Version effective date: March 24,2026 Version number: 1.0

Introduction

We welcome you to choose and utilize our digital currency market data services, blockchain project information aggregation and analysis solutions, and other related products and services provided by Wufang (Hong Kong) Financial Technology Limited (registered address: Hong Kong Special Administrative Region, hereinafter referred to as 'We', 'Wufang', 'WooFun', or 'the Company').

We fully recognize the importance of personal information to you and consistently prioritize the protection of your data security and privacy rights. To this end, we strictly comply with and fully implement the Personal Data (Privacy) Ordinance (PDPO) of the Hong Kong Special Administrative Region, along with all applicable laws, regulations, and industry standards. This document serves as both our Privacy Policy Statement (PPS) and a comprehensive Personal Data Collection Statement (PICS). Its primary purpose is to clearly, comprehensively, and transparently explain how we collect, use, store, protect, share, and ultimately process your personal information during service usage, while explicitly informing you of your legally entitled rights.

This Privacy Policy applies to all service terminals and access channels under WooFun, including but not limited to the official website (Web version), iOS and Android mobile client applications, various H5 pages, and any other interactive interfaces that may be developed in the future. Whether you are a registered user or an unregistered visitor, this policy remains applicable when the system automatically collects necessary technical information to ensure service operation and security. Before registering an account, logging in, or using any services, we strongly recommend that you carefully read and fully understand all terms of this policy. Your registration, login, or continued use of our services shall be deemed as your complete understanding, voluntary acceptance of all policy provisions, and consent to our processing of personal information in accordance with the methods specified herein.

If you have any questions after reading this policy, require further clarification, or wish to exercise your statutory rights, please contact us through the official contact information provided in Chapter 8 'Contact Us' of this policy. Our professional team will be happy to assist you.

Data controller statement: Wufang (Hong Kong) Financial Technology Limited, as the statutory data controller, independently determines the specific purposes, processing methods, and relevant security measures for handling your personal information.

Chapter 1 Definition, Collection and Use of Personal Information

Personal Information Definition

Within the framework of this policy, "personal information" refers to any data or information set that can be used alone or in combination with other data to directly or indirectly identify or locate the identity or activities of specific individuals. This broadly includes but is not limited to direct identifiers such as names, email addresses, and phone numbers, as well as indirect identifiers or behavioral data including device identifiers, network protocol (IP) addresses (even if only approximate geographic ranges can be inferred), website browsing history, clickstream data, and in-app operational behaviors. It should be particularly noted that, based on current service models, this platform neither designs nor processes legally defined "sensitive" personal information such as racial or ethnic origins, religious beliefs, health conditions, precise real-time geographic coordinates (GPS), or biometric features (e.g., fingerprints and facial recognition).

Throughout the entire lifecycle of personal information processing, we strictly adhere to the core principles of "legality, propriety, necessity, and minimization." This means collecting only the personal information necessary to achieve specific, explicit, and lawful service objectives, and promptly deleting or anonymizing the data within the shortest timeframe permitted by laws and regulations after the objectives are achieved.

Collect scenarios and detailed information

Account registration and login process

Basic account registration: When you create an account using an email address or phone number, we collect the information you provide. This data is primarily used for identity verification and account activation, providing secure login credentials and forming the basis for establishing and managing your contractual relationship with WooFun services.

Third-party Quick Login Service: To enhance your login convenience, we have integrated third-party authorized login services including Google Sign-In and Apple Sign-In. When selecting these login methods, you must authorize third-party providers to share their platform's unique user identifier (UID), public nickname, and profile picture with us (Google may additionally provide name and email address according to platform policies, while Apple allows you to hide your real email). We only collect and store the minimum necessary data provided by third parties within your authorized scope, primarily to securely link your WooFun account with their accounts and streamline the login process.

Personal profile enhancement: You can customize your account profile, such as uploading a custom profile picture. This operation requires access to the device's camera or photo album, but this permission is only requested and used when you actively trigger the profile picture upload feature. We do not access the photo album or camera in the background when you do not perform the relevant operation.

Core service functions provided

Customized Market Selection with Multi-Device Sync: To ensure a consistent user experience across devices, we record and store the digital currencies you add to your "Custom Selection" list. This information automatically syncs your selection across web browsers, mobile apps, and other devices after account login.

Synced Followings, Subscriptions, and Favorites: Similarly, your operation records for specific blockchain projects, institutions, industry professionals, content creators, or articles—including 'Follow,'  'Subscribe,' and 'Favorites' —will be securely stored. This feature enables cross-device list synchronization to ensure important information remains accessible regardless of device switching.

Search Function Optimization and Content Recommendation: When using the platform's search feature, the system records your input keywords and click behavior on search result pages. After collection, the data undergoes rigorous anonymization (removing or masking all personally identifiable information through irreversible techniques) or aggregation processing (generating aggregate reports that cannot be traced to individual users). The processed data is used to analyze trending patterns, optimize search ranking algorithms, and provide you with more relevant and valuable personalized content recommendations. It will never be used to identify or track specific individual users.

Mobile app permissions description

Notification Push Permissions (Integrated with OneSignal SDK): To promptly deliver critical market price alerts, updates on launched blockchain projects, and other service-related messages, our mobile application requires your authorization for notification permissions. During this process, service provider OneSignal (acting as our data processor) may collect device identifiers, interaction data with push notifications, and network connection status to precisely manage and optimize push services. OneSignal strictly processes these data in compliance with our instructions and contractual agreements. For details on its privacy practices, please refer to their official privacy policy at https://onesignal.com/privacy_policy.

Camera/Album access: As mentioned earlier, this permission is only for specific functions initiated by you, such as profile photo upload or QR code scanning. We promise not to use it for any other purposes without your consent.

We hereby make a solemn declaration that under the current service framework, we will neither proactively nor needlessly collect your precise geographical location information (such as GPS coordinates), device contact lists, private keys for encrypted asset payments, digital wallet addresses, biometric data, or any other personal information unrelated to the core functionalities of our services. Should future business development require the introduction of new features involving direct cryptocurrency transactions, staking mechanisms, or other functionalities that may necessitate additional personal data collection, we will provide explicit notice through separate updates to this Privacy Policy prior to feature implementation. Collection and use of such additional information will only commence upon obtaining your explicit consent.

Automatically collected technical information categories

Server log information: To ensure platform security and stable operation, defend against cyber attacks and fraudulent activities, and provide content display tailored to regional preferences (such as default language settings), our servers automatically record and store essential log data upon your access. This includes your IP address (primarily for security and localization purposes), browser type and version, exact access time, page viewing duration, and telecommunications provider information of your internet connection.

Device Identification Information: To enhance anti-fraud mechanisms and account security, we may collect unique device identifiers such as Apple's Advertising Identifier (IDFA), International Mobile Equipment Identity (IMEI), or Android's Android ID for your device. These identifiers are solely used for device identification to mitigate risks, are not permanently linked to your personal identity, and are not utilized for cross-application tracking.

Legal Basis Statement (Based on Hong Kong's Personal Data (Privacy) Ordinance (PDPO)): Our processing of your personal information is strictly governed by applicable laws. Specifically, the collection and processing of personal data for account creation, registration login services, and core market information services are essential to fulfilling service contracts with you. The collection of automated technical data such as server log information and device identifiers primarily serves to maintain service network security, prevent fraud, and comply with our statutory security obligations to users. To enhance service experience and strengthen security measures, we process personal information related to your legitimate interests only after clearly explaining collection purposes and obtaining your consent or in accordance with applicable laws. Additionally, we will conduct data processing in compliance with other legal requirements.

Chapter 2 Cookies and Similar Technologies

In terms of technical implementation, we employ technologies such as cookies and localStorage to enhance the interactive experience and functionality of websites and applications.

type	purpose	instance	Manageable mode
Required Cookies	Maintain login status and save preferences	Language, pricing currency, layout preferences	Cannot be disabled completely, as it may affect service usage
Analysis/Function Cookies	Service Optimization, Traffic Analysis	Access time and click behavior	Manage through browser settings or in the App: Settings> Privacy

Please note that we do not use cookies for cross-site targeted advertising tracking. You can adjust your browser settings to block non-essential cookies or manage permissions through mobile device system settings according to your preferences.

Chapter 3 Data Storage and Protection

Regarding data storage and protection, the specific arrangements are as follows: Data is primarily stored within the Hong Kong Special Administrative Region of China. In certain cases, to ensure stable services, data may also be stored on third-party cloud service nodes compliant with stringent data protection regulations (all meeting Hong Kong PDPO standards). For cross-border transmission of personal information, we will adopt the 2022 Model Contract Clauses recommended by the Hong Kong Privacy Commissioner's Office (PCPD), and employ a combination of encryption technologies and organizational management measures to ensure that the protection level of personal information meets or exceeds the standards stipulated by Hong Kong legislation.

Regarding the retention period of data, we adhere to the principle of least necessity, retaining data only for the shortest duration required to achieve specific collection objectives:

Account basic information and transaction records: These are retained during your service period and continue to be stored for 6 months after account cancellation to comply with legal log retention requirements.

Your custom lists, follow/subscribe/favorite lists, and search history data will be retained during the service's lifetime until you delete them or we anonymize them.

System logs and device information: Retained for up to 6 months or a shorter period as required by law.

When the specified retention period expires, we will permanently dispose of the data using irreversible anonymization techniques or secure erasure methods (including physical destruction of storage media). We have implemented reasonable measures to ensure data accuracy and encourage you to maintain and update your account information promptly.

In terms of safety measures, we implement multi-level protection:

Secure transmission: All personal information transfers require encryption protocols such as HTTPS/TLS.

Access control: Strictly adhere to the principle of least privilege, allowing only employees in essential roles with multi-factor authentication to access relevant data.

Additional safeguards: We conduct regular security audits, organize employee data protection training, perform data protection impact assessments, and have established comprehensive emergency response plans for security incidents.

Data Breach Response: Upon occurrence of a data breach incident, we will promptly conduct risk assessments in accordance with the "Data Breach Handling and Notification Guidelines" (2023 Revised Edition) issued by the Personal Data Protection Commission (PCPD). If risks of actual harm (such as identity theft or financial losses) are identified, we will immediately notify affected users and the Hong Kong Office of the Privacy Commissioner for Personal Data, and implement appropriate remedial measures.

Chapter 4 Third-Party Sharing

Regarding third-party sharing, we solemnly commit to never selling or leasing your personal information. Limited sharing with the following types of third parties will only occur when strictly necessary and under the signing of rigorous data processing agreements (ensuring protection standards no less stringent than those outlined in this policy):

Infrastructure service providers: For instance, they share device identifiers, push interaction data, and network status to deliver push services (e.g., OneSignal); exchange essential information to enable sharing features (e.g., Sharethis); and provide third-party login services (e.g., Google Sign-In/Apple Sign-In) by sharing user UID, nickname, profile picture, and other authorized information.

Compliant cloud service and technical support providers: Server and storage service providers that have passed our rigorous evaluation.

Legal and Regulatory Requirements: When judicial authorities or regulatory agencies legally request information, or to protect our and users' significant legitimate rights and interests, we will disclose information within the minimum necessary scope.

Prior to any information sharing, we will assess its necessity and restrict third parties to process data solely in accordance with our explicit instructions, prohibiting its use for their own purposes. If your information is to be utilized for direct marketing in the future, we will obtain your separate and explicit consent in advance and provide you with a convenient opt-out mechanism.

Chapter 5 Your Rights

You are entitled to the following rights under the law, which can be exercised through the "Personal Center" in the App or by contacting our customer service channels (we will process your request as soon as possible after verifying your identity, with a maximum processing time of 30 days):

Access and Correction Rights: Query, view, or modify your account information at any time.

Delete rights: Request to delete personal information no longer needed for processing purposes (this operation will be automatically executed when the account is canceled).

Withdraw consent: You can disable specific permissions such as camera access and notifications at any time through system settings (this withdrawal does not affect the legality of data processing activities previously conducted based on consent).

Right to object: Under certain circumstances, you have the right to object to our processing of your personal information based on legitimate interests (e.g., certain personalized recommendation features).

Data Portability Right: If technically feasible, you may request access to certain personal data you have provided in a structured and universal electronic format.

Account Deactivation: You can deactivate your account through the following steps in the App: [Personal Center] → [Account Information] → [Account Security]. We will confirm your account before deactivation. After deactivation, all related data will be deleted and cannot be recovered. We recommend backing up your data in advance.

If your claim for a certain right is rejected due to statutory reasons, we will provide you with the specific reasons.

Chapter 6 Protection of Minors

We place high priority on protecting minors' personal information. This service is primarily intended for adults aged 18 and above, and we do not proactively collect personal data from minors. If guardians discover that minors have registered and used our services without authorization, please contact us immediately. We will promptly verify the situation and delete the relevant data. Guardians may also exercise the aforementioned rights on behalf of minors.

Chapter 7 Policy Revision

This Privacy Policy may be revised from time to time. When any updated version is released, we will notify you of significant changes through appropriate channels (such as website announcements or app notifications) and specify the latest effective date. We may make necessary revisions and updates to this Privacy Policy in response to strategic adjustments in our business operations or changes in relevant laws, regulations, and policies. If revisions involve substantial changes—such as modifications to the purposes of collecting user personal information, types of personal data processed, scope of external sharing, or key recipients—we will promptly notify you through in-app pop-ups, official website announcements, mobile site notifications, or email communications. By continuing to use our services and products, you will be deemed to have read, understood, and agreed to the revised Privacy Policy terms. If you disagree with the revisions, you have the right to opt out of using related services or request account cancellation following our guidelines.

You can view historical versions of this privacy policy. If you need to review past policy content, submit a request through the official contact channels provided below.

Chapter 8 Contact Us

Data controller: Wufang (Hong Kong) Financial Technology Limited

Registered address: Hong Kong Special Administrative Region of the People's Republic of China

Contact email: contact@woofun.ai

Upon receiving your request to access historical versions or any other requests based on this policy, we will first conduct necessary identity verification to ensure information security. After verification, we commit to processing and responding within 15 working days, with a maximum processing period of 30 days in complex cases.

Important Notice: The ultimate authority to interpret this Privacy Policy rests with Wufang (Hong Kong) Financial Technology Limited. It should be noted that this policy document is intended to clarify our privacy protection practices and does not constitute any legal advice or recommendation. For further legal interpretation of personal information protection rights and obligations, we recommend consulting a qualified attorney to obtain tailored legal counsel.