Legal

Privacy Policy

⚠ Draft — not reviewed by a lawyer

This policy was written by reading the Hypertide database schema and source code, not by a privacy lawyer. No lawyer has reviewed it. It has not been assessed against the GDPR, the UK GDPR, CCPA, or any other regime, it does not name a data controller, and the unfinished parts are marked [[ OPERATOR ]].

It is published because the app already links here. The inventory below is accurate — it is derived field-by-field from what the code actually stores — but the legal framing around it is a placeholder. It must be reviewed by a qualified lawyer before launch.

Last updated: 16 August 2026 · Status: unreviewed draft

Short version: we store your Telegram identity, your wallet address, the encrypted key of a trading agent we created for you, and a record of every order we placed for you. We do not store your email, your name, any identity documents, or your main wallet key — and we run no advertising or cross-site trackers.

1. Who we are

Hypertide is a non-custodial copy-trading tool for Hyperliquid perpetuals, delivered as a Telegram bot, a Telegram Mini-App and a web app. The operator of the service — and the data controller for the purposes of this policy — is [[ OPERATOR: legal entity name, registered address, and (if required) an EU/UK representative and DPO contact ]].

2. What we store, exactly

This table is the real inventory, taken from the database schema rather than written from memory. If a field is not here, we do not have it.

Personal data held by Hypertide, by category.
Category	Specific fields	Where it comes from
Telegram identity	Your numeric Telegram user ID, your Telegram username, your Telegram first name, and your language/locale.	Telegram, when you message the bot or open the Mini-App. Refreshed if you change your username or first name.
Wallet identity	Your wallet address, the address of the agent wallet we created for you, that agent's encrypted private key, its status, expiry, and the maximum builder-fee rate you approved.	You, when you connect and approve the agent. The agent keypair is generated on our server.
Copy settings	Which leaders you follow, sizing mode and ratio or fixed size, leverage and leverage mode, maximum open copies, daily copy budget, allocated capital, take-profit and stop-loss percentages, your label for the session, pause/removal timestamps, plus your watchlist, private aliases for leaders, and your symbol and leader blocklists.	You, in the app.
Orders we placed	For each order: symbol, side, size, limit price, reduce-only flag, time-in-force, the builder-fee rate tagged, the Hyperliquid order id and client order id, status, filled notional, estimated builder fee, submit and resolve timestamps, the raw Hyperliquid API response, and whether it came from copying, manual trading or a stop.	Generated by us when we place an order for you, plus Hyperliquid's response.
Trading outcomes	Fills read back from Hyperliquid (timestamp, market, side, size, price, the builder fee attributable, and — for copies — measured latency and slippage against the leader's fill); copies that were skipped and why; periodic snapshots of your account equity and margin used; your lifetime routed volume; milestones and in-app notifications.	Hyperliquid's public API, read for your connected address. Some of this runs only when the relevant background job is switched on.
Sessions	For web logins: a SHA-256 hash of your session token (never the token itself), your browser's user-agent string truncated to 256 characters, and created / last-seen / expiry / revoked timestamps. Short-lived signing and login rows during connect.	Your browser, at login.
Support & feedback	The message you send us, its category, where it came from, and your Telegram ID so we can reply.	You, when you contact support or send feedback.
Groups	If you add the bot to a Telegram group: the group's chat ID and title, who added it, and — only for members who opt in — that member's broadcast preference.	Telegram, when the bot is added to a group.
Referrals	Your referral code, who referred whom, the code used, accrued and paid amounts, and the on-chain transaction hash of any payout.	Generated when a referral link is used, if the referral programme is running.
Product analytics	Onboarding funnel events: a step name, a timestamp, a few short non-identifying values, and a random per-browser id stored in your browser as `htide_anon_id`. No address, email, handle or IP is ever attached to these events, and the endpoint deliberately refuses client-supplied user ids.	Your browser, when the funnel instrumentation is enabled.
Server logs	Ordinary request logs: method, path, status, timing. IP addresses are seen by our host's edge proxy and appear in these transient logs, and are used as a fallback rate-limit key for unauthenticated requests. They are not stored in our database and are not linked to your account there.	Your network connection.

3. What we do not collect

✕Your main wallet's private key or seed phrase.Never sent to us, never stored, never requested. Connecting is done with signed messages.
✕Your email address.If you use the email sign-in option, the email is held by our embedded-wallet provider (see §6) — there is no email field in our database.
✕Identity documents, date of birth, address or phone number.We run no KYC. We do not ask and have nowhere to put them.
✕Payment card or bank details.There is no card payment anywhere in the product — we are paid a builder fee by Hyperliquid.
✕Advertising, marketing or cross-site trackers.No ad pixels, no analytics SDKs, no fingerprinting, no data sold or rented to anyone. Ever.
✕The contents of your Telegram chats.The bot sees messages sent to it (and, in groups, commands addressed to it) — not your other conversations.

4. Why we hold it, and on what basis

To run the service you asked for — identity, wallet, agent key and copy settings exist because without them we cannot place a single order for you. Basis: performance of a contract with you.
To charge and account for the builder fee — order and fill records are how fees are computed and reconciled. Basis: contract, and our legitimate interest in being paid correctly and in keeping accurate financial records.
To keep the service safe — session records, rate-limit keys and transient logs exist to stop abuse and to investigate incidents. Basis: legitimate interests.
To support you — your messages and Telegram ID, so we can answer. Basis: contract and legitimate interests.
To improve onboarding — anonymous funnel counts showing where people get stuck. Basis: legitimate interests; the data identifies a browser, not a person.
Optional extras you switch on — group broadcasts, notification preferences, referral participation. Basis: your consent, withdrawable at any time.
Where the law requires it — retaining or disclosing records when we are legally obliged to. Basis: legal obligation.

[[ OPERATOR: the "legal basis" framing above assumes a GDPR-style regime. Which regimes actually apply depends on where the entity is established and who it serves — confirm with counsel and rewrite this section accordingly. ]]

5. Wallet addresses and on-chain activity are public

This is not something we can change, so it is worth being blunt about.

Your Hyperliquid address, its balances, its positions and every fill it makes are public information published by Hyperliquid, visible to anyone, permanently. That is true whether or not you use Hypertide — it is how the exchange works. Anyone who learns your address can see your entire trading history, and they may be able to link it to you by other means.

There is one thing Hypertide adds: every order we submit for you carries our builder code, which is public on the wire. An observer analysing Hyperliquid data can therefore tell that a given account routes orders through Hypertide. We cannot remove that — it is the mechanism by which we are paid — and you should assume your use of Hypertide is publicly observable.

We also read your account's public data from Hyperliquid (positions, fills, equity) to run copying and to show you your history.

6. Who else is involved

These are the third parties actually present in the product. Each has its own privacy policy, which governs what it does with your data.

Hyperliquid — the exchange. Receives every order we place for you, and your address. Your account and funds live there.
Telegram — delivers the bot and the Mini-App. Sees your Telegram identity and the messages you send the bot. Telegram is where the bot and Mini-App run at all.
Railway — our hosting provider. Runs the application server and the Postgres database, and terminates TLS at its edge, so it processes everything above, including IP addresses.
Sentry — error tracking, used only when an error-reporting endpoint is configured. Events are aggressively scrubbed before sending: private keys, tokens, database URLs and any field whose name looks secret are redacted, the SDK's "default PII" setting is off, and an event that fails scrubbing is dropped rather than sent.
Privy — the embedded-wallet provider behind the "continue with email" option. If you use it, Privy receives your email address and holds the wallet; we receive only the resulting wallet address.
WalletConnect — used to connect an existing external wallet, when configured. It relays the connection between your wallet app and the site.
An Arbitrum RPC endpoint — queried for balances and to sponsor a dust of gas during the one-tap deposit flow. The endpoint operator sees the wallet addresses queried. [[ OPERATOR: name the RPC provider actually configured in production. ]]

We do not sell your data, rent it, or share it for anyone else's marketing. We may disclose data where we are legally required to, or where it is necessary to investigate abuse or protect the service.

Some features publish your information because that is their point. They are all opt-in:

Group broadcasts. If you opt in inside a Telegram group, the bot announces your trades to that group, showing your Telegram first name or username and details of the trade. Everyone in the group sees it. It is off unless you turn it on, and you can turn it off again.
Share cards. When you generate a P&L image or a share link, you are creating something you can post publicly. Anyone with the link can view it.
Referral links. A referral code identifies you as the referrer to us; it does not reveal your address or handle to the person you refer.

8. Cookies and browser storage

htide_session — an HTTP-only, same-site cookie holding your web login token, so you stay signed in. Only its hash is stored on our side. Necessary for the web app to work; 30-day lifetime.
htide_anon_id — a random id in your browser's local storage, used only to join onboarding funnel steps from the same browser. It identifies a browser, not a person, and is never sent alongside your address or handle. Clearing site data removes it.

No advertising cookies and no third-party analytics cookies are set by us. Wallet and embedded-wallet providers may set their own storage when you use them.

9. How long we keep things

Trading records (orders, fills, copy settings, referral accruals) — kept for as long as your account exists, because they are the record of what we did with your money and what we charged for it. [[ OPERATOR: set a definite retention period; financial record-keeping obligations in your jurisdiction will drive it. ]]
Expired login and signing rows — pruned automatically: expired web sessions are deleted 30 days after expiry (kept that long as a login audit trail), and short-lived signing and login-challenge rows within about 24 hours of expiry.
Agent keys — an encrypted agent key is retained while the agent exists. [[ OPERATOR: there is no automatic deletion of superseded agent keys today — decide the policy and implement it, or state the truth here. ]]
Support messages — kept while they are useful for support history.
Server logs — short-lived, retained by the hosting platform under its own schedule.

10. Your rights, and how to use them

Depending on where you live you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, take it elsewhere in a portable form, and withdraw consent for anything based on consent.

How to ask: message us through Hypertide support and say what you want. We handle these by hand. [[ OPERATOR: a support chat is not an adequate sole channel for a formal data request — publish a dedicated privacy email or postal address here, and a response-time commitment. ]]

Be honest about what deletion means. There is no self-service delete button today, and some things genuinely cannot be deleted:

Your on-chain activity is not ours to erase. Hyperliquid's public record of your trades is permanent and outside our control. Deleting your Hypertide account does not remove it.
We may need to retain some financial records to meet legal or accounting obligations even after you ask for deletion.
Deleting your account does not close your positions or move your funds — see the Terms. Revoke the agent and manage your positions on Hyperliquid yourself.

You can also change or stop most processing yourself at any time: turn off notifications, leave a group broadcast, delete a copy configuration, or revoke the agent on Hyperliquid — which ends our ability to trade for you immediately.

If you think we have handled your data badly, please tell us first — and you may also complain to your local data-protection authority. [[ OPERATOR: name the lead supervisory authority once the entity is established. ]]

11. How it is protected

Agent private keys are sealed with AES-256-GCM authenticated encryption, with a fresh random initialisation vector for every key. The encryption key is held in the server environment, not in the database, so a database dump alone does not yield usable keys.

Session tokens are stored only as SHA-256 hashes, cookies are HTTP-only and same-site, HTTPS is enforced with HSTS, and error reports are scrubbed of secrets before leaving the server. Logs redact key material by field name.

What we do not claim: there has been no third-party security audit, and the code is closed-source. No system is perfectly secure, and we cannot guarantee yours will never be breached — which is precisely why the agent's permissions are capped by Hyperliquid at placing and cancelling orders, and can never withdraw or transfer your funds.

12. Children

The service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has used the service, contact us and we will delete what we hold.

13. International transfers

Our infrastructure and the third parties in §6 operate across borders, so your data will be processed outside your own country. [[ OPERATOR: identify the actual hosting regions and the transfer mechanism used (e.g. Standard Contractual Clauses) with counsel. ]]

14. Changes to this policy

We will update this policy as the product changes — particularly as background jobs that read Hyperliquid data are switched on. The "last updated" date at the top always reflects the current version, and we will flag material changes in the app.

15. Contact

Reach us in-app at Hypertide support, or send product feedback via feedback. A dedicated privacy contact will be published here once the operating entity is named: [[ OPERATOR: privacy email and postal address ]].

See also our Terms of Service and how custody works.

Open items before launch

Name the data controller, its address, and any required EU/UK representative (§1).
Confirm which privacy regimes apply and rewrite the legal-basis section accordingly (§4).
Name the production Arbitrum RPC provider (§6).
Set definite retention periods, including for superseded agent keys (§9).
Publish a dedicated privacy email or postal address and a response-time commitment, and decide whether to build a self-service export/delete path (§10).
Identify hosting regions and the international-transfer mechanism (§13).
Have the whole document reviewed by a qualified privacy lawyer.