This Privacy Policy explains how BFM Company Limited ("Company," "we," "us," or "our") collects, uses, discloses, retains, and protects personal data in connection with Bitcoinist (the "App"), bitcoinist.app (the "Website"), and related support, legal, marketing, security, analytics, payment, mining-operation, and settlement-support functions.
This Privacy Policy is available at https://bitcoinist.app/privacy and should be read together with our Terms & Conditions, available at https://bitcoinist.app/terms, and other legal notices available through https://bitcoinist.app/legal. If this Privacy Policy and the Terms conflict, this Privacy Policy controls for detailed personal-data processing disclosures, while the Terms control the commercial and contractual nature of the App relationship.
1. Controller and Contact
BFM Company Limited is a company registered at RAKDAO, Ras Al Khaimah, United Arab Emirates (Registration No. 01010714; Business licence No. 07010714). Where applicable data protection law uses the concepts of controller, business, organization, or similar terms, BFM Company Limited is the entity responsible for the personal data described in this Privacy Policy unless another party is expressly identified as responsible for a particular processing activity.
Privacy contact: privacy@bitcoinist.app
Legal notices: legal@bitcoinist.app
Support: support@bitcoinist.app
Where applicable law requires a local representative, data protection contact, or similar function for a specific jurisdiction, we may provide those details through the App, Website, App Store listing, or direct notice.
2. Scope
This Privacy Policy applies when you use or interact with the App, Website, public legal pages, support channels, waitlists, launch forms, referral-code forms, promo-code forms, email signup forms, beta-access forms, in-App features, subscriptions, rewarded ads, analytics, mining-operation features, pool-related features, payout-address features, and related communications.
This Privacy Policy does not apply to third-party websites, wallets, exchanges, public mining pools, Apple services, App Store services, third-party ad networks, public blockchains, or other third-party services that operate under their own terms and privacy policies.
3. Personal Data We Collect
We may collect the categories of personal data below, depending on your country, device settings, consent choices, App version, account status, and enabled features.
3.1 Account and identifier data. This may include Apple Sign in identifiers, private relay email addresses, email address, App user ID, account ID, device-linked identifiers, referral or promo-code identifiers, VIP or entitlement identifiers, and support identifiers.
3.2 Device, technical, and usage data. This may include device model, device name where available and permitted, operating system, App version, bundle ID, language, country, time zone, carrier or network data, IP address, approximate location derived from IP address or device/network signals, user agent, timestamps, sessions, app opens, screen views, clicks, impressions, feature interactions, Remote Config assignments, A/B test groups, crash logs, non-fatal errors, stack traces, custom logs, and diagnostic events.
3.3 Purchase, subscription, and entitlement data. This may include Apple receipt data, StoreKit data, RevenueCat or similar subscription-management data, product IDs, purchase events, renewal status, cancellation status, refund events, chargeback signals, entitlement status, paywall views, subscription tier, subscription period, VIP status, Diamonds status, rental access, promo-code benefits, and related server records. We do not directly collect or store your payment card details for Apple In-App Purchases.
3.4 Mining-operation, pool, telemetry, and settlement-support data. This may include rented hashrate records, miner identifiers, virtual miner assignments, rental periods, pool selections, Private Pool identifiers, Public Pool contribution records, Stratum records, accepted Share records, telemetry records, payout-address events, threshold status, settlement status, transaction IDs, blockchain addresses, block-related records, estimated sats/BTC attribution, corrections, reversals, and system logs needed to operate, reconcile, verify, secure, and support the App.
3.5 Wallet and blockchain-related data. If you save a Bitcoin output address, we process that address and related validation, review, risk, settlement, and support records. Bitcoin addresses, transactions, transaction IDs, block data, and other blockchain data may be public and may remain public permanently. We do not control public blockchain data and cannot delete or alter public blockchain records.
3.6 Support and communication data. This may include email address, message contents, screenshots, attachments, account identifiers, device details, App version, timestamps, support history, dispute evidence, and any other information you voluntarily provide. You must not send seed phrases, private keys, wallet backup files, exchange passwords, signing credentials, identity documents, health data, biometric data, or other sensitive data unless we specifically request it and it is legally and operationally necessary.
3.7 Marketing, waitlist, referral, and promotion data. This may include email address, signup source, campaign source, referral source, deep-link data, referral-code use, promo-code use, ad campaign metadata, consent status, unsubscribe status, suppression-list entries, and engagement data for emails, landing pages, waitlists, beta-access forms, launch forms, or similar forms.
3.8 Advertising and rewarded-ad data. Where enabled, we and our advertising or mediation partners may process ad requests, ad impressions, rewarded ad views, ad revenue, device or advertising identifiers where permitted, fraud signals, frequency and eligibility data, reward-validation events, and related operational records. Rewarded ads may depend on third-party ad networks and platform permissions.
3.9 Compliance, fraud, security, and abuse-prevention data. This may include IP address, storefront, country, location signals, device signals, account signals, Apple records, purchase records, blockchain address risk signals, sanctions-screening signals, fraud signals, abuse indicators, referral-abuse indicators, promo-code-abuse indicators, device-farm or account-farm indicators, VPN or proxy indicators, automated-risk decisions, investigation records, and legal-request records.
4. Data We Do Not Intend to Collect
We do not intend to collect seed phrases, private keys, wallet backup files, exchange passwords, precise GPS location unless a feature expressly requires it, government identity documents unless legally required, special-category personal data under GDPR/UK GDPR, or sensitive personal information under similar laws beyond what is strictly necessary for App operation, security, compliance, or support. If you provide unnecessary sensitive data, we may delete it, restrict it, or retain limited records where required for security, legal, dispute, or compliance reasons.
5. Sources of Personal Data
We collect personal data from you, your device, Apple, App Store and StoreKit systems, subscription-management providers, analytics providers, attribution providers, ad networks, support tools, fraud-prevention tools, public blockchain data, public pool or Private Pool records, hashrate suppliers, infrastructure providers, and other vendors or systems needed to operate, secure, measure, support, and improve the App.
6. How We Use Personal Data
We use personal data where permitted by applicable law for the following purposes:
6.1 Service operation. To provide, maintain, monitor, and support the App, Website, accounts, subscriptions, rentals, Diamonds, promo-code benefits, referral features, rewarded ads, Private Pool features, Public Pool features, telemetry, mining-operation records, settlement-support features, and customer support.
6.2 Purchase and entitlement administration. To validate purchases, manage subscriptions, restore purchases where available, apply entitlements, manage VIP status, process refund or chargeback consequences, detect purchase abuse, and maintain authoritative account records.
6.3 Mining-operation and settlement support. To operate pool-related features, measure Mining Work, validate telemetry, calculate App records, reconcile records, support payout-address functionality, prepare settlement-support records, handle missing address events, review address risk, detect errors, correct displays, and maintain authoritative operational records.
6.4 Security, fraud, abuse, and compliance. To protect the App, Company, users, founders, directors, officers, personnel, contractors, suppliers, service providers, infrastructure, pools, payment systems, and legal rights; detect and prevent fraud, bots, device farms, account farms, referral abuse, promo-code abuse, ad abuse, settlement abuse, sanctions risk, unauthorized access, malware, scraping, and other misuse; enforce the Terms; respond to legal requests; and comply with law.
6.5 Analytics and improvement. To understand App performance, crashes, errors, funnels, retention, ad performance, campaign attribution, subscription behavior, feature usage, and product reliability; test features; improve user experience; and develop new or modified features.
6.6 Communications. To respond to support requests, send service notices, send account notices, send purchase or subscription communications, send security and legal notices, send operational updates, and send marketing communications where permitted by law or with consent where required.
6.7 Legal and business purposes. To keep business records, perform audits, prepare legal claims or defenses, complete corporate transactions, obtain advice from lawyers or other professional advisers, manage insurance, report to authorities where required or permitted, and protect the Company and Covered Parties identified in the Terms.
7. Lawful Bases Where GDPR, UK GDPR, UAE PDPL, or Similar Laws Apply
Where a lawful basis is required, we rely on one or more of the following, depending on the context:
7.1 Contract. Processing needed to provide the App, Website, account features, subscriptions, purchases, rentals, support, pool-related functionality, telemetry, and settlement-support functionality requested by you.
7.2 Legitimate interests. Processing needed to operate, secure, improve, measure, support, and protect the App, Website, users, Company, personnel, founders, business, legal rights, and infrastructure, provided those interests are not overridden by rights requiring a different result under applicable law.
7.3 Consent. Processing based on your consent, including where required for marketing emails, non-essential cookies, certain analytics, App Tracking Transparency, push notifications, or similar permissions. You may withdraw consent where applicable, but withdrawal does not affect processing already carried out lawfully before withdrawal.
7.4 Legal obligation. Processing needed to comply with laws, tax/accounting rules, App Store rules where legally relevant, sanctions controls, lawful requests, regulator requests, court orders, law-enforcement requests, and other binding obligations.
7.5 Vital interests or public interest. Processing where strictly necessary to protect someone's vital interests or where a recognized public-interest basis applies under applicable law.
8. Disclosures of Personal Data
We may disclose personal data to the following categories of recipients where permitted by law:
8.1 Service providers and processors. Cloud hosting, infrastructure, analytics, crash reporting, attribution, subscription management, support tools, email providers, fraud-prevention providers, sanctions-screening providers, security providers, ad mediation providers, ad networks, monitoring providers, hashrate suppliers, pool-related providers, and other vendors that help operate, secure, measure, support, and improve the App.
8.2 Apple and App Store systems. Apple may process purchases, subscriptions, receipts, refunds, Apple ID, private relay email, device permissions, App Store review information, App Tracking Transparency choices, and related App Store data under Apple's own terms and privacy policies.
8.3 Public pool, Private Pool, blockchain, and infrastructure providers. Where needed for pool-related functionality, telemetry, routing, accounting, settlement-support, or diagnostics, relevant data may be processed by or shared with pool operators, infrastructure providers, monitoring systems, and related service providers. Blockchain addresses and transactions may be publicly visible on the Bitcoin network.
8.4 Professional advisers and business parties. Lawyers, auditors, accountants, insurers, consultants, banks, corporate transaction parties, financing parties, acquirers, successors, and assignees where needed for advice, compliance, corporate transactions, restructuring, financing, merger, acquisition, sale of assets, business continuity, or legal protection.
8.5 Authorities and legal recipients. Courts, regulators, law enforcement, tax authorities, sanctions authorities, consumer authorities, payment-related investigators, and other competent authorities where required or permitted by law, legal process, dispute handling, security, fraud prevention, abuse investigation, or protection of rights.
8.6 Affiliates and personnel. Company affiliates, founders, directors, officers, employees, contractors, and authorized personnel who need access for the purposes described in this Privacy Policy and who are subject to confidentiality, access-control, or equivalent obligations.
9. Third-Party SDKs, Ad Networks, and Tracking Technologies
The App may include Company-operated tools and third-party SDKs, APIs, pixels, server-to-server integrations, attribution links, deep links, ad mediation tools, analytics tools, crash reporting tools, subscription tools, remote configuration tools, fraud-prevention tools, sanctions-screening tools, and similar technologies.
These may include vendors such as RevenueCat, AppsFlyer, Firebase/Google, Branch, AppLovin MAX and its mediated ad networks, Apple frameworks, advertising networks, analytics providers, fraud-prevention providers, support providers, and other service providers we add, remove, replace, or reconfigure over time.
Depending on your device settings, consent choices, country, App version, and enabled features, these tools may collect or receive account identifiers, App user IDs, Apple identifiers, advertising identifiers where permitted, IDFV, IP address, approximate location, device information, app events, purchase events, subscription events, receipt data, campaign data, referral source, deep-link data, ad events, ad revenue, fraud signals, crash logs, diagnostics, and operational data.
10. App Tracking Transparency, Advertising, Sale, and Sharing
Where Apple or applicable law requires consent, including App Tracking Transparency permission for tracking across apps or websites, we will request or rely on the required permission mechanism. If you decline ATT or similar consent, some tracking, personalization, attribution, ad revenue, rewarded ad availability, campaign measurement, deep-linking, or analytics features may be limited, unavailable, less accurate, or replaced by aggregated or privacy-preserving measurement.
We do not sell personal data for money. However, some US privacy laws define "sale," "sharing," or "targeted advertising" broadly. Where required by applicable law, you may opt out of sale, sharing, targeted advertising, or similar processing by using available in-App controls, device controls, consent prompts, website controls, or by contacting privacy@bitcoinist.app. We will not discriminate against you for exercising privacy rights, but some features may be unavailable or less functional where data is needed to provide them.
12. Push Notifications
If you enable push notifications, we may process Apple Push Notification service device tokens, notification preferences, delivery metadata, and related operational records. You can disable notifications through iOS settings. Disabling notifications stops future device delivery, but we may retain limited records needed for security, suppression, legal, or operational purposes.
13. Email and Marketing Communications
If you submit your email address in the App, on the Website, through a waitlist, beta-access form, referral-code form, promo-code form, launch signup, landing page, or similar form, we may send App-related emails, launch access messages, waitlist updates, referral-code messages, promo-code messages, product updates, educational content, offers, marketing, announcements, reminders, and related Bitcoinist communications where permitted by law or with consent where required.
You may opt out of marketing emails using unsubscribe links where provided or by contacting privacy@bitcoinist.app. Opting out of marketing does not stop service, security, legal, account, purchase, subscription, transactional, compliance, or operational notices.
14. International Transfers
We are based in the United Arab Emirates and use service providers that may process personal data in multiple countries, including the United States, United Kingdom, European Economic Area, United Arab Emirates, and other jurisdictions where our providers operate. Data protection laws in those countries may differ from those in your country.
Where required by applicable law, we use appropriate safeguards for international transfers, which may include adequacy decisions, standard contractual clauses, UK international data transfer mechanisms, UAE-compliant transfer mechanisms, contractual protections, vendor due diligence, security measures, and transfer-risk assessments where required.
15. Data Retention
We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods vary by data type and purpose.
Account, entitlement, purchase, subscription, Apple receipt, support, telemetry, settlement-support, blockchain-address, transaction-ID, fraud, security, sanctions, dispute, tax/accounting, and legal records may be retained where needed for App operation, authoritative records, dispute handling, chargebacks, refunds, compliance, fraud prevention, sanctions controls, security, legal claims, accounting, audit, technical integrity, and business continuity.
When data is no longer needed, we may delete it, anonymize it, aggregate it, restrict it, or securely store it until deletion is feasible. Public blockchain data cannot be deleted by us.
16. Account Deletion and Privacy Requests
If you delete your account through the App, certain account-linked data may be deleted, anonymized, or made inaccessible. Some records may be retained where required or permitted for legal compliance, tax/accounting, fraud prevention, sanctions controls, security, disputes, chargebacks, operational integrity, backup integrity, or defense of legal claims.
Account deletion does not necessarily delete public blockchain data, Apple records, App Store records, emails already sent or received, data held by third parties under their own policies, or records we are required or permitted to retain. Deletion may also prevent restoration of App history, miner history, pool history, rental history, Diamonds, VIP status, promo-code benefits, sats attribution, BTC attribution, telemetry associations, and other account-linked records as described in the Terms.
17. Security
We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, and disclosure. These measures may include access controls, least-privilege access, encryption in transit where appropriate, logging, monitoring, secure development practices, vendor review, incident response, and internal controls.
No system, network, wallet, blockchain, pool, App Store process, cloud provider, or internet transmission is completely secure. To the maximum extent permitted by law, we are not responsible for third-party systems, public blockchain exposure, wallet compromise, user device compromise, phishing, malware, address-substitution attacks, lost credentials, or security failures outside our reasonable control.
18. Your Privacy Rights
Depending on your jurisdiction, you may have rights to request access, confirmation, correction, deletion, erasure, restriction, objection, portability, withdrawal of consent, opt out of marketing, opt out of sale/sharing/targeted advertising, limit use of sensitive personal information, or appeal a decision.
You may exercise rights by contacting privacy@bitcoinist.app. We may require information reasonably necessary to verify your identity, confirm account control, understand your request, protect other users, prevent fraud, and comply with law. We may refuse, limit, or delay requests where permitted by law, including where a request is unverifiable, excessive, repetitive, abusive, legally privileged, conflicts with another person's rights, would compromise security, would reveal trade secrets or anti-abuse methods, or would interfere with legal, compliance, dispute, fraud-prevention, sanctions, tax/accounting, or operational obligations.
If you are in the EEA, UK, or another jurisdiction with a supervisory authority, you may have the right to lodge a complaint with your local data protection authority. We encourage you to contact us first so we can try to resolve the issue.
19. Regional Privacy Notices
19.1 EEA and UK. If GDPR or UK GDPR applies, you may have rights described in Section 18, and we process personal data using the lawful bases described in Section 7. International transfers are handled as described in Section 14.
19.2 United Arab Emirates. If UAE data protection law applies, we process personal data for lawful, specific, and clear purposes; use appropriate security measures; respect applicable rights; and apply transfer safeguards where required.
19.3 United States. If US state privacy laws apply, you may have rights to know or access personal information, request deletion, request correction, opt out of sale/sharing/targeted advertising, limit use of sensitive personal information, portability, non-discrimination, and appeal, subject to legal thresholds and exceptions. We do not sell personal data for money.
19.4 Other jurisdictions. If another privacy law applies, we will handle legally required requests and notices according to that law, subject to applicable exceptions and verification requirements.
20. Children
The App and Website are not intended for children under the age at which parental consent is required under applicable law. We do not knowingly collect personal data from children without required consent. If you believe a child has provided personal data, contact privacy@bitcoinist.app and we will take appropriate steps consistent with applicable law.
21. Third-Party Services
The App and Website may link to or integrate with third-party services, including Apple, App Store, wallets, public pools, analytics providers, attribution providers, ad networks, support tools, infrastructure providers, and blockchain explorers. Third parties may process data under their own privacy policies. We do not control and are not responsible for third-party privacy practices except where non-waivable law provides otherwise.
22. Automated Tools and AI-Assisted Support
We may use automated systems and AI tools to classify, summarize, route, detect abuse in, or draft responses to support, security, compliance, analytics, and operational communications. These tools may process support content, account identifiers, device data, telemetry, risk signals, and related records. AI or automated output does not override the Terms, this Privacy Policy, authoritative App records, pool records, settlement-support records, or applicable law.
23. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The updated version will be indicated by the Last updated date. Material changes may be notified through the App, Website, email, App Store update notes, or other reasonable means where practical or required. Continued use of the App or Website after an updated Privacy Policy becomes effective means the updated Privacy Policy applies from its effective date, subject to mandatory law.
24. Contact
For privacy questions, requests, or complaints, contact:
BFM Company Limited
RAKDAO, Ras Al Khaimah, United Arab Emirates
privacy@bitcoinist.app
For support: support@bitcoinist.app
For legal notices: legal@bitcoinist.app