Privacy policy

The intended connection is a restricted trading authorization. Check the permissions, account scope and expiry shown by the selected venue before approval; do not grant withdrawal permission. A trading credential can still cause losses, liquidation and fees if misused. Non-custodial does not mean risk-free.

We do hold some data about you: your wallet address, records of the trading sessions you ran, and ordinary web server logs. A Google Analytics tag runs on our pages. Details below, including how to ask us to delete what we hold.

• Trading funds remain in your venue account; orders and fees can change its balance.
• Server-managed integrations store trading credentials, not your main wallet recovery phrase.
• We do store your wallet address and your session history.

Server-managed trading credentials are stored. Depending on the integration, this can include an API secret or a delegated agent's signing key, along with authorization metadata. A session-history record without a secret does not establish that no separate credential store exists. This policy does not claim that every stored credential uses the same encryption or retention mechanism.

Do not provide a main wallet private key, seed phrase or recovery mnemonic. A delegated signing key is a different credential with venue-defined permissions. Review those permissions in your own wallet and venue interface, rather than relying on the label 'agent' alone.

Stop, revocation and deletion are different. A Stop request is not confirmation that a session is flat and has no open orders. Venue revocation disables an authorization according to that venue's rules; it does not close positions or necessarily cancel existing orders. It also does not prove that every stored copy of the credential or session record has been deleted. Where possible, confirm cleanup before revoking a credential needed to finish it.

• Do not grant withdrawal permission; verify the selected venue's actual authorization.
• Expiry and revocation behavior depend on the venue and credential type.
• Never share your main wallet private key or recovery phrase.

Your session records. When you start, stop, or complete a run we keep what happened: which venue and market, the settings you chose, counters, and the timestamps. We use these to run the product, to restore a session after a restart, and to measure whether our own strategy is working.

Ordinary web logs. Like any web server: your IP address, the time, the page requested, the browser you used. These rotate on the usual schedule and are used for operating the site and investigating faults.

Analytics. We run a Google Analytics tag on our public pages. It sets cookies and sends usage data to Google. It currently loads without a consent prompt. Browser-level tracking protection or an ad blocker may prevent it from loading, depending on your settings; we do not treat you differently for using one. This disclosure is not a claim that a consent mechanism or legal compliance review has been completed.

• Wallet address: stored, and present in server logs because it travels in the URL.
• Session records: venue, market, settings, counters, timestamps.
• Server-managed integrations: trading credentials and authorization metadata, held separately from session history.
• Web logs: IP, time, page, browser.
• Google Analytics: currently loads without a consent prompt.

Google (Analytics). Usage data from public pages, as described above.

An AI assistant, if enabled on a page. Your messages and selected page context can be sent to a third-party model provider. The code filters specified sensitive fields from structured context. This is not a guarantee that every secret is detected, especially in free-text messages or unrecognized fields. Do not put credentials, recovery phrases or other private information into a chat message.

We do not sell your data, and we do not share it with advertisers.

• The exchange, because that is where your orders belong.
• Google Analytics: public page usage.
• A model provider, if the assistant is enabled: messages and filtered context, not a promise of complete redaction.
• No sale of data. No advertising networks.

Trading credentials are used for server-managed sessions. Stopping a run, disconnecting a browser or revoking permission at a venue must not be treated as confirmation that all server-side copies have been deleted. Ask us about credential deletion separately, and verify the authorization status directly at the venue.

You can ask us to delete the data tied to your wallet address. Write to us on Telegram at t.me/sypherscore or on X at x.com/Cryptobalp, from an account you can show controls that address, and say which address you mean. We will confirm when it is done.

Two limits, stated plainly: we cannot delete anything from the blockchain, because we did not put it there and nobody can; and we cannot delete what the exchange holds about your account, which is between you and them.

• Ask for deletion via Telegram or X, naming the address.
• We cannot remove anything from a blockchain. Nobody can.
• We cannot remove what your exchange holds about you.

If you are in a place where automated trading or these venues are restricted, that restriction is yours to observe; we do not check it for you and cannot advise you on it.

When this policy changes, the date at the top changes with it. We do not quietly rewrite it and pretend it always said that.

• Not for anyone under 18.
• Local restrictions are yours to check.
• Changes are dated at the top of this page.