Cookie Notice

INTRODUCTION

This cookie notice ("Cookie Notice") describes how Exynic Solutions Ltd., a company incorporated in Saint Lucia and having its registered address at Ground Floor, The Sotheby Building, Rodney Village, Rodney Bay, Gros-Islet ("Company", "we", "our" or "us"), uses cookies and similar technologies when you ("User(s)", "you" or "your") access our service, whether by visiting our website at https://tontrader.com/, by using our trading application at https://app.tontrader.com/, or by accessing our Telegram mini-app (together, the "Service").

This Cookie Notice should be read together with our Privacy Notice, our Website Terms of Use, our Telegram Mini App Terms of Use, and our Risk Disclosure Notice, which together describe how we collect, use and protect your Personal Information.

For the purposes of this Cookie Notice, we organize cookies into three categories, each of which is a defined term used throughout: "Strictly Necessary Cookies", "Functional Cookies", and "Analytics Cookies". These categories are described in section 3 below.

Capitalized terms used in this Cookie Notice but not defined herein have the meanings given to them in the Privacy Notice or, where applicable, in the Telegram Mini App Terms of Use.

In this Cookie Notice, you can learn about:

1. WHAT ARE COOKIES AND SIMILAR TECHNOLOGIES?

2. WHY WE USE COOKIES AND SIMILAR TECHNOLOGIES

3. CATEGORIES OF COOKIES WE USE

4. COOKIES ON OUR WEBSITE (tontrader.com)

5. COOKIES IN OUR TRADING APPLICATION (app.tontrader.com)

6. COOKIES IN OUR TELEGRAM MINI APP

7. HOW WE OBTAIN YOUR CONSENT

8. THIRD-PARTY PROVIDERS AND INTERNATIONAL TRANSFERS

9. YOUR RIGHTS

10. UPDATES TO THIS COOKIE NOTICE

11. HOW TO CONTACT US?

1. WHAT ARE COOKIES AND SIMILAR TECHNOLOGIES?

A cookie is a small text file that a website, application or other online service places on your device when you visit it. Cookies allow that service, or another party recognized by that service, to identify your device, remember your preferences, and collect information about your interaction with the service.

In this Cookie Notice, references to "cookies" should be understood to include cookies as well as other similar technologies that store or read information on your device or in your browser, including without limitation:

• Pixels and web beacons — tiny graphics or code snippets embedded in pages or emails that allow a third party to detect that you have accessed certain content;

• Scripts — code executed by your browser when you load a page, which may collect information about your device, behavior or interaction with the Service;

• Device and browser fingerprinting — techniques that combine information about your device, browser, operating system and configuration to identify or distinguish your device, with or without cookies;

• Software development kits (SDKs) and similar embedded modules used within applications, including the Telegram mini-app environment, to collect technical and usage information.

For convenience, we refer to all of the above collectively as "cookies" throughout this Cookie Notice, unless we expressly state otherwise.

We also use local storage (including HTML5 localStorage and sessionStorage) — storage areas in your browser used to retain information across sessions or tabs. Local storage is a related technology that is not affected by browser settings that block or delete cookies; instructions for clearing it are described in section 7 below.

2. WHY WE USE COOKIES AND SIMILAR TECHNOLOGIES

We use cookies to:

• operate and secure the Service — to authenticate Users, maintain sessions, prevent fraud and abuse, and protect against automated attacks;

• remember your preferences — for example, your preferred language;

• understand how the Service is used — to measure traffic, identify errors, and improve performance and user experience;

• comply with our legal and regulatory obligations — including obligations relating to record-keeping, fraud prevention, and consent management.

We do not currently use cookies for advertising, retargeting, or behavioural advertising. Should this change in the future, we will update this Cookie Notice and, where required, obtain your renewed consent.

3. CATEGORIES OF COOKIES WE USE

We organize cookies into the following categories, by purpose:

Category	Purpose	Legal basis (GDPR Art. 6)	Consent
Strictly Necessary Cookies	Cookies that are essential to the operation of the Service. Without them, the Service cannot function — for example, you would not be able to log in, our security and bot-prevention measures would not work, and critical components such as trading charts would not load.	Performance of a contract with you (Art. 6(1)(b)) and our legitimate interests in maintaining the security and integrity of the Service (Art. 6(1)(f)).	No consent required. Exempt from consent under the ePrivacy Directive because they are strictly necessary to provide the service you have explicitly requested.
Functional Cookies	Cookies that allow the Service to remember choices you make and provide enhanced functionality (such as language preference, or the in-app support chat).	Your consent (Art. 6(1)(a)).	Consent required in jurisdictions implementing the ePrivacy Directive (EU/EEA/UK) and equivalent regimes.
Analytics Cookies	Cookies that help us understand how Users interact with the Service, including aggregated information about visits, page views, errors and feature usage, so that we can improve the Service.	Your consent (Art. 6(1)(a)).	Consent required in jurisdictions implementing the ePrivacy Directive (EU/EEA/UK) and equivalent regimes.

We do not currently deploy "Advertising" or "Targeting" cookies on the Service. If we introduce such cookies in the future, this Cookie Notice will be updated and any required consent will be requested at that time.

4. COOKIES ON OUR WEBSITE (tontrader.com)

The following cookies are set when you visit https://tontrader.com/:

Cookie / identifier	Provider	Category	Purpose	Duration	Domain
__cf_bm and related Cloudflare cookies	Cloudflare, Inc.	Strictly Necessary Cookies	Content delivery network ("CDN"), bot management and protection against malicious traffic.	Up to 30 minutes (session)	.tontrader.com
i18n_redirected	Set by our website (Nuxt i18n module)	Functional Cookies	Stores your preferred language so that we can show content in that language on subsequent visits.	Up to 1 year	.tontrader.com
_ga, _ga_*, _gid, _gat (measurement ID G-64TCE5GDE3)	Google LLC (Google Analytics 4)	Analytics Cookies	Generates statistical reports about how visitors use our website, including pages visited, time spent and traffic sources. Loaded subject to Google Consent Mode v2; analytics signals are denied by default until you click "Accept" on our cookie banner.	Up to 2 years (_ga); up to 24 hours (_gid, _gat).¹	.tontrader.com

¹ In jurisdictions where the CNIL 13-month soft ceiling for analytics cookies applies, the effective lifespan of `_ga` is limited to 13 months.

4.1. Data transfers without cookies

When you visit our website, your browser also makes requests to the following third parties as part of normal page loading. These third parties do not set cookies via our website, but they do receive certain technical information such as your IP address, User-Agent string, and the page being loaded, which they may process for their own purposes in accordance with their own policies:

Provider	Purpose	What is transmitted
Google Fonts (fonts.googleapis.com, fonts.gstatic.com)	Web font delivery, for visual rendering of the website.	IP address, User-Agent, and the referring page.
CoinGecko	Live TON price ticker shown on certain pages.	IP address, User-Agent, and the referring page.

We disclose these data transfers so you have a complete picture of the third parties involved when you load our website, even though they technically operate without cookies.

5. COOKIES IN OUR TRADING APPLICATION (app.tontrader.com)

When you use our trading application at https://app.tontrader.com/, the following cookies and similar technologies are used:

Cookie / identifier	Provider	Category	Purpose	Duration	Domain
__cf_bm and related Cloudflare cookies	Cloudflare, Inc.	Strictly Necessary Cookies	CDN, bot management and protection against malicious traffic.	Up to 30 minutes (session)	.app.tontrader.com
Authentication / session cookies	Set by us	Strictly Necessary Cookies	Maintain your authenticated session and protect the integrity of trading operations. Without these cookies, you cannot remain logged in.	Session, with rotation	.app.tontrader.com
_GRECAPTCHA, _NID	Google LLC (Google reCAPTCHA)	Strictly Necessary Cookies	Anti-bot protection on login and other sensitive flows. Required to prevent automated account abuse.	Up to 6 months	.google.com and related
TradingView preference cookies (chart settings, layout)	TradingView, Inc.	Strictly Necessary Cookies	Required to operate the embedded charting component of the trading application. Without these cookies, charts will not function correctly.	Up to 1 year	.tradingview.com and our domain
Mava widget cookies	Mava AI Limited	Functional Cookies	Operates the in-app customer support chat embedded in the trading application, including the ability to associate your messages with your support thread. If you Decline, the in-app support chat will not be available; you can still contact us via our Telegram support bot or by email at [e-mail].	Up to 1 year	.app.tontrader.com and .mava.app
_ga, _ga_*, _gid, _gat (measurement ID G-KQZ47RYDQL)	Google LLC (Google Analytics 4)	Analytics Cookies	Generates statistical reports about how Users interact with our trading application. This is a different Google Analytics property from the one used on our marketing website, so that website and application usage are measured separately. Subject to Google Consent Mode v2, denied by default until you click "Accept" on our cookie banner.	Up to 2 years (_ga); up to 24 hours (_gid, _gat).¹	.app.tontrader.com

¹ In jurisdictions where the CNIL 13-month soft ceiling for analytics cookies applies, the effective lifespan of `_ga` is limited to 13 months.

5.1. PostHog — cookieless analytics

We use PostHog as a product analytics tool within our trading application, but only in a cookieless, memory-only mode:

• PostHog does not set cookies on your device.

• The identifier used by PostHog to attribute events to a session is held in your browser's working memory only and is discarded when you close the tab.

• PostHog is loaded only after you have logged in to your account; it does not run on the public, pre-login parts of our trading application.

• Because PostHog does not store information on your device, its use does not require consent under ePrivacy rules. We disclose it here for the sake of transparency.

PostHog data is hosted on PostHog's EU cluster. For more information about PostHog's processing, see https://posthog.com/privacy.

6. COOKIES IN OUR TELEGRAM MINI APP

When you access the Service through the Telegram mini-app, the runtime environment is different from a standard web browser. The mini-app is delivered within the Telegram client, and the technologies available to us are controlled by Telegram's own platform.

• Telegram's own policies apply. Your use of the Telegram client is governed by Telegram's Terms of Service, Telegram's Privacy Policy, and the Telegram Mini App Terms. We have no control over how Telegram operates its client or what it stores on your device.

• Identification within the mini-app is performed using Telegram's initData signed payload, which is sent to us by the Telegram client when you launch the mini-app. This is not a cookie that we set on your device.

• Telegram Analytics SDK (tganalytics.xyz) is loaded within our Telegram mini-app and provides aggregate usage analytics about the mini-app experience.

• Other analytics technologies. We may use similar analytics technologies within the Telegram mini-app as we use in our trading application, including those listed in sections 5 and 5.1 above. The specific set of technologies deployed in the mini-app build is subject to the constraints of the Telegram platform. Please consult our Privacy Notice for information about the categories of Personal Information processed and the purposes for which they are used.

7. HOW WE OBTAIN YOUR CONSENT

When required by applicable law, we obtain your consent before placing Functional Cookies or Analytics Cookies on your device. Strictly Necessary Cookies are set regardless of your choice on the banner, in accordance with the consent exemption available under the ePrivacy Directive, because they are required to provide the Service you have explicitly requested.

Deny-by-default. On your first visit to https://tontrader.com/ or https://app.tontrader.com/, Functional Cookies and Analytics Cookies, and any non-essential third-party scripts they depend on, are not activated until you make a choice on the cookie banner. The banner is displayed before non-essential cookies are set, and all Google Consent Mode v2 signals (described below) are initialized to denied.

The banner displays the following text:

"We use cookies for sign-in, security, and analytics. You choose. [Accept] [Decline] · Cookie Notice"

The banner offers two clear choices: Accept or Decline.

• If you click Accept, we set Functional Cookies and Analytics Cookies in accordance with this Cookie Notice, and we flip the Google Consent Mode v2 signals listed below from denied to granted for analytics.

• If you click Decline, we do not set Functional Cookies or Analytics Cookies, and the Google Consent Mode v2 signals remain denied. Strictly Necessary Cookies continue to be set, because they are required for the Service to operate. The in-app customer support chat (Mava) will not be available; you can still contact us via our Telegram support bot or by email.

Both responses are recorded persistently in your browser's local storage so that, if you choose Decline, you will not be repeatedly prompted on subsequent visits. Your consent state is also persisted server-side (timestamp and applicable Cookie Notice version) to allow us to demonstrate compliance and to respond to any later request to withdraw or change your consent.

The banner is displayed to all visitors, regardless of country. In the trading application, the banner is presented before, or during, the onboarding flow, so that you have the opportunity to make your choice before non-essential cookies are activated.

We have implemented Google Consent Mode v2 across the Service. By default, the following Google consent signals are set to denied: ad_storage, ad_user_data, ad_personalization, and analytics_storage. If you click Accept, these signals are flipped to granted for analytics. If you click Decline, they remain denied; Google Analytics operates in Google's Consent Mode cookieless signal mode (no _ga cookie is set; pings sent are aggregate).

Withdrawing or changing your consent. You can change your cookie choice at any time by:

1. clearing the cookies and local storage for our domains in your browser settings — the banner will then be displayed again on your next visit, and you can make a fresh choice (note that browser settings that delete cookies do not always clear local storage; you may need to clear local storage separately);

2. using your browser's built-in controls to block or delete cookies at any time (please note that doing so may prevent the Service from functioning correctly); or

3. contacting us at [e-mail] with a request to record your updated preference, in which case we will update both the server-side consent record and instruct your browser to clear the corresponding flag on your next visit.

8. THIRD-PARTY PROVIDERS AND INTERNATIONAL TRANSFERS

When the cookies described in this Cookie Notice are operated by third-party providers, information about you is transferred to, and processed in, jurisdictions other than the one in which you are located. We put in place appropriate safeguards for such transfers, including Standard Contractual Clauses ("SCCs"), reliance on the EU–US Data Privacy Framework ("DPF") where the provider is certified, or other approved transfer mechanisms.

The third-party providers used in connection with cookies and similar technologies on the Service are listed below:

Provider	Role	Where data is processed	Transfer safeguards
Cloudflare, Inc.	CDN, bot management, security.	Globally distributed (multi-region edge network).	SCCs in place; Cloudflare's data protection documentation: https://www.cloudflare.com/privacypolicy/.
Google LLC (Google Analytics 4, reCAPTCHA, Google Fonts)	Web analytics, anti-bot protection, web font delivery.	United States and other regions.	Google LLC is certified under the EU–US Data Privacy Framework; SCCs apply where DPF does not.
PostHog Inc.	Product analytics (cookieless mode in our trading application only).	EU cluster (operated by PostHog in the European Union).	Data hosted in the EU; SCCs apply for any onward transfers.
TradingView, Inc.	Charting component within the trading application.	United States and other regions.	SCCs apply where required.
Mava AI Limited	In-app customer support chat.	As described in Mava's privacy policy.	SCCs apply where required.
CoinGecko	TON price ticker on the marketing website (data transfer only, no cookies).	As described in CoinGecko's privacy policy.	Transmits only technical request data; we rely on the provider's own contractual safeguards.
Telegram FZ-LLC / Telegram Messenger Inc. and Telegram Analytics (tganalytics.xyz)	Telegram mini-app runtime and mini-app analytics SDK.	As described in Telegram's privacy policy.	Governed by Telegram's own policies; see https://telegram.org/privacy.

Retention of data derived from cookies. The cookies themselves expire as set out in the duration columns in sections 4 and 5. The data derived from those cookies (for example, aggregated Google Analytics reports, Cloudflare security logs, and PostHog event data) is retained by the relevant processor in accordance with that processor's published retention policy. For the broader retention of your Personal Information by the Company, please refer to section 8 ("RETENTION OF PERSONAL INFORMATION") of our Privacy Notice.

For more information about how each provider processes data, please consult the privacy policy linked from that provider's website.

9. YOUR RIGHTS

Depending on your jurisdiction, you have rights in relation to your Personal Information, including rights of access, rectification, erasure, restriction, portability, and objection. These rights, and how to exercise them, are described in section 9 ("YOUR RIGHTS") of our Privacy Notice.

In addition, in relation to cookies specifically, you have the right to:

• Withdraw your consent at any time — by following the steps described in section 7 above, or by contacting us at [e-mail]. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.

• Refuse Functional Cookies and Analytics Cookies — by clicking Decline on our cookie banner, or by configuring your browser to block cookies. Please note that Strictly Necessary Cookies will continue to be set regardless of your choice on the banner, because they are required for the Service to operate; if you wish to block these as well, you must use your browser's built-in controls, and the Service will not function correctly.

• Request information about the cookies set when you use the Service — by contacting us at [e-mail].

• Lodge a complaint with a supervisory authority — you have the right to lodge a complaint with the data protection supervisory authority in your country of residence or place of work if you believe that our processing of your Personal Information in connection with cookies infringes applicable law. We ask, however, that you first bring any concerns to our attention so that we can try to resolve them.

Please note that disabling Strictly Necessary Cookies will prevent the Service from functioning correctly. In particular, you will not be able to log in or use core trading features.

10. UPDATES TO THIS COOKIE NOTICE

We reserve the right to change this Cookie Notice at any time, so please re-visit this page frequently. We will use reasonable efforts to notify you in the event substantial changes are made to this Cookie Notice, as required by law. Any modifications, updates or alterations will be effective upon our publishing of this Cookie Notice on the Service and as of the stated "Last Revised" date, and your continued use of the Service after the Last Revised date will constitute acceptance of, and agreement to be bound by, those changes.

Where required by applicable law, we will request your renewed consent in connection with material changes to this Cookie Notice — for example, the introduction of a new category of cookies, or the addition of a new third-party provider that materially changes the way your information is processed.

11. HOW TO CONTACT US

If you have any general question about this Cookie Notice or the cookies used on the Service, please contact us at [e-mail]. To exercise any of your rights described in section 9, or to file a complaint, please contact us at [e-mail].

We will make an effort to reply within a reasonable timeframe. If you are unsatisfied with our response, you can also reach out to the applicable data protection supervisory authority in your jurisdiction.