Skip to content
Paave

Virtual money is for practice. It is not cash and cannot be withdrawn.

Legal

Privacy policy

This policy explains what personal data Paave collects, why we use it, who we share it with and the choices you have.

Who we are

Paave is operated by DIFISOFT HOLDING COMPANY PTE. LTD. ("Difisoft", "we" or "us"). Difisoft decides how and why your personal data is processed for Paave and is responsible for it.

If you have a question about this policy or your data, email us at [email protected].

What this policy covers

This policy applies to the Paave mobile app for iOS and Android, the Paave website at paave.ai (including its account pages) and PaaveClaw, including when you chat with PaaveClaw in Telegram.

Services run by others that you use with Paave, such as Telegram, Sign in with Apple and Google Sign-In, have their own privacy policies.

Data we collect

We collect data you give us, data created when you use Paave, and a limited amount of data from other services.

  • Account details: your email address, username, password, full name and, when you sign up in the app, your date of birth. You can also add a bio to your community profile.
  • Apple or Google sign-in: if you sign in with Apple or Google, the account identifier and email address that Apple or Google shares with us, and your name if Apple shares it the first time. Apple may give us a private relay address instead of your email address.
  • Security data: one-time codes sent to your email, your two-step verification settings, authenticator app and passkey details, and, for face or fingerprint sign-in in the app, a key and an identifier for your device. Your face and fingerprint data stay on your device and are never sent to us.
  • Your activity in Paave: your virtual orders, virtual portfolios and virtual results, your watchlists, the challenges you join and your Arena rankings, and your community activity such as votes, follows, mutes, blocks and the reports you file.
  • PaaveClaw conversations: the messages you send to PaaveClaw and its replies. If you link Telegram to your Paave account, we also keep your Telegram user ID with that link.
  • API keys: if you create API keys on the website (MENU > API keys), we keep a key prefix, its creation and last-use dates and a protected form of the key.
  • Linked securities accounts: if you link an account you hold with a securities company where Paave offers this, the account number and the sign-in details you enter, which are used only to set up and maintain that link.
  • Device and app data: device model, operating system and app version, language and theme settings, and the push notification token the app registers when it starts, even before you allow notifications.
  • Diagnostics: crash, error and performance reports from the app, and error reports from the website. Before these reports are sent, we remove personal data such as account details, messages and request content.
  • Usage data: in the app, Google Analytics for Firebase records events such as app opens, sessions, the screens you view and the method you used to sign in or sign up, with an identifier for the app installation. It does not receive your name, email address, user ID or account data.
  • Advertising data: in the app, Google AdMob receives device and network information (such as your IP address and, where your consent and device settings allow it, your device's advertising ID) to show and measure ads. We do not give AdMob your account, posts, portfolio or other Paave data.
  • Install attribution data: in the production app, AppsFlyer measures which campaign led to an install. Once the Google consent flow allows it, it receives the standard device and app information that the AppsFlyer SDK collects (such as the operating system and app version), your IP address, install and attribution timestamps and, where your consent and device settings allow it, your advertising ID. On iPhone, Apple also sends AppsFlyer copies of its install attribution postbacks. We turn off the device name on iPhone and the Android ID and network carrier data on Android. We do not give AppsFlyer your Paave user ID, email address, phone number, name, in-app events or location.
  • Messages to us: what you tell us when you email us or send feedback in the app.

The website does not use cookies, analytics or advertising trackers. Your browser keeps your sign-in session and your language and theme choices on your device.

How we use your data

  • To create and run your account and let you sign in, including with Apple, Google, passkeys or face or fingerprint sign-in.
  • To provide Paave: market information, virtual trading, Arena rankings and challenges, community features and PaaveClaw.
  • To keep Paave and your account secure: verifying sign-ins with codes and two-step verification, preventing abuse and fraud, and reviewing reports.
  • To send account emails such as verification codes and account deletion confirmations, push notifications if you allow them, and PaaveClaw messages and briefings you choose to receive in Telegram.
  • To find and fix errors and improve speed and reliability.
  • To understand how the app is used overall, so we can improve it.
  • To show ads in the app.
  • To meet legal obligations and respond to lawful requests.

We do not sell your personal data, and we do not give advertisers your account details.

Ads and analytics in the app

The app shows native ads from Google AdMob in some feeds and lists. They are labelled "Sponsored".

Where the law requires consent, Google's consent message asks for your choices before ads load, and ads are personalised only if you agree. On iPhone, we ask for tracking permission only if your choices allow it, and ads are personalised only if you allow tracking. On Android in other regions, Google may personalise ads using your device's advertising ID; you can delete or reset it in your device settings.

Google uses ad data as described in Google's own privacy policy.

In the production app, AppsFlyer install attribution starts only when the Google consent message allows it (where the law requires consent, only if you agree to storing information on your device). On iPhone, your advertising ID is used only if you allow tracking. If you withdraw your ad consent, the AppsFlyer SDK stops collecting; Apple postback copies already scheduled may still reach AppsFlyer.

Google Analytics for Firebase records how the app is used without your name, email address or user ID. Its advertising features are turned off, and the data is kept for 14 months.

The website shows no ads and uses no analytics.

Who we share data with

We share personal data only as described here. Our service providers process it to provide their services to us:

  • Amazon Web Services: hosting and databases in Singapore and email delivery (Amazon SES).
  • AI providers: to write PaaveClaw replies and content from Paave-operated AI accounts. We use only providers that do not keep your messages after answering and do not use them to train their models.
  • Google: Firebase (app analytics, performance monitoring and remote app settings), AdMob (ads and the ad consent message), Google Sign-In, and Firebase Cloud Messaging for push delivery.
  • Apple: Sign in with Apple and the Apple Push Notification service.
  • OneSignal: push notifications. OneSignal receives your push token and an internal Paave user ID, never your email address, phone number or location.
  • Sentry: crash, error and performance monitoring, after personal data is removed as described above.
  • AppsFlyer: install attribution in the production app, once the Google consent flow allows it, without your Paave user ID, email address, phone number, name, in-app events or location.

We also share data:

  • with Telegram, when you chat with PaaveClaw there. Telegram handles those messages under its own privacy policy.
  • with a securities company, when you choose to link an account you hold with it.
  • with other members, as described in "What other members can see".
  • with authorities, courts or other parties when the law requires it, or to protect the rights, safety and security of our users, Difisoft or others.
  • with a buyer or successor if Difisoft is involved in a merger, acquisition or sale of assets, under the protections of this policy.

What other members can see

Arena is a community. The username, name and bio on your profile are shown to other members. Other members can view your virtual portfolio and virtual performance unless one of you blocks the other. Arena rankings show your username and virtual results once you qualify.

When member posting opens, your posts and comments will be visible to other members, and trade cards in journal posts are shared only when you attach them.

Members you mute are not told that you muted them.

PaaveClaw and AI content

When you chat with PaaveClaw, your messages are sent to a third-party AI provider to write a reply, together with the Paave market data and news needed to answer. When you ask about your virtual account or a virtual order, your virtual account data is used as well.

PaaveClaw answers, briefings and content from Paave-operated AI accounts are generated by AI and can be wrong. Posts from Paave-operated AI accounts are labelled as AI-generated. None of this is investment advice.

International transfers

Paave's servers are in Singapore. Some service providers process data in other countries, including the United States — for example AI processing, error monitoring by Sentry, and Google and OneSignal services. Transfers of personal data abroad are made in line with applicable law.

How long we keep data

We keep your account data while your account is open.

When you delete your account, we delete or anonymise your personal data. Your profile (including your date of birth), sign-in methods, two-step verification factors, passkeys, API keys and Apple or Google sign-in links are removed, and your Sign in with Apple authorisation is revoked. Deletion may not happen at once in every system.

After deletion, we may keep limited records where needed for security, to prevent abuse, to resolve disputes or to meet legal obligations — for example, a record of security changes that holds no passwords or keys.

Verification codes and confirmation links expire after a short time. App analytics data is kept for 14 months.

Deleting your Paave account does not close any account you hold with a securities company.

How we protect your data

We protect your data with measures that include:

  • encrypted connections (HTTPS) between your device and Paave;
  • passwords and recovery codes stored only in protected, hashed form;
  • encryption of authenticator app secrets and Apple sign-in tokens;
  • optional two-step verification with an email code, an authenticator app or a passkey, and face or fingerprint sign-in in the app;
  • removing personal data from crash and error reports before they are sent.

No system is completely secure. Keep your password and devices safe, and contact us if you think your account has been compromised.

Your choices and rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to get a copy of it, to object to or restrict some processing, and to withdraw consent.

  • Access and correct: view and update your name, username, email address and password in the app, or in Profile settings on the website.
  • Delete your account: delete your account yourself in the app under Settings > App settings > Delete account. We email you a link to confirm the deletion.
  • Deactivate your account: in the app under Settings > App settings > Deactivate account, you can lock your account for a while without deleting your data. Contact us to reactivate it.
  • Ads: change your ad consent choices in the app under Settings > App settings > Ad privacy choices (where it applies; withdrawing ad consent also stops AppsFlyer SDK collection), change tracking permission in your iPhone settings (it controls whether your advertising ID is used for ads and install attribution), or reset your advertising ID in your device settings.
  • Notifications: turn push notifications off in your device settings at any time.
  • Telegram: send /logout to PaaveClaw in Telegram to unlink Telegram from your Paave account, and /briefings off to stop briefings.
  • Other requests: email [email protected]. We may need to verify your identity, and we will respond within the time required by applicable law.

You can also complain to the data protection authority where you live.

Children

Paave is not directed to children under 16, and we do not knowingly collect personal data from them. You must be at least 16 to create a Paave account, and we ask for your date of birth when you sign up in the app to check this.

If you believe a child has given us personal data without the required consent, contact us and we will take steps to delete it.

Changes to this policy

We may update this policy as Paave changes or as the law requires. We will post the new version on this page with a new effective date and, if the changes are significant, let you know in the app or by email.

Contact us

Paave is operated by DIFISOFT HOLDING COMPANY PTE. LTD. For questions, requests or complaints about privacy, email [email protected].