PUBKY RING PRIVACY POLICY
Effective Date: 27 January 2026

SCOPE

This Privacy Policy (“Policy”) describes how Synonym Software Ltd. treats personal information in relation to the products, services, and features available through the Pubky Ring platform, including the Pubky Ring mobile application (collectively, the “Platform”).

POLICY SUMMARY

Click on the links below to go straight to more information on each area:

1. SCOPE
2. POLICY SUMMARY
3. NOTICE AT COLLECTION
4. TYPES OF INFORMATION WE COLLECT
5. LEGAL BASIS
6. HOW WE COLLECT YOUR INFORMATION
7. HOW WE USE YOUR INFORMATION
8. HOW WE SHARE YOUR INFORMATION
9. CHILDREN UNDER 18
10. CHOICES REGARDING YOUR INFORMATION
11. YOUR PRIVACY RIGHTS
12. SECURITY
13. STORAGE AND TRANSFER OF INFORMATION
14. LINKS
15. HOW TO CONTACT US
16. CHANGES IN POLICY

NOTICE AT COLLECTION

We collect, and in the past 12 months have collected, the following categories of information from and about you: identifiers (such as your public key, IP address, account identifiers and cryptographic keys), internet or similar network activity (such as device information, log data, and usage information) and communications (where you contact us directly). We collect these categories of information from you in order to provide our services to you, to run our business, to communicate with you, and as required by law. We may have disclosed each of these categories of personal information for a business purpose as described below. We have not “sold” or “shared” personal information in the past 12 months, as those terms are defined by the California Consumer Privacy Act (“CCPA”) or General Data Protection Regulation (“GDPR”). For a description of your rights under the CCPA or GDPR, and instructions on how to exercise your rights, please see the Your Privacy Rights section below.

We will retain each of these categories of personal information for as long as it is necessary for the purposes for which it was collected. Retention periods are determined based on: (i) duration of the user relationship; (ii) legal and regulatory requirements; (iii) security and fraud-prevention needs; and (iv) dispute resolution obligations. When data is no longer required, it is securely deleted or anonymized.

TYPES OF INFORMATION WE COLLECT

We collect information from you and about you. Here are some examples of the information we may collect:

• Identifiers. This includes your Pubky address and cryptographic keys.
• Phone Number. We will collect your phone number you provide for SMS verification purposes.
• Information You Submit. We may collect any information that you submit or provide to us if you contact us.
• Device Information. For example, we may collect information about the type of device you use to access our Platform. We may also collect your device identifier, IP address or mobile operating system. Based on your IP address, we may also collect information relating to your general location.

LEGAL BASIS

We must have a lawful basis (a valid legal reason) for using your information, and more specifically personal data. Our legal basis will be one of the following:

Consent: You have agreed to us collecting your personal data, or sensitive personal data, for example when you tick a box to indicate consent.

Keeping to our contracts and agreements with you: We need certain personal data to provide our services and cannot provide them without this personal data.

Legal obligations: At times, we have a legal responsibility to collect and store your personal data (for example, under anti-money laundering laws we must hold certain information about our customers).

Legitimate interests: We sometimes collect and use your personal data because we have a legitimate reason to use it and this is reasonable when balanced against your human rights and freedoms. Where we rely on legitimate interests, such interests include operating, securing, and improving the Platform and preventing fraud.

Substantial public interest: Where we process your personal data, or your sensitive personal data (sometimes known as special category personal data under GDPR), to adhere to government regulations or guidance, such as our obligation to prevent fraud or support you if you are, or become, a vulnerable customer.

HOW WE COLLECT YOUR INFORMATION

We collect your information in different ways. Below are some examples of how we may collect your information.

• Directly From You. For example, when you download the mobile application, create an account, or submit an inquiry to us.
• Passively. For example, when you visit and navigate our Platform on any device or scan a provided QR code. We may also collect information about users over time and across different websites and devices when you use the Platform.
• From Third Parties. We may receive information about you from other sources. For example, this may include information we receive from our SMS verification service provider during the account registration process.
• By Combining Information. We may combine information that we collect offline with information we collect through our Platform. We may also combine information we collect about you from the different devices you use to access our Platform.

HOW WE USE YOUR INFORMATION

Examples of how we may use your information include:

• To Run and Improve Our Platform and Business. We may use your information to operate our business and improve the Platform.
• To Respond to Your Requests or Questions. This may include responding to your feedback.
• For Security and Fraud Prevention Purposes. This could include protecting our company and consumers who use our products and services. It may also include protecting our Platform.
• As Otherwise Permitted By Law or As We May Notify You. This includes using your data as required to comply with applicable regulations or fraud detection.
• As Requested or Directed By You.

HOW WE SHARE YOUR INFORMATION

We may share your information in the following ways:

• Internally. We may share your information with our parent, subsidiary, and affiliate entities.
• With Our Service Providers. We may share your information with third parties who perform services on our behalf. For example, this may include companies that send emails on our behalf, help us run our Platform, or provide security and identity verification services.
• With Any Successors to All or Part of Our Business. For example, if we merge with, are acquired by, or sell part of our business to another entity. This may include an asset sale, corporate reorganization or other change of control.
• To Comply With the Law or To Protect Ourselves. For example, this could include responding to a court order or subpoena. It could also include sharing information if a government agency or investigatory body requests. We might share information when we are investigating a potential fraud.
• For Other Reasons We May Describe to You.
• As Requested or Directed By You.

CHILDREN UNDER 18

The Platform where this Policy is located is meant for adults. We do not knowingly collect personally identifiable data from persons under the age of 18, and strive to comply with the provisions of COPPA (The Children’s Online Privacy Protection Act). If you are a parent or legal guardian and think your child under 18 has provided us with information, please contact us at privacy@synonym.to. You can also write to us at the address listed at the end of this website Policy. Please mark your inquiries “COPPA Information Request.” Parents, you can learn more about how to protect children’s privacy on-line here.

CHOICES REGARDING YOUR INFORMATION

You have certain choices about how we use your information. Certain choices you make are browser and device specific.

SMS Messages:

We may send you SMS messages in order to verify your identity as part of the account creation process. Note that message and data rates may apply. The frequency of messages may vary. You may reply “HELP” if you need assistance or “STOP” to stop receiving SMS messages. If you opt out, we may send you a confirmation SMS message to acknowledge your request. We do not sell or share phone numbers to third parties for their own marketing purposes.

Cookies & Other Tracking Technologies:

• Cookies: Non-essential cookies are used only where permitted by applicable law and, where required, with your consent. You may withdraw consent at any time. For more information on how to control browser cookies, click here.
• Note that deleting or blocking cookies may impact your experience on our website, as some features may not be available. Certain options you select are browser and device specific.

Our Do Not Track Policy:

• Some browsers have “do not track” features that allow you to tell a website not to track you. These features are not all uniform. We do not currently respond to those signals. If you block cookies, certain features on our sites may not work. If you block or reject cookies, not all of the tracking described here will stop.
• Options you select are browser and device specific.

YOUR PRIVACY RIGHTS

Based on your state or country of residence, you may have the rights listed below with respect to the personal information that we maintain about you. We may take steps to verify your identity, as permitted or required under applicable law, before we process your request. Verification may include asking you to provide information about yourself that we can match against information already in our possession.

• Notice. This means that you can request that we disclose what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we have disclosed personal information, and the specific pieces of personal information we have collected about you.
• Access. This means that you have the right to access your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Deletion. This means that you can request that we delete personal information about you which we have collected from you. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Correction. This means that you can rectify inaccurate personal information that we maintain about you.
• Erasure. This means that you have the right to be forgotten.
• Object to Specific Processing. This means that you may object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Restrict Processing. This means that you may restrict processing of your personal information.
• Withdraw Consent. Where we are relying on consent to process your personal information, you may withdraw that consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• Limit the Use or Disclosure of Sensitive Personal Information. The CCPA provides a right for consumers to request that business limit the use or disclosure of their “sensitive” personal information. In our normal business operations, we do not process sensitive personal information” as that term is defined under CCPA. Please do not submit this information to us.
• Opt-Out of the Sale or Sharing of Personal Information. You may have the right to opt out of the “sale” or sharing of personal information with third parties for cross-contextual marketing purposes. We do not knowingly “sell” or “share” any personal information, including any personal information relating to consumers under the age of 16, as we understand those terms to be defined under applicable law.
• Complaint. You have a right to lodge a complaint with a relevant supervisory authority.

Agents that you have authorized to act on your behalf may also submit requests as instructed below. The agent must also provide evidence that they have your written permission to submit a request on your behalf. If we are unable to verify the authenticity of a request, we may ask you for more information or may deny the request.

Synonym or third-party providers may use machine learning models or automated decision-making technology (“ADMT”) to perform fraud detection and geoblocking, which might restrict data subjects’ access to the products, services, and features available through the Pubky Ring platform. Data subjects have the right to obtain human intervention to express their point of view and contest such ADMT.

Individuals who wish to exercise their rights as provided in this section, including submitting a request to opt-out or to access information about our use of ADMT, can contact us at privacy@synonym.to. Please include your name, public key, and email address, and indicate you are making a “Privacy Rights” request. If we deny your rights request and you would like to appeal, you may contact us again at privacy@synonym.to. In addition, you may delete your account or data associated with your account at any time by visiting the ‘Settings’ dashboard within the Pubky Ring application.

Should you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you may contact the supervisory authority of your state or country.

SECURITY

The Internet is not 100% secure. We cannot promise that your use of our Platform will be completely safe. We encourage you to use caution when using the Internet. While we use reasonable means to safeguard personal information under our control, due to the decentralized nature of the Platform, any information that you upload to the Platform may be shared in different locations and different servers. This may include servers not controlled or maintained by Synonym.

STORAGE AND TRANSFER OF INFORMATION

Due to the decentralized nature of the Platform, information we maintain may be stored or hosted in any jurisdiction, including the United States. If you live outside of the United States, you understand and agree that we may transfer your personal information to the United States. This Platform is subject to the laws of the United States, which may not provide the same level of protections as those in your own country. Personal information processed and stored in another country, including the United States, may be subject to disclosure or access requests by the governments, courts or law enforcement or regulatory agencies in that country according to its laws.

Where personal data is transferred outside the European Economic Area, such transfers are carried out on the basis of appropriate safeguards under Article 44-49 GDPR, including Standard Contractual Clauses via third-party service providers.

LINKS

Our Platform may contain links to other third-party sites or platforms that are not governed by this Policy. If you click on a link to a third-party site, you will be taken to a site we do not control. We are not responsible for the privacy practices used by third-party sites. We suggest that you read the privacy policies of those sites carefully.

HOW TO CONTACT US

If you have any questions, comments or concerns with respect to our privacy practices or this Policy, or wish to update your information, please feel free to contact us at privacy@synonym.to.

CHANGES IN POLICY

From time to time, we may change our Policy. We will notify you of any material changes to our Policy as required by law. We will also post an updated copy on our Platform. Please check our Platform periodically for updates.