This Privacy Policy explains how YouFi Ltd ("YouFi", "we", "us") collects, uses, and protects your personal data when you interact with our website at youfi.io and the YouFi closed alpha service. It applies to personal data processed under the UK General Data Protection Regulation (UK GDPR, retained in the Data Protection Act 2018) and, where you are in the EU/EEA, the EU General Data Protection Regulation (Regulation (EU) 2016/679).
The data controller for personal data collected via youfi.io is:
We are not required to appoint a Data Protection Officer at this stage of operations under Article 37 UK GDPR / EU GDPR.
?src=tiktok): one short plain word, kept with your sign-up to see which of our own channels work. It is read from the address when you sign up. It is no cookie and nothing is stored on your device for it, and it is not passed to our sign-in provider.cf-ipcountry header) — used for aggregate geographic insight, never linked to your identityThe early-access waitlist is for people aged 18 or over.
Authentication is handled by Clerk, Inc. (see Section 4). We receive your email address and a user identifier from Clerk. We do not receive or store your password.
If you accept analytics cookies, we receive event data via PostHog (US region) including page views, button clicks, session duration, and session replay recordings of your interactions with the site and app (cursor movements, clicks, scroll behaviour, page layout) so we can diagnose usability issues and bugs. Session recordings (with typed and displayed text hidden) are made only if you accept analytics cookies, to improve the product. We do not record passwords or form values. The AI chat panel appears in a recording only as a blank area. A recording keeps the layout of what you see and the address of each page, without anything after a "?" or "#". If you decline analytics, no analytics data — including session replay — is collected.
We do not collect financial information, wallet addresses, private keys, transaction data, payment information, or any data about your trading activity from the public landing page.
This applies if you join the YouFi community group on Telegram or talk to our automated assistant, YouFi bot (@YouFi_io_bot), in Telegram or in its Telegram mini app. YouFi Ltd is responsible for the personal data described here. Telegram is separately responsible for how it handles your data when you use Telegram; see Telegram's own privacy policy.
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Contact you about YouFi alpha access | Email address, source tag, link label, submission date | Consent (Art. 6(1)(a)) — given via the checkbox on the waitlist form |
| Authenticate alpha testers | Email + user identifier (via Clerk) | Performance of contract (Art. 6(1)(b)) — to provide access to the service you signed up for |
| Aggregate website analytics (only if you consent) | Pseudonymous event data, page views, browser info | Consent (Art. 6(1)(a) UK GDPR / EU GDPR) — given via the cookie banner; for cookies specifically, Reg. 6 of the Privacy and Electronic Communications Regulations 2003 (PECR) also requires consent |
| Run YouFi bot on Telegram: answer questions, welcome new members, remove posted secrets, spam and scams (Section 2.5) | Telegram user ID, username and display name; your messages to the bot; group messages (read, not stored) | Legitimate interests (Art. 6(1)(f)) — running a safe, useful community for people who chose to join it. You can object at any time by emailing [email protected]. |
| Keep a record of the bot's replies, and the bug reports, ideas and questions you send through it | The bot's replies, your reports and ideas, linked to a keyed one-way code of your Telegram ID; unanswered questions with no identifier | Legitimate interests (Art. 6(1)(f)) — handling complaints, fixing errors and improving YouFi |
| Security and abuse prevention | IP-derived country, user agent | Legitimate interests (Art. 6(1)(f)) — to detect and prevent abuse of the waitlist form |
How to withdraw consent:
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. We have assessed our legitimate interest in basic abuse-prevention logging (IP-country, user agent) and concluded that the interest does not override your fundamental rights — this assessment is available on request.
We use the following processors to operate the YouFi alpha. Each is bound by a written data processing agreement.
| Processor | Purpose | Region |
|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, DDoS protection | Global (US/EU edge) |
| Clerk, Inc. | Authentication | United States |
| Resend, Inc. | Transactional email delivery | United States |
| Notion Labs, Inc. | Internal waitlist record-keeping | United States |
| PostHog Inc. | Aggregate analytics (only with your consent) | United States |
Cloudflare also carries messages between the YouFi bot mini app in Telegram and the bot. Telegram (Telegram Messenger Inc. and its group companies) is not our processor: it is a separate controller for the messages you send through it, under its own privacy policy, and it handles data worldwide.
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
Cloudflare, Clerk, Resend, Notion, and PostHog process some personal data outside the United Kingdom and the European Economic Area (typically in the United States). These transfers rely on the following safeguards, depending on the jurisdiction of the data subject:
You can request copies of the safeguards in place for any specific transfer by contacting us at [email protected].
Analytics data via PostHog is transferred to the United States and protected by the UK–US Data Bridge / EU–US Data Privacy Framework where the recipient is certified, supplemented by the UK IDTA or EU SCCs as applicable. Analytics is only enabled if you consent via the cookie banner.
| Data | Retention period |
|---|---|
| Waitlist email | 24 months from submission, or until you unsubscribe — whichever is earlier |
| Waitlist link label | The link label is kept with the sign-up and deleted with it |
| Alpha account data (chat history, strategies, paper-trading sessions, wallet metadata) | For the duration of your account. On deletion request via Clerk, we purge all primary stores (PostgreSQL, semantic-memory vectors, on-disk strategy files, Redis cache) within 30 days and notify downstream processors (Resend, Notion) of the erasure request under Art. 17(2). |
| Inactive accounts | If you do not sign in for 24 months, we email a warning and, if you still do not return within 30 days, automatically purge your account under the storage-limitation principle (Art. 5(1)(e)). |
| Consent decisions | Stored with your account while it exists. When your account is deleted, that record (including the IP address it was given from) is deleted. What we keep is a keyed one-way code of your verified email address, recorded each time you gave or withdrew consent, with its date and no IP address, for 7 years after your account is deleted. It cannot be linked back to your account; it only lets us confirm your consent if you contact us from that email address (Art. 7(1), 17(3)(e)). |
| Deletion audit log | Pseudonymised (SHA-256 hash) hash-chained record of each erasure event, retained for 3 years for regulator verification. |
| Analytics events (if consented) | 13 months (PostHog default) |
| Security logs | 90 days |
| YouFi bot: conversation memory | In memory only; cleared after 30 minutes without a message, on restart, or on /deleteme |
| YouFi bot: record of its replies | 12 months, then deleted automatically; or at once on /deleteme |
| YouFi bot: bug reports, ideas, screenshots and questions it could not answer | 90 days, then deleted automatically; reports, ideas and screenshots also at once on /deleteme |
You have the following rights regarding your personal data:
To exercise any of these rights, email [email protected]. We will respond within one month (Art. 12(3) GDPR).
Self-serve options for alpha accounts:
/api/gdpr/access returns an inventory of every piece of personal data we hold about you./api/gdpr/rectify with {"field": "...", "new_value": "..."}. Allowed fields: email, display_name, username, country_code, timezone./api/gdpr/export returns a machine-readable JSON export of your portable data (chat history, strategies, paper-trading records, knowledge-base items, wallet metadata, consent history)./api/consent/withdraw, with no request body. It withdraws your consent to AI model training (the consent this endpoint manages) and marks all your training samples as excluded from any future model improvement. Withdrawing does not depend on re-checking your email address, so it is never refused for that reason.You have the right to lodge a complaint with a supervisory authority. Because YouFi Ltd is established in the United Kingdom, the lead supervisory authority for our processing is:
EU/EEA residents: you may also lodge a complaint with the supervisory authority of your country of residence. A list is maintained at edpb.europa.eu.
We do not carry out automated decision-making or profiling that produces legal effects or similarly significant effects concerning you within the meaning of Article 22 GDPR.
Authentication session cookies set by Clerk when you sign in. These are essential for the service to function and are exempt from consent under Reg. 6(4) of the Privacy and Electronic Communications Regulations 2003 (PECR, UK) and Article 5(3) of the ePrivacy Directive 2002/58/EC (EU).
PostHog cookies are only set if you click "Accept" in the cookie banner. With your consent, this includes session replay recordings of your interactions with the page so we can diagnose usability issues and bugs (typed and displayed text is hidden — see Section 2.3 for details). You can change your choice at any time by clicking Manage cookies in the website footer, which re-opens the banner; declining stops further analytics collection and opts you out of session replay. We may also receive your IP address briefly during analytics initialisation. PostHog is hosted in the United States — see Sections 4 and 5 for details of the safeguards that apply to that transfer.
We do not use advertising cookies, cross-site tracking, third-party advertising pixels, social-media tracking pixels, or fingerprinting.
We may update this policy as the YouFi alpha evolves. We will post the new policy here with an updated "Last updated" date and, where required by law, notify you by email.
Questions, data subject requests, or concerns about this policy: