Privacy

The short version

We ask for no personal information. There is no sign-up form, no email address, no name and no identity check. You sign in by signing a message with your wallet, which proves you control an address without revealing anything else.

What we store

• Your wallet address. The public Hyperliquid address you sign in with. This is your account identifier.
• A session token. A random, opaque value in an httpOnly cookie. It is not readable by JavaScript and carries no information about you.
• Sign-in nonces. Single-use random values, held for five minutes, that stop a captured signature being replayed.
• An encrypted API wallet key. Generated by us, encrypted at rest, never disclosed. It can trade your Hyperliquid account but cannot withdraw from it.
• Your copy settings. Who you copy and on what limits — allocation, leverage ceiling, caps, market filters, slippage budget.
• Your trade log. Every order planned, sent, filled, rejected or skipped for you, with sizes, prices, timings and errors. This is your audit trail, and it is why we keep it.
• Periodic equity marks. Your account value over time, to draw your performance chart.
• Request IP addresses, transiently. Held in memory only, to rate-limit abuse. Not written to our database and not retained.

What we do not collect

• No email address, name, phone number, postal address or date of birth.
• No identity documents and no KYC data.
• No private keys or seed phrases for your own wallet. We never ask, and never will.
• No browsing history, no cross-site identifiers, no advertising profile.
• No payment card or bank details. We take no card payments.

Public blockchain data

Hyperliquid is a public venue. Addresses, positions, fills and performance are visible to anyone, by design and independently of us. The leaderboard and trader pages present that public data; we do not create it and we cannot remove it.

This cuts both ways: the account you trade from is publicly observable, and so are the positions copied into it. If being publicly linkable matters to you, consider which address you use. We do not deanonymise addresses, combine them with off-chain identity, or attempt to work out who you are.

Cookies

One cookie, hc_session. It holds a random session token, is httpOnly and same-site, is marked secure in production, and expires after seven days. It exists solely to keep you signed in.

There are no analytics, preference or advertising cookies, which is why the site shows no cookie banner — there is nothing to consent to. Your light or dark theme choice is kept in your browser's local storage and never leaves your device.

Who else is involved

We keep the number of third parties deliberately small. Those involved are infrastructure, not data partners: none of them receive data in order to use it for their own purposes, and we sell your data to nobody.

• Hyperliquid. Orders, approvals and account queries go to Hyperliquid's API. Everything we do on your behalf happens there, under their terms and privacy policy.
• Our hosting and database providers. They store and serve the data described above on our instruction.

How long we keep it

• Sign-in nonces: five minutes, then deleted.
• Sessions: seven days, or until you sign out.
• Copy settings, trade log and equity marks: for as long as your account exists, because they are your record of what was traded for you.
• Encrypted API wallet keys: retained while an agent may still be approved, so that a revoked or superseded agent can be identified rather than silently reused.

Your choices

You can stop the service acting for you at any moment, without asking us: revoke the API wallet on Hyperliquid. Copying stops immediately.

You can also pause or stop subscriptions in the dashboard, sign out to destroy your session, and request deletion of your account data. Where deletion would destroy your own audit trail of trades already placed, we will tell you before doing it. Some records may be retained where we are legally required to keep them.

Depending on where you live you may have rights to access, correct, export or erase your data, and to object to its processing. Because we hold so little, most requests resolve quickly. Ask and we will deal with it.

Security

API wallet keys are encrypted at rest with a per-record key derived from a master secret that is not stored alongside the data. Session tokens are random and opaque. Sign-in nonces are single-use. We verify an API wallet approval against Hyperliquid's own records rather than trusting a claim from the browser.

No system is perfectly secure. The architecture is designed so that the worst case is bounded: even a complete compromise of our database cannot move your funds, because the keys we hold cannot withdraw. That is a deliberate limit on how much damage we are capable of doing to you.

Changes

If this policy changes, the date at the top of this page changes with it. Material changes will be signposted in the product where practical. See also the terms of service and the risk disclosure.