Privacy

Ylalo is operated for agent and human trading access. Contact: privacy@ylalo.com · security: security@ylalo.com.

What we collect

• Phone number when you sign in with OTP (hashed verification codes; SMS via our provider).
• Account metadata — nickname, wallet addresses we generate for you, optional invite codes.
• API / MCP usage — request paths, User-Agent, MCP clientInfo, error codes (for reliability and abuse prevention).
• Sandbox accounts — synthetic identifiers (no phone) plus the same trading metadata.

What we do not do

• Agents and API keys cannot withdraw funds.
• We do not sell personal data.
• We do not ask agents to put secrets in chat; use env vars.

Cookies / analytics

Optional Mixpanel and Vercel Analytics when configured. Sentry for errors. You can block third-party scripts in the browser.

Retention

Account and trade records are kept while the product operates and as needed for security/abuse review. Contact us to request deletion of phone-linked accounts.