Privacy Policy

Who we are

Heist Inc. operates Heist and is responsible for the personal information described in this Privacy Policy. In this policy, “Heist,” “we,” “us,” and “our” refer to Heist Inc. You can contact us about privacy at gm@hologram.xyz.

What this policy covers

This policy applies to the Heist app on iOS, Android, and the web, to useheist.com, to the early-access waitlist, and to related emails. It does not apply to third-party websites or services that have their own privacy policies.

Information we collect

Account information

When you create a Heist account, our sign-in provider, Privy, verifies the email address, phone number, or Apple account you sign in with, and we associate your account with a pseudonymous account identifier. We never ask for, collect, or store private keys or recovery phrases.

Wallet and transaction information

Signing up creates embedded blockchain wallets for your account. We process your wallet addresses, balances, deposits, withdrawals, trades, and fees to operate the service, maintain accurate records, prevent abuse, and meet legal obligations. Blockchain transactions are public by design: once recorded on a public network, they are visible to anyone and cannot be deleted by us.

Waitlist information

When you join early access, we collect your email address, the Heist form you used, your waitlist group, signup time, confirmation status, and subscription preferences.

Email and communications information

If you receive or respond to an email from us, we may process the message, delivery status, confirmation activity, and email engagement information such as opens and link clicks where available.

Device and technical information

Our hosting, security, and infrastructure providers may process limited technical information needed to deliver and protect their services, such as IP address, browser or device type, request time, referring page, and diagnostic logs. If you turn on notifications, we process a push token for your device so we can deliver them.

Product analytics and session replay

We use PostHog to understand how Heist is used. In the app, analytics runs only with your consent, which you can change at any time under Privacy & account. Analytics events describe product steps — for example that a trade was submitted or a deposit screen was viewed — and never include amounts, balances, holdings, wallet addresses, transaction hashes, emails, or names. Session replay masks all text, inputs, and images. On this website, if your browser sends a Global Privacy Control or Do Not Track signal, we do not load analytics or record your session. We do not use analytics for advertising.

Information you send us

We collect information you choose to include when you contact Heist or request support.

How we use information

• To create and secure your account and its embedded wallets.
• To execute the deposits, trades, and withdrawals you request, and to keep an accurate record of them.
• To operate, secure, troubleshoot, and improve the app and website.
• To send service, security, and product communications, and the notifications you turn on.
• To prevent fraud and abuse, enforce our Terms, and comply with law.
• To add you to the waitlist and confirm that you control the submitted email address.

Legal bases

Where data-protection law requires a legal basis, we rely on the performance of our contract with you (operating your account, wallets, and trades); your consent (product analytics in the app, optional emails); our legitimate interests in operating, securing, and improving Heist; and compliance with legal obligations. You may withdraw consent at any time, but withdrawal does not affect earlier lawful processing.

How we share information

We share information only as needed to operate Heist, including with:

• Privy, which provides sign-in and embedded wallet infrastructure.
• Blockchain infrastructure providers (such as Alchemy and Helius) and trading venues, which carry the public blockchain transactions you initiate.
• PostHog, which processes the consent-gated product analytics and masked session replays described above.
• Loops, which hosts the waitlist and sends confirmation and update emails.
• Hosting and infrastructure providers, which host and deliver the app, API, and website.
• Professional advisers, authorities, or transaction parties when reasonably necessary to comply with law, protect rights and safety, or evaluate a corporate transaction.

We do not sell personal information or share it for cross-context behavioral advertising.

Retention

We keep account, wallet, and transaction records while your account is open and afterwards for as long as reasonably needed to resolve disputes, secure the service, and meet legal, accounting, and regulatory obligations. Waitlist and subscription information is kept while you remain subscribed; if you unsubscribe, we may retain the minimum needed to honor that choice. Provider logs may be retained for their standard security and operational periods. Records on public blockchains are permanent and outside our control.

Your choices and rights

You can turn app analytics off at any time under Privacy & account, and you can delete your Heist account from the same place in the app. You can unsubscribe from marketing email through the link in any message, and turn off website analytics by enabling Global Privacy Control or Do Not Track in your browser. Depending on where you live, you may also have rights to request access, correction, deletion, restriction, portability, or an objection to certain processing, and to complain to a data-protection authority. Send requests to gm@hologram.xyz. We may need to verify your request.

International processing

Heist and its providers may process information in countries other than your own. Where required, we use legally recognized safeguards for those transfers.

Children

Heist is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has submitted information, contact us so we can review and delete it.

Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information, and we never hold your private keys or recovery phrases. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy as Heist changes. We will post the revised version here and change the “Last updated” date. If a change materially affects how we use information already collected, we will provide additional notice where required.

Contact

For privacy questions or requests, email gm@hologram.xyz.