time to time. The updated version will be posted in the Service or on geteven.xyz and will be effective when posted unless otherwise stated. Your continued use of the Service after an update means you acknowledge the updated Privacy Policy. If required by law, we may provide additional notice or request consent. Contact. For questions or requests relating to this Privacy Policy or privacy matters, contact Toxic Flow Labs Pte Ltd at info@geteven.xyz.