Privacy Policy
Last updated 7 November 2026
We collect what we need to run your account and meet the law. We don't sell your data, and we don't use advertising or analytics trackers. You can download your data or delete your account in Settings.
- 1. Who is responsible
- 2. What we collect
- 3. Why we use it
- 4. Automated decisions
- 5. Who we share it with
- 6. Transfers abroad
- 7. How long we keep it
- 8. How we protect it
- 9. Your rights
- 10. Children
- 11. Changes
1. Who is responsible
Wickd ("we") decides how your personal data is used, and is the controller of it. Reach us on [email protected].
We handle personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and any other data protection law that applies to you.
2. What we collect
| Type | What it includes | Where it comes from |
|---|---|---|
| Account | Email, phone number, handle, password stored only as a salted hash, your Google account ID if you sign in with Google, and when you accepted these terms | You, Google |
| App | Whether you installed the app on your device | Your device |
| Profile | Your photo, which we redraw as a new image, keeping none of the original file or its metadata | You |
| Security | Two-factor secret, stored encrypted, backup codes, stored hashed, and the browser, system and date of each sign-in | You, your device |
| Network | IP address, used while handling a request to prevent abuse and to work out your country, which sets your first language and phone code and tells us if the service is available to you. We don't store the address on your account, only the country it points to and when you last visited | Your device |
| Financial | Balances, orders, trades, deposits, withdrawals and wallet addresses | You, our systems, WestWallet, public blockchains |
| Support | What you write in the support chat | You |
| Identity checks | If we ask: identity documents, proof of address and source of funds | You, verification providers |
| Referral | Who referred you, and what you tell us in an affiliate application | You, the person who referred you |
| Support | What you write to us | You |
We don't use advertising or analytics trackers, and we don't buy data about you.
3. Why we use it
| Purpose | Our basis |
|---|---|
| Create and run your account, trades, deposits and withdrawals | Our contract with you |
| Keep accounts and the service secure, and prevent fraud and abuse | Our contract with you, and legal duties |
| Identity, anti-money-laundering, sanctions and record-keeping duties | Legal duties |
| Answer you, and send important notices about your account | Our contract with you |
| Review affiliate applications and work out referrals | Our contract with you, or steps you asked for |
| Marketing messages, if we ever send them | Your consent, which you can withdraw at any time |
4. Automated decisions
Some decisions are made automatically. Liquidations, take profits, stop losses and the refusal of orders over a limit follow fixed rules with no person involved, because trades have to be handled instantly. Our systems also slow or block repeated sign-in attempts.
You can object to a decision made this way, and ask a person to review it, by writing to [email protected].
5. Who we share it with
We don't sell your personal data. We share it only with:
- providers that run the service for us, such as hosting, databases and email, under contract and only on our instructions
- Google, if you choose to sign in with Google
- WestWallet, our payment provider, which handles wallet addresses, amounts and transfer details for deposits and withdrawals
- the card service you choose, if you pay by card or bank: it receives what you give it directly, under its own policy, including your deposit address, and we pass it only the amount and network you picked
- anyone you give your profile link to, if you turn on profile sharing: your handle, picture, trades, win rate, stakes, and total deposits and withdrawals, until you stop sharing
- verification and compliance providers, when your deposits or withdrawals need them
- public blockchains: a wallet address and transfer written to one is public and permanent, and we can't erase it
- courts, regulators, law enforcement and other authorities, where the law requires it
- professional advisers, and a buyer or successor if the business changes hands, under a duty of confidentiality
Coin logos load directly from Hyperliquid's servers, which see your IP address as for any web request.
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com. We look up your country inside our own systems, and your address isn't sent to MaxMind.
6. Transfers abroad
Our providers may process data outside the United Arab Emirates. We do this where the destination has adequate protection or, where it doesn't, with a contract that requires it, or on another ground allowed by Articles 22 and 23 of Federal Decree-Law No. 45 of 2021.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | Until you delete your account or remove the item |
| Sign-in sessions | Up to 30 days. Expired sessions are deleted within the hour |
| Password reset codes | 10 minutes, and removed within a day |
| Trades, payments, and identity and compliance records | At least five years, as anti-money-laundering law requires (Cabinet Resolution No. 134 of 2025), and longer if an authority requires it |
| Affiliate applications | While the relationship lasts, and as long as needed for legal claims |
| Support conversations | Until you delete your account |
When you delete your account, we erase your email, phone number, handle, photo, password and two-factor details at once. Records we must keep stay, without those details on them.
8. How we protect it
- Encrypted connections, and strict browser security headers on every page
- Passwords and backup codes stored only as hashes, and two-factor secrets encrypted
- A database that keeps an append-only record of money, with separate restricted access for each service
- Uploaded images rebuilt from their pixels and served so they can't run
- Limits on sign-in attempts, and pauses on withdrawals after a sign-in change
No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.
9. Your rights
Under Articles 13 to 18 of Federal Decree-Law No. 45 of 2021, and subject to the limits in the law, you can:
- find out what we hold about you, why, and who received it
- receive your data in a form you can take elsewhere
- have it corrected, or erased where we no longer need or may keep it
- have its use restricted or stopped
- object to decisions made only by automated means
- withdraw consent, where we rely on it
Settings lets you download your data, change your details and delete your account. For anything else write to [email protected], and we will normally reply within 30 days. We may need to confirm it's you.
We can't erase records the law makes us keep. If you're unhappy with how we handled your data, you can complain to the UAE data protection authority or your local one.
10. Children
The service isn't for anyone under 18, and we don't knowingly collect their data. If you think we hold a child's data, tell us and we will delete it.
11. Changes
We will update this page when our practices change, and will tell you in the app or by email if a change matters.