Privacy Policy

Last updated 31 October 2026

1. Who is responsible

Hypurr Desk ("we", "us") is the controller for the limited personal data we process, described in sections 4 and 5. For questions or to use your rights, email info@hypurr.app.

This policy covers the Hypurr Desk website and trading terminal. It follows the EU General Data Protection Regulation (GDPR).

2. What stays in your browser

The terminal stores the following in your browser's local storage and IndexedDB, on your device only. We cannot read it.

• Your settings: network, chosen market, chart layout, order ticket options, risk settings, presets, hotkeys, alerts, market events, watchlists and similar preferences.
• The API wallet key your wallet approved for trading. It never leaves your browser except as signatures on your orders. If you link a phone, the phone's own key passes from your computer's screen to the phone in a QR code; the link is read in the phone's browser and is never sent to us or any server.
• Trading records: the planned risk of your orders, trade journal notes, tags and chart snapshots, the edge report's copies of your closed trades (their fills, starting stop and price candles) and its weekly reports, and the list of wallets you choose to follow.
• Your acceptance of the Terms and their date.
• Referral data: the code from a referral link you opened (?ref=), and, per account, whether applying it worked (hlterm.refApplied.<network>.<account>) and whether the account may be given Hypurr Desk's own code (hlterm.refHouseOk.<network>.<account>). We keep no referral database.
• Wallet connection data saved by the wallet connectors (MetaMask SDK, Coinbase Wallet SDK) to remember your connection.

You can delete all of it by removing the API wallet in Settings and clearing this site's data in your browser. Clearing it deletes your journal and notes permanently, so export them first (the journal exports to CSV or JSON).

Browser notifications for fills, price alerts and market events are optional, shown by your own browser, and sent nowhere.

3. Services your browser talks to

To work, the page connects directly from your browser to the services below. We do not receive or relay this traffic. Each service sees your IP address and browser details and processes them under its own privacy policy.

Browser wallet extensions (such as Rabby or MetaMask) are software you installed; they handle data under their own policies.

4. What we process ourselves

• Website hosting. The site is served by Cloudflare, Inc. (Cloudflare Workers), which processes your IP address, browser details and the pages requested to deliver the site and protect it from abuse. We don't keep request logs for the site; Cloudflare keeps short-lived security and performance data under its own privacy policy. Legal basis: our legitimate interest in running a secure website (GDPR art. 6(1)(f)).
• Ideas. When you use Ideas, the text you type is sent to our server and processed by an AI service provider on our behalf to build a portfolio. Don't type personal details into it. We don't log the text or link it to your wallet. The answer is kept for up to 24 hours in our server's cache, under a hash of the text, so the same idea isn't processed twice. To limit abuse and cost, we count requests per day under a hash of your IP address and the date, and delete the counts after two days. Legal basis: our legitimate interest in providing the feature and keeping it available (GDPR art. 6(1)(f)). The prices Ideas shows come from Hyperliquid directly to your browser and are kept there (IndexedDB).
• Edge report write-up. Only after you agree in the report, your browser sends our server a list of the patterns it found in your trades (for example "this market, late at night, lost money, strong evidence") so an AI service provider can word them on our behalf. The list holds no amounts, dates, trade counts, wallet address, notes, or setup and tag names (those are replaced by codes), and the wording that comes back has no numbers: your browser fills them in. We don't log the list or link it to your wallet. The answer is kept for up to 24 hours in our server's cache, under a hash of the list, and requests are counted per day as for Ideas. You can turn the write-up off in the report at any time. Legal basis: your consent (GDPR art. 6(1)(a)), which you can withdraw there. The report itself is worked out in your browser, from data that stays there.
• Builder fee records. Builder fees are paid to our address on Hyperliquid, where every transaction is public. We read this public data, which includes the paying wallet addresses and order details, for our accounting and tax obligations (GDPR art. 6(1)(c)) and to understand how the Interface is used (art. 6(1)(f)). We do not try to link wallet addresses to people. Accounting records are kept for 7 years, as the law requires.
• Referral payouts. When we pay an affiliate under the program terms, we use the affiliate's wallet address and the amount owed, calculated from public Hyperliquid data. We do this to carry out the program terms with the affiliate (art. 6(1)(b)) and keep the payout records for our accounting and tax obligations (art. 6(1)(c)). The payment itself is public on Hyperliquid. Payout records are kept for 7 years, as the law requires.
• Email. If you email us, we use your email address and message to reply (art. 6(1)(f)) and delete them within 2 years after the conversation ends, unless we need them longer for a legal claim.
• Access restrictions. To comply with sanctions and the restrictions in our Terms, we or our hosting provider may use your IP address to determine your approximate country and block access (art. 6(1)(c) and (f)). This happens at the moment of the request and is not stored by us.

We do not sell personal data, use advertising, build profiles or make automated decisions with legal effects.

5. Referral program

Hypurr Desk has no referral database, accounts or tracking. The program uses Hyperliquid's own referral records, which are public on its blockchain:

• When you open a link with ?ref=CODE on any page of the site, your browser keeps the code in its local storage (the first link wins) and removes it from the address bar. After you enable trading, your browser applies the code on Hyperliquid with your API wallet. Hypurr Desk's own code is applied only on mainnet, only to an account that enabled trading through Get started on this site, and only when there is no code from a link and the account has no referrer yet (see the Terms). Nothing is sent to us.
• If you view the Referrals page, your browser asks Hyperliquid for your referral data and downloads the public daily fee files from stats-data.hyperliquid.xyz. The files list the wallet addresses of every order that paid our builder fee; the calculation of what you are owed happens in your browser.
• When we pay an affiliate, we send USDC to the affiliate's wallet address on Hyperliquid. The payment is public. We read the public builder-fill files and referral records for this and keep the payout records as described in section 4; we do not link wallet addresses to people.

6. Public blockchain data

Hyperliquid is a public blockchain. Your wallet address, deposits, withdrawals, orders, trades, positions and the builder fees you pay are visible to anyone, permanently. We cannot delete or change this data. Anyone can look up any address, which is also how the Interface's "watch an address" feature works.

7. International transfers

Some of the services in section 3 and our hosting provider may process data outside the European Economic Area, including in the United States. For the processing we are responsible for, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

8. Your rights

Under the GDPR you have the right to access, correct or delete personal data we hold about you, to restrict or object to its processing, and to data portability. Because we have no accounts, we usually hold nothing that identifies you; data in your browser is under your own control, and public blockchain data cannot be deleted by anyone. Email us to use your rights.

You can also complain to the data protection authority where you live or work, or where you think your rights were infringed.

9. Children

The Interface is not for anyone under 18, and we do not knowingly process their data.

10. Changes

We will update this policy when the Interface or the services it uses change. The date at the top shows the latest version.