Privacy Policy

This Privacy Policy applies to the Onederlend service — the mobile application (Android package name com.varlextech.onederlend) and the web dashboard that powers it (together, the "Service") — developed and operated by Varlextech Limited ("Varlextech Limited", "we", "us", or "our"). Onederlend automates funding (margin-funding) lending on the Bitfinex exchange using restricted API credentials that you connect to your account.

Unlike a standalone app, Onederlend is a hosted service: your account, encrypted exchange credentials, lending records, and billing state are stored on servers we operate. This policy explains what we collect, why, the third-party services involved, and the choices you have.

By registering for or using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

1. Summary

• Onederlend stores your account and exchange credentials on our servers. Bitfinex API keys are encrypted at rest and keys with withdrawal permission are rejected at setup — the Service can lend but can never move funds out of your exchange account.
• We collect only what the Service needs: your email or sign-in identity, security settings (optional TOTP/passkeys), Bitfinex credentials, the balances/lending data your own Bitfinex account returns, and billing records. No advertising, no analytics or tracking SDKs, no in-app purchases.
• Payments are made in USDT (TRC-20) — we never see or store payment card details.
• You can pause lending, disconnect Bitfinex, and request account deletion at any time.

2. Information we collect

2.1 Account and identity

• Email address and password — passwords are stored only as Argon2 hashes; we never store plaintext passwords.
• OAuth sign-in identity — if you sign in with Google or Apple, we receive an ID token containing your provider account ID, and (where shared) your name and email address.
• Security settings — optional TOTP (authenticator-app) secrets, stored encrypted; WebAuthn/passkey public credentials; and hashed recovery codes.
• Sessions — random session identifiers stored server-side; browsers receive an HttpOnly, SameSite=Lax session cookie and a CSRF token, and the mobile app receives short-lived access tokens plus a rotating refresh token stored in your device's secure storage (Keychain / Android Keystore).

2.2 Exchange credentials and financial data

• Bitfinex API credentials — the API key and secret you connect, encrypted at rest using XChaCha20-Poly1305. Credentials are decrypted only in memory when your lending bot runs or is being validated. Keys carrying withdrawal permission fail activation preflight and cannot be used.
• Account and lending data — wallet balances, active loans, pending funding offers, and income history read from your Bitfinex account through the API, plus the order intents, managed offers, and lending records the Service creates for you.
• Lending settings — your plan tier, strategy/safety parameters, and bot state (active or paused).

2.3 Billing and payments

• Plan and subscription records — the plan you choose, trial status, and membership expiry.
• USDT payment data — depending on billing mode, either a transfer proof you submit to support, or a personal TRC-20 deposit address generated for your account (the address's private key is stored encrypted). Confirmed payments are recorded as transactions (amount, txid, timestamp). Payment activity is also visible on the public TRON blockchain.
• No payment cards — we do not accept, see, or store credit/debit card numbers.

2.4 Optional communications

• Telegram — if you connect notifications, your Telegram chat ID and chosen notification categories (fills, payments, bot status, risk/errors). Disconnect at any time by sending /stop to the bot or in Security settings.
• Support correspondence — messages you send us, including payment proofs.

2.5 Technical data

• Operational logs — standard server logs (IP address, user agent, request paths, timestamps, error traces) used for security, abuse prevention, and debugging.
• Device metadata — platform, OS version, and app version sent by the mobile app for authentication and compatibility.

3. Information we do not collect

• Payment card numbers or bank account details
• Contacts, photos, precise location, microphone, or camera
• Advertising identifiers — the Service has no ads and no ad SDKs
• Behavioral analytics or telemetry — there is no third-party analytics, tracking, or crash-reporting SDK in the app
• Your Bitfinex account password or 2FA — the Service only ever uses the restricted API credentials you provide

4. Third-party services

The Service integrates the following providers. Each processes data under its own privacy policy.

4.1 Bitfinex (exchange)

The Service's core function is calling the Bitfinex API on your behalf using your credentials — reading balances, loans, and history, and placing, replacing, and cancelling funding offers. Whatever you do through the Service is executed inside your own Bitfinex account and is subject to Bitfinex's terms and privacy policy.

• Bitfinex Privacy Policy: https://www.bitfinex.com/legal/privacy

4.2 Google and Apple (sign-in)

If you choose OAuth sign-in, Google or Apple authenticates you and returns an ID token to the Service. We receive only the identity claims described in Section 2.1.

• Google Privacy Policy: https://policies.google.com/privacy
• Apple Privacy Policy: https://www.apple.com/legal/privacy/

4.3 TronGrid (payment verification)

To confirm USDT (TRC-20) plan payments, the Service queries the TronGrid API for the balance of the deposit address associated with your account. Only the public deposit address is sent; the underlying transactions are public blockchain data.

• TRON / TronGrid: https://trongrid.io

4.4 NOWPayments (optional checkout)

Where enabled, hosted USDT checkout and payment webhooks may be handled by NOWPayments under its own terms and privacy policy.

• NOWPayments: https://nowpayments.io

4.5 Telegram (optional notifications)

If you connect Telegram, messages you exchange with our bot and your chat ID are processed by Telegram's platform to deliver notifications.

• Telegram Privacy Policy: https://telegram.org/privacy

4.6 Resend (transactional email)

Where enabled, password-reset emails are sent through Resend, which processes your email address and the message content solely to deliver the email.

• Resend Privacy Policy: https://resend.com/legal/privacy-policy

5. How information is used

• Core service — authenticating you, running your lending bot, displaying balances/loans/offers/income, and enforcing your safety limits.
• Security — encrypting credentials, enforcing MFA, issuing/revoking sessions and tokens, detecting abuse, and maintaining audit logs.
• Billing — tracking trials, confirming payments, and activating or expiring memberships.
• Communications — password-reset emails, optional Telegram alerts, and support replies.

For users in the EEA/UK, the legal bases are: performance of the contract (operating your account, bot, and purchases), legitimate interests (security, fraud prevention, service improvement), legal obligations (records we must keep), and your consent (optional features such as Telegram notifications).

6. Data sharing and sale

Varlextech Limited does not sell your personal information and does not share it with third parties for their own marketing. Data is disclosed only to the providers in Section 4 as needed to run the Service, to authorities where legally required, or in connection with a transfer of the business (with notice). Note that USDT payments confirmed on-chain are inherently public on the TRON blockchain.

7. Data retention and deletion

Account data, encrypted credentials, lending records, and billing records are retained while your account is active. Deleting your account — by request to varlextechltd@gmail.com — removes your account record, sessions, MFA factors, and encrypted credentials; lending history and payment transactions may be retained for a limited period where required for accounting, fraud, or legal purposes. Disconnecting Bitfinex deletes that credential. Uninstalling the mobile app removes the tokens held in your device's secure storage. Third-party providers retain data per their own policies.

8. Your rights and choices

Depending on where you live, you may have rights over your personal data, including the right to access, correct, delete, restrict or object to processing, data portability, and to withdraw consent.

• Access and correct: view and update your sign-in method, security settings, credentials, and notification preferences in the app's Settings.
• Pause or disconnect: pause lending or disconnect Bitfinex at any time — existing loans simply run to maturity, and the credential is deleted.
• Delete your account: email varlextechltd@gmail.com from your registered address.
• Notifications: control Telegram categories or send /stop to the bot.
• Cookies: the web dashboard needs its session cookie to function; it sets no tracking or advertising cookies.

EEA/UK users may also lodge a complaint with their local data protection authority.

9. Children's privacy

Onederlend is a financial service intended for adults and is not directed at anyone under 18 (or the age of majority in your region). We do not knowingly collect personal information from minors. If you believe a minor has registered, please contact us at varlextechltd@gmail.com and we will delete the account.

10. Security

Passwords are hashed with Argon2; Bitfinex credentials, TOTP secrets, and wallet keys are encrypted at rest with XChaCha20-Poly1305 under keys held separately from the database; traffic is protected by HTTPS/TLS; sessions and tokens are revocable; and optional TOTP and passkeys add a second factor. Restricted API keys are validated so the Service has no withdrawal capability. No method of transmission or storage is 100% secure, but the Service is designed to minimize data and keep funds in your own exchange account.

11. International data transfers

The Service is operated from servers that may be located outside your country, and providers such as Google, Apple, Bitfinex, Telegram, and Resend may process data in the United States and other jurisdictions. Where required, such transfers are covered by the safeguards described in those providers' privacy policies (e.g., Standard Contractual Clauses or adequacy frameworks).

12. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted at this URL with an updated "Effective date". Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

13. Contact us

If you have questions about this Privacy Policy or the Service's data practices, contact:

Varlextech Limited
Email: varlextechltd@gmail.com