Mojo Privacy Policy

Last Updated: September 27, 2026

1. Introduction

This Privacy Policy explains how MindOrigin Pte. Ltd. ("Mojo", "we", "us"), a company incorporated in Singapore, collects, uses, discloses, and protects personal information when you use the Mojo mobile application, website, and related services (the "Services"). It should be read with our Terms of Service.

Our role. For the personal information described below, Mojo acts as a "data controller" (GDPR), "business" (CCPA/CPRA), or "organisation" (Singapore PDPA), as applicable.

Children. The Services are not directed to, and we do not knowingly collect personal information from, individuals under 18. If you become aware that a child has provided personal information to us, contact support@mindorigin.co and we will delete it.

2. Information We Collect

You Provide

• Email, username, authentication credentials, profile preferences
• Linked social account information (e.g., handles from platforms you choose to connect)
• Subscription billing data (processed by Apple, Google Play, or our payment processor — Mojo does not store full payment card numbers)
• User Content as defined in the Terms of Service (messages, shared screenshots, comments, trade ideas, profile information)
• Support communications

Collected Automatically

• Public wallet addresses you create or connect, transaction history, token holdings, PnL, and other on-chain activity (which is public by nature)
• Encrypted server-side shards of the Multi-Party Computation ("MPC") wallet (the "Server Shards"), used to provide the non-custodial wallet service — we do not store your complete private key in plaintext or in any single location, and the Server Shards alone are mathematically insufficient to access your wallet
• Device and technical data (IP address, device model, OS, app version, language, time zone, crash logs)
• Usage data (features accessed, clicks, session duration, and derived behavioral metrics used to personalize informational outputs)
• Cookies and local storage on our website for authentication, security, and analytics

From Third Parties

• Wallet screening signals (sanctions, fraud, illicit-activity risk)
• Aggregated product analytics
• Public blockchain data
• If your Mojo account is linked to an X account (for example, you sign in with X or connect X in your account settings): your X username, display name, and public bio, and your own public posts from the last 30 days (original posts, replies, and quotes; reposts excluded), which we retrieve from X
• If you connect an exchange account such as Binance: your trade history on that exchange, collected through the API key you provide

3. How We Use Information

We use personal information for the following purposes, with the corresponding GDPR legal basis where applicable:

3.1 AI Processing

When you use Mojo's AI-assisted features, your inputs and relevant context are sent to third-party large language model providers via their API endpoints. We also use these providers in the background to generate the personalization profile described in Section 3.2. Leading API providers' default terms do not use customer API inputs or outputs to train their general models, and we do not submit your data to consumer-grade AI chat products. Please do not include passwords, seed phrases, private keys, or other sensitive material in AI chats. We may use aggregated or de-identified interaction data to improve Mojo's own prompts and evaluations. We do not use your individual interaction data to train any model that is shared with other users.

3.2 Automated Decision-Making and Profiling

Mojo's pre-signed automated transaction features (as described in the Terms of Service) execute strictly according to parameters you have configured and approved in advance. These executions are deterministic and are not "automated decision-making producing legal or similarly significant effects" under Article 22 GDPR. Any personalization of informational outputs based on your behavior is likewise informational in nature and does not constitute a personal recommendation or regulated advice.

Personalization profile. If your Mojo account is linked to an X account or an exchange account such as Binance, we automatically generate a short personalization profile about you and update it regularly. This also applies to accounts linked before this feature was introduced. For X, our own code analyzes your public posts from the last 30 days to derive statistics, such as the tokens, hashtags, and topics you mention repeatedly and when and how often you post. When generating the profile, we do not store the text of your posts or send it to AI providers; for this purpose, we keep only limited details of each post, such as its ID, when it was posted, its type, and the tokens, hashtags, and topics it mentions. For exchange accounts, our code summarizes your trade history, such as the assets you trade, how often you trade, your typical trade sizes, and when you trade. We then send these statistics, together with your X account identifiers (such as your username, display name, and account ID) and bio, other information and preferences Mojo has saved from your conversations, and any corrections you have made, to third-party large language model providers, which write the profile. The profile is stored with your account and provided to Mojo's AI in your conversations to tailor its suggestions and follow-up questions. It is not an input to the systems that move funds, apply limits, place orders, or run trade checks.

Your right to object. You may object to the personalization profile at any time by emailing support@mindorigin.co. We will then turn off your profile: we stop reading your X information and summarizing your trade history for it, stop providing it to Mojo's AI, and delete the profile together with the X bio and post details we collected for it. We keep only a small record, such as your linked account details, so that the profile stays off. Records of your earlier conversations and our service logs are not changed by this; they may still contain the profile, or the information used to create it, from that time, and such content may continue to be used as context in those conversations. Turning off the profile does not affect other information and preferences Mojo has saved from your conversations; to object to their use or to have them deleted, contact us as described in Section 6.

4. Sharing and International Transfers

We do not sell your personal information to advertisers or data brokers.

We share information only as follows, each bound by contractual confidentiality and data protection obligations:

• Infrastructure providers: including MPC wallet infrastructure partner(s), cloud hosting providers, large language model providers accessed via API (including for generating the personalization profile described in Section 3.2), analytics tools, payment processors, wallet screening providers, and email service providers (for service and marketing emails)
• Third-party venues: you choose to interact with, whose use of data is governed by their own privacy policies
• Legal and safety disclosures: in response to valid legal process, to enforce our Terms, or to protect the rights, property, or safety of Mojo, our users, or others
• Corporate transactions: merger, acquisition, reorganization, financing
• With your consent

International transfers. Mojo operates globally. Your information may be transferred to and processed in countries other than your country of residence, including Singapore, the United States, and the European Union. Where transfers are subject to GDPR or UK GDPR, we rely on appropriate safeguards which may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, adequacy decisions, or other equivalent mechanisms. You may request a copy of the applicable safeguard by contacting support@mindorigin.co.

5. Data Retention

We retain personal information only for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods:

When the retention period ends, we delete or irreversibly de-identify the data.

6. Your Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access: request a copy
• Rectification: correct inaccurate data
• Deletion: right to be forgotten, subject to the irreversibility warning in Section 5
• Restriction: pause processing in certain cases
• Portability: receive data in a structured, machine-readable format
• Objection: to processing based on legitimate interests, including behavioral personalization
• Withdraw consent: for processing based on consent, such as marketing
• Complaint: lodge a complaint with your local data protection authority

California residents (CCPA/CPRA) additionally have the right to know, delete, correct, and opt out of "sale" or "sharing" of personal information (we do not sell or share personal information for cross-context behavioral advertising), and to non-discrimination for exercising these rights.

EU/UK residents (GDPR/UK GDPR) have the rights listed above and may contact their local supervisory authority.

Singapore residents (PDPA) have the right to access and correct personal data and to withdraw consent.

How to exercise your rights. To delete your account or exercise any of the rights above, email support@mindorigin.co. Where supported in the App, account deletion is also available via Settings → Account → Delete Account. We will respond within the time limits required by applicable law (for GDPR, generally within one month, extendable by two further months for complex requests, with notice). We may need to verify your identity before acting on requests.

7. Security

We implement technical and organizational measures designed to protect personal information, including:

• Encryption in transit (TLS) and at rest
• Encryption of MPC Server Shards with key management segregated from application servers
• Role-based access controls and audit logging
• Regular security reviews
• Incident response procedures

8. Changes and Contact

We may update this Privacy Policy from time to time. Material changes will be notified through the App or by email at least seven (7) days before they take effect. The "Last Updated" date shows the most recent revision. Your continued use after the effective date constitutes acceptance.