Privacy Policy

Effective date: 5 November 2026

This policy covers the Wave app for Android and iPhone and the Wave website. It explains what we collect, why, who gets it, how long we keep it, and what you can do about it.

Wave is moving its website to new servers. The app already runs on the new servers, and this policy describes them. Until the move is finished, the older website at wavesite.ai runs on our older servers and may handle some data differently from what is described here.

Wave is for adults only. You must be 18 or over to use it.

---

1. Who we are

Wave (wavesite.ai) is responsible for your data under this policy. In this policy "Wave", "we" and "us" mean Wave. "You" and "member" mean the person using Wave.

Wave is not a broker. Your trades are placed on your own account with your own broker, and the money in that account stays with your broker.

Contact for anything in this policy: [email protected]

Data protection contact: [email protected]

---

2. The short version

• We collect what you give us (your profile, identity check, broker login, payments, messages, posts, help tickets, assistant chats and voice) and some technical data (IP address, device, app version).
• We use it to run your account, connect your broker account, run copy trading, signals, the assistant and meetings, take payments, keep accounts safe, and meet the law.
• We do not sell your data. There are no advertising or analytics tools in the app or on the website.
• Some outside companies handle data for us, for example our sign-in service, AI and voice providers, email, push notifications, payment providers, image hosting and hosting. They are listed by name in section 6.
• Some of these companies are outside Nigeria, including in the United States and China. See section 9.
• You can download your main account data, change it, and delete your account. Some data is kept after deletion, for stated reasons. See sections 10 and 13.

---

3. What we collect

3.1 Your account

• Email address, username, display name, trading alias, phone number (optional), profile photo, bio.
• Country (you choose it after sign-in; we use it to check that Wave is offered where you are), language, and your answers to the short welcome survey (for example trading experience and risk level).
• Your role and tier, your invite (referral) code and who invited you.
• When you joined, when you were last active, and how you signed up.
• Your privacy choices (see section 12).

3.2 Sign-in and security

• Your password. Your password is held by our sign-in service (section 6). When you set or change your password through Wave, we also keep a scrambled (bcrypt) copy. We use it only to confirm it is you for sensitive actions, such as deleting your account, when our sign-in service cannot answer.
• Email codes used to confirm your email or sign in.
• Two-step sign-in (2FA): the 2FA secret and your recovery codes (we keep only a scrambled form of each recovery code).
• Your trading PIN (we keep only a scrambled form), passkeys you add on the website (only their public part), and, if you turn on face or fingerprint unlock for trading, a scrambled form of that phone's unlock key.
• Sessions: which devices are signed in, the device name (for example "Wave app on Android"), browser or app details, and IP address.
• A security record of sign-ins and security changes (password, 2FA, email, PIN, passkey, face or fingerprint unlock, trading devices, account lock), with device and IP address. We use it for new-device alerts and the "This wasn't me" lock.
• Your trading PIN device list (we keep only a scrambled form of each device key).
• If you sign in with Google: your Google account ID, Google email and name.
• If you link Telegram: your Telegram user ID, first name, username, language and the chat with Wave's bot.
• A history of email address changes (old and new address).
• An activity record of actions on your account, with your username at the time, IP address and browser or app details.
• Which version of our terms, privacy policy and risk notice you accepted, when, and from which IP address.

3.3 Identity check

You need a passed identity check to withdraw, or to become a copy master or signal provider.

• Document type (passport, national ID or driving licence), issuing country, full name, date of birth, document expiry date.
• Photo of the front and back of the document, a selfie, and, if asked, proof of address (picture or PDF) and any extra file our reviewer asks for. You can take these with the camera or choose them from your phone's photos.
• The reviewer's notes, requests and decision (with reasons), and any appeal you send and its answer.

We check your date of birth to confirm you are 18 or over.

Identity files are stored encrypted on Wave's own server. They are never put on a public image host.

3.4 Broker accounts and trading

• The broker, server, login number and trading password of each MT5 or MT4 account you connect (for MoonX, on the website only, your connector key).
• What we read from your broker: balance, equity, margin, currency, the account holder's name, open positions and orders, trade history, account type (demo or live).
• A record of each connection attempt (login, server, broker, the account holder's name, outcome, IP address).
• If you paste your broker's welcome message into Quick Connect on the website: that text, with password-like words hidden before it is read by an AI provider.

3.5 Copy trading, signals, analysis and journal

• Strategies you follow, your copy settings, each copied trade, your copy profit or loss, copy fees, debts, settlements and master earnings, and any fee dispute you send.
• Signals you publish or follow, and signal trades placed on your account.
• Chart analysis: the chart pictures you upload, the market, timeframe and risk you choose, and the result.
• Your trading journal: notes, tags, mood, chart pictures, and who you share them with (private or your mentors).

3.6 Payments, Gas and Earnings

We do not take card payments. You pay with crypto or by Naira bank transfer.

• Gas balance, Earnings balance, and a record of every credit and debit.
• Crypto purchases: amount, coin, deposit address and payment reference.
• Naira purchases: amount, reference, and the payment details the payment provider sends back to us, which can include the payer's name and bank details.
• Bank transfer receipts you upload (stored encrypted).
• Withdrawals: amount, coin, network and the wallet address you pay out to.

3.7 Wave assistant

• Your chats with the assistant (typed and spoken), thread titles, and a short summary of each conversation written by AI.
• Up to 30 facts or preferences the assistant remembers about you (for example pairs you trade, or how you like to be addressed).
• Assistant settings (the name you give it, voice, language, look).
• Standing orders, trading limits you set, reminders, calendar events, price alerts, and a log of everything the assistant did for you.
• A second email address for reports, if you add one, and a private calendar link.
• Photos you send with a question (only for that answer; we keep a count, not the photo).
• Ratings and reports you give on answers.
• Voice call times and Gas charged for voice calls.

3.8 Voice, meetings and remote help

• In assistant voice calls: your voice is turned into text by our voice provider, and replies are turned into speech. Wave does not record the audio. The words become part of your assistant chat.
• In meetings: camera, microphone and screen streams, chat, polls, who joined and when, and requests to a host about your camera, microphone or screen sharing.
• Email addresses you invite to a meeting, including people who have no Wave account. We email them the invite.
• Recordings, if a host records a meeting (video and audio of everyone in the call).
• Live captions and AI meeting notes, only from people who said yes to them.
• Remote help (Wave Assist): in a meeting, you can let another person see one window or your screen and move your mouse and type on your Windows computer, through the small Wave Assist app. This only happens after you say yes in the call and type the pairing code the app shows you, and you can end it at any time. Someone in a call can also, with your yes, view and point at your Wave screen, or help you using a short code. We keep a record of each session (who asked, who shared, when, and how it ended) and a scrambled form of the network address. We do not store your screen or your keystrokes.

3.9 Community and support

• Posts, comments, direct messages, reviews, signals and pictures you share.
• Help tickets and bug reports (including a short description of your device), and the files and screenshots you attach to them (pictures or PDF, stored encrypted).
• What you send through the help forms for people who cannot sign in, including the account deletion request form: your email, name (optional) and message.
• Telegram: order messages you type to Wave's Telegram bot. If you add Wave's bot to a Telegram group, it reads every message in that group, including other people's, to find trading signals. We keep a record of each message read (the answer and a scrambled form of the text), the signals found, and up to 25 example messages you confirmed, so the bot learns the group's format.

3.10 Invites and partner programmes

• Invites: who invited you, and invite rewards.
• If you add a friend through "invite a friend", we store the name and email you enter, create a sign-in for them with our sign-in service, and email them a temporary password.
• Nextstar rebate programme (only if you turn it on; not offered in the Google Play app): we send your email, username and country, and the username of who invited you (or Wave's own sponsor name), to Nextstar. Wave creates your Nextstar password and keeps it encrypted, with your Nextstar access keys, so Wave can sign in for you.
• Partner broker sign-up (only if you ask for it): your email, first and last name (taken from your display name), phone and country are entered into the partner broker's sign-up form for you. The form may also need a code sent to you, a captcha, your date of birth, your gender and an account type; we ask you for these during sign-up. Wave creates the password for that broker account and keeps it encrypted so you can see it later.

3.11 Technical data and logs

• For each request to our servers: your member ID, username, the page or feature used (including the web address), the time, how long it took, your IP address, browser or app details, the information you sent, and any error. Passwords, codes and tokens are hidden before anything is written to the log, including ones inside nested fields and in web addresses.
• Error reports from our analysis and Telegram services, which can include your member ID or Telegram ID and the market and timeframe you asked about, go to a private Wave staff channel on Telegram.
• Push notification tokens for your phone or browser.
• On your phone, the app keeps your settings, chart layouts, indicators, drawings, saved scripts and a random trading-device key in its own storage. The secret for face or fingerprint unlock is kept in the phone's secure storage (Keychain or Keystore). Your sign-in session is kept in memory only.
• Server log files of Wave MT5 Cloud (the service that connects to brokers).

3.12 What we do not collect

• No location. The app does not ask for location permission.
• No advertising IDs. There are no advertising, analytics or crash-tracking tools in the app or on the website.
• No card numbers.

---

4. Why we use it

We do not use your data for advertising, and we do not sell it.

---

5. What other people can see

• Without signing in, anyone can see: the top-traders board (name, username, photo and trading results), strategy pages with their trades, older copy-trader pages (name or alias, photo, tier, fees and results), public profiles and the posts on them.
• Signed-in members can also see: the copy-master board (name, username, photo, tier, 90-day return, drawdown and number of followers) and the referrer board.
• By default your profile is public and you appear on all these boards. You can change this in your privacy settings (who sees your profile, whether your profit and loss shows, and which boards you appear on).
• Copy masters see their followers' display names, copy settings and copy profit or loss.
• Mentors can read journal notes you mark as shared with mentors. We log each time they do.
• Whoever invited you sees your username, display name, photo, join date, whether your email is confirmed, and the date of your first completed purchase.
• Meetings: other people in a meeting see and hear what you share. If a host records, everyone's audio and video is in the recording. If you give someone remote help access, they see what you share and can use your mouse and keyboard until you end it.
• Telegram groups: if you add Wave's bot to a group, the people in it see what the bot posts there.

---

6. Who we share it with

We share data only with the companies below, and only what they need to do their job for us. We do not sell data.

Sign-in

• Wave Auth Engine (auth.wavesite.ai): the sign-in service Wave shares with the older Wave site. It holds your email, password and display name, sends sign-in and reset codes by email, and receives your IP address at sign-in. It also holds who invited you.
• Google: if you choose "Sign in with Google".

Trading

• Your broker: receives your login and the trades you or your copy settings place.
• Wave MT5 Cloud (Wave's own service) and wave-copier (Wave's own copier): log in to your broker account, read figures and place trades. They receive your broker login, password and server.
• Depending on how and when your account was connected, these services may also receive your broker login, password and server: fxmt5 (MT5 engine service), MyFXPaddy MT5 API (metahost.myfxpaddy.com), used to import trade history, and MetaApi (agiliumtrade.ai), used for older connections.
• mtapi, the maker of the MT5 and MT4 engine software we use: receives a login check from your broker's server, and the broker server names we look up, over an unencrypted connection. It never receives your login or password. MetaQuotes may also receive the broker server name we look up.
• MoonX (moon-x.io): only if you connect a MoonX account on the website. Not offered in the Google Play app.
• Deriv: we get market prices from Deriv. No member data is sent.

AI and voice

• DeepSeek: our main AI model. It receives your assistant messages, recent chat history and summary, the facts the assistant remembers, your broker name, login number, server, balances, equity and positions, and results of things the assistant looks up for you (for example parts of your direct messages, your profile, help tickets and signed-in devices). It also receives meeting captions with speaker names, meeting chat and polls (for AI notes), signal texts, Telegram group messages and order messages the bot cannot read by itself, and text pasted into Quick Connect with passwords hidden.
• OpenAI: receives the same data when DeepSeek is unavailable, and reads any photo you send to the assistant.
• AI chart analysis: the chart pictures you upload are read on Wave's own server. Wave works out the plan itself; DeepSeek (or OpenAI as backup) only receives the market, timeframe, market prices and that plan, to write it in plain words. No chart picture and no member data is sent to them.
• Anthropic: if you chat with Wave's Telegram bot, it may use Anthropic's models to answer your message.
• ElevenLabs: turns your voice into text and the assistant's replies into speech during voice calls. It receives your voice, the language and the name you gave the assistant.
• The assistant may call itself "WaveAI". It runs on models from the providers above.
• On the website, live captions and voice input use your browser's speech recognition. In Google Chrome, the browser may send your voice to Google to turn it into text.

Payments

• NOWPayments: crypto purchases. Receives the amount, coin and an order number that includes your member ID.
• Bachs for Naira payments, and Paystack, Fincra, Korapay or Busha only if we switch them on. They receive your email, display name, member ID, the amount and a reference, and they send back the payment details.

Messages and notifications

• Resend: sends our emails (codes, security alerts, deletion notices, assistant emails and statements, meeting invites, including to people without a Wave account, and your data download when Wave sends it by email). It receives the email address and the email content.
• Google Firebase Cloud Messaging (and Apple's push service through it): sends push notifications. Receives your device token and the notification text, which can include trade and money details unless you turn on "hide amounts".
• Expo: push notifications for the older Wave app only.
• Telegram: if you link Telegram or add Wave's bot to a group. Receives your Telegram ID and the messages Wave or the assistant sends you or the group. Wave's error reports also go to a private staff channel on Telegram (section 3.11).
• Your calendar app: if you subscribe to your assistant calendar link, your calendar provider reads the event and reminder texts through that private link.

Partner programmes (only if you use them)

• Nextstar (nxt-star.com): email, username, country, who invited you (or Wave's sponsor name) and the password Wave creates for you. Not offered in the Google Play app.
• Partner brokers such as Vantage: the sign-up details listed in section 3.10. To fill in a broker's sign-up form, Wave can use a captcha service (2captcha) and a proxy service (SOAX).

Hosting, images, logs and backups

• DigitalOcean: hosts our servers, database and media server, and stores our encrypted off-site backups (in San Francisco, USA).
• A separate hosting company runs the Windows server for Wave MT5 Cloud and the Telegram service.
• Cloudflare: carries all traffic to wavesite.ai (it sees IP addresses and requests in transit).
• Cloudinary: hosts profile photos and pictures in posts. Pictures there have public links. Identity documents, help-ticket files and journal pictures are never put there.
• LiveKit: the meeting, voice and remote help software. It runs on Wave's own server.
• MongoDB Atlas: keeps a copy of our server request logs for 10 days.

Others

• The law: we share data when the law requires it, for example with courts, police or regulators, and to protect members, Wave or others from fraud or harm.
• If Wave is sold or merged: data would pass to the new owner under this policy.

---

7. Wave staff

Wave staff can see account data when they need to, for support, safety and payments. This includes:

• viewing a member's account as the member sees it, to help with a problem;
• reviewing identity documents (only staff who review identity checks);
• opening files attached to help tickets (each view is logged);
• reading assistant answers that members rated, with the question before them;
• seeing request logs, error reports, remote help session records and withdrawal wallet addresses.

Staff actions are logged.

Wave staff will never ask for your password, PIN or codes.

---

8. How the assistant uses your data

• The assistant reads your account figures (balances, positions, profit and loss) to answer you.
• It can look up your own direct messages, profile, identity check status, help tickets and signed-in devices when your question needs them.
• It can send you an email or a Telegram message and add events to your calendar when you ask.
• Trades and other money actions need your yes first.
• You can delete chats and remembered facts at any time.

---

9. Data sent outside Nigeria

Wave is first offered in Nigeria. Some of the companies in section 6 store or process data in other countries, including:

• United States: DigitalOcean off-site backups (San Francisco), OpenAI, Google, Cloudflare, Resend, Cloudinary, and others listed in section 6.
• China: DeepSeek, our main AI model.
• Other providers in section 6 may store or process data in other countries too.

When we send data abroad, we send each provider only the data it needs to do its job for us.

---

10. How long we keep data

Where a row below says "no fixed end date", we have not yet set a time limit. We will add one to this policy when we set it.

---

11. How we protect data

• Traffic between you and Wave is encrypted (HTTPS).
• Identity documents, help-ticket files, journal pictures, bank transfer receipts, saved broker passwords and passwords Wave creates for partner accounts are stored encrypted.
• Off-site backups are encrypted (AES-256).
• Your Wave password, PIN and recovery codes are stored only in scrambled form.
• Passwords, codes and tokens are hidden from our request logs.
• Trading actions can require your PIN or face or fingerprint unlock.
• New-device sign-ins send an alert, and "This wasn't me" locks the account.

No system is perfectly safe. If a breach puts your data at risk, we will tell you and the regulator as the law requires.

---

12. Your choices

• Privacy settings: who sees your profile, whether your profit and loss shows, who can message you, which leaderboards you appear on, whether others see you online, and whether people can find you by your exact email.
• Notifications: turn types on or off, set quiet hours, and hide amounts in push notifications.
• Assistant: delete chats and remembered facts.
• Meetings: say yes or no to captions and AI notes, and to remote help. End remote help at any time.
• Telegram: unlink Telegram, or remove Wave's bot from a group.
• Partner programmes: Nextstar and partner broker sign-up only run if you turn them on.
• Phone permissions: you can refuse or remove camera, microphone, photos, Bluetooth, notification and face or fingerprint access in your phone settings. Some features will then not work (for example the identity check needs the camera or your photos, voice calls and meetings need the microphone).

---

13. Your rights

Under the Nigeria Data Protection Act 2023 and similar laws, you can:

• See your data: use "Download my data" in Settings. You get a JSON copy of your main account data: profile, accepted terms, privacy and notification settings, posts, comments, follows, blocks and mutes, journal, analyses, messages you sent, reviews, signals, help tickets, wallet, purchases, withdrawals, sign-ins, email changes and reports you made. Each kind holds up to 5,000 items (analyses: your latest 500). It has no passwords or secrets. It does not yet include assistant chats and memory, your identity check, copy-trading records, meetings or the security record: email [email protected] for those. You can ask once every 24 hours, and the file is kept for 7 days.
• Correct it: edit your profile, or contact support.
• Delete it: delete your account in the app, or ask on the web at wavesite.ai/delete-account.
• Object or limit: ask us to stop a use of your data that is based on our legitimate interest.
• Withdraw consent: for anything based on your consent (for example voice, photos, captions, remote help), stop at any time. This does not affect what was done before.
• Move it: the "Download my data" file is in a common format (JSON).
• Complain: to the Nigeria Data Protection Commission (NDPC), or the regulator where you live.

To use any right, email [email protected] from the email on your account. We may ask you to confirm it is you. We aim to answer within 30 days.

---

14. Age limit

Wave is only for people 18 and over. We do not knowingly collect data from anyone under 18. The identity check confirms your date of birth. If we learn that a member is under 18, we close the account. If you think a child is using Wave, email [email protected].

---

15. Deleting your account

You can delete your account in the app (Settings, then Delete account) or ask on the web at wavesite.ai/delete-account.

In short:

• The app first lists anything that still needs your account (for example open trades, Earnings not yet withdrawn, a pending withdrawal, or a strategy you run that still has followers).
• After you ask, you have 7 days to change your mind. Then the account is deleted, normally within an hour after the 7 days end.
• Your Gas is lost when the account closes.
• Your posts stay on Wave under "Deleted User".
• Some data is kept, for the reasons in section 10, including identity documents for 5 years.

The full list of what is deleted and what is kept is on the account deletion page.

---

16. Cookies and browser storage (website)

• We use one cookie, wave_lang, to remember your language, for 1 year.
• The website also stores your sign-in session, your invite code (if you came from an invite link) and your display preferences in your browser. These stay until you sign out or clear your browser.
• We do not use advertising or analytics cookies.

---

17. App permissions

On Android the app also uses internet, network state and audio settings (for calls). These do not show a prompt. The app does not ask for your location.

---

18. Changes to this policy

If we change this policy, we will update the date at the top. For important changes, we will tell you in the app or by email before they take effect, and ask you to accept the new version where needed.

---

19. Contact

Wave (wavesite.ai)

Email: [email protected]

Data protection contact: [email protected]

Website: wavesite.ai