Privacy Policy

Effective date: November 5, 2026
Data controller / service provider: Hypexapp Ltd, Room 1201, 12/F, 100 Queen's Road Central, Central, Hong Kong
Privacy contact: support@hypexapp.xyz

1. Scope and independence

This Privacy Policy describes how Hypexapp Ltd ("we", "us", or "our") handles personal information in connection with the HyperliquidX website and application.

HyperliquidX is an independent third-party product under active development. It is not an official Hyperliquid product and is not operated, sponsored, or endorsed by Hyperliquid or the Hyperliquid Foundation. This policy describes our practices; it does not represent the privacy practices of Hyperliquid or other independent providers.

2. Information and purposes

The application's diagnostic reporting uses Firebase Crashlytics to identify crashes and improve application stability and user experience. The application does not use Google Analytics for Firebase to collect click events or interface preferences. Hypexapp Ltd does not maintain a company-hosted database of users' wallet balances, positions, orders, or transaction-request payloads.

Crash reports can include technical device and app information, SDK-generated identifiers, and the limited diagnostic context described below. We do not intentionally attach names, email addresses, phone numbers, wallet addresses, account balances, orders, private keys, or seed phrases to Crashlytics reports. Website analytics, user-directed wallet and trading requests, local application storage, and information you choose to send to support are handled separately.

Do not send seed phrases, private keys, passwords, or unnecessary sensitive information in support requests or AI prompts. Public wallet addresses and trading activity can identify or be linked to individuals; they should not be assumed anonymous.

3. Legal grounds, where required

Website delivery and optional analytics

Where applicable law requires a legal basis, we rely on our legitimate interests to process the limited network information necessary to deliver requested webpages and downloads and to protect the website's availability and security. Our interests are operating a reliable website and preventing abuse. This operational processing is separate from optional website statistics.

We rely on your prior consent for the optional website statistics described in this policy. These statistics are off until you select "Accept all" in the website's privacy notice, or enable "Website analytics" under "Manage preferences" and select "Save preferences". Selecting "Reject all", saving preferences with website analytics off, or making no selection leaves optional statistics off. The preference cookie that remembers your choice is necessary for this control and cannot be turned off in the preference panel. You can refuse without losing access to webpages or downloads, and you can withdraw or change your choice at any time through "Privacy choices" in the footer. We do not send earlier interactions retrospectively when you later allow statistics.

Your choice applies to our optional page-view, interaction, and download counters, including the server-side download counter. Your site-specific choice permits only these optional statistics; it does not authorize advertising, data sales, or cross-site tracking. Our site blocks automatically injected third-party analytics scripts so they cannot bypass this choice. Cloudflare still handles the network information needed to deliver and protect the website and downloads.

[For application functionality, crash reporting, support communications, and other non-website purposes, identify the actual legal basis required in the relevant jurisdiction and verify the corresponding implementation. State the particular interests or obligations relied on. Do not list all grounds as interchangeable alternatives.]

Where processing relies on consent, you may withdraw it through the relevant feature control or by contacting support@hypexapp.xyz. Withdrawal does not affect the lawfulness of prior processing. We will explain which information is necessary for a feature and the consequences of not providing it.

The application provides a crash-report-sharing control in Settings > Privacy. Turning it off stops the application's custom diagnostic-context updates and requests deletion of unsent crash reports on the device. Changes to Crashlytics automatic reporting take full effect after restarting the application. Previously submitted information remains subject to the retention and request procedures described in this policy. The application's reporting control does not control the website's separate analytics.

4. Recipients and third-party services

The website is hosted on Cloudflare, which also receives the custom website interaction and download events described above through Workers Analytics Engine. The custom event collector does not write IP addresses, raw user-agent strings, wallet addresses, full referring URLs, query strings, cookies, or persistent visitor identifiers into that dataset. Cloudflare still processes the network requests needed to deliver the website and analytics endpoints; the absence of those fields from our custom dataset does not mean no network information is processed.

Google Firebase Crashlytics receives the crash and diagnostic reports when crash-report sharing is enabled. Its SDK may process installation or session identifiers and device metadata in addition to information explicitly attached by the application. Google processes and stores the information needed to provide this diagnostic service.

Hyperliquid APIs process account queries and trading instructions. Relevant public blockchain RPC operators process the network calls needed for blockchain-related actions. Reown/WalletConnect services relay wallet-connection and signing messages when that connection method is used. These services are distinct from Hypexapp Ltd and operate under their own applicable terms and privacy policies. Hypexapp Ltd does not maintain a separate server-side archive of transaction-request payloads.

Email and support-channel providers process messages and attachments needed to deliver support communications. The absence of a company-operated trading database does not mean that hosting, analytics, diagnostics, support, or network providers do not process or store information.

Third parties may receive information directly from your device when you use connected functionality. Independent providers handle that information under their own policies. Information may also be disclosed where legally required or necessary to protect rights and investigate abuse, subject to applicable law. In a business transfer, personal information may be transferred subject to applicable safeguards and required notice.

We do not sell personal information, share it for targeted advertising, or use it to send marketing messages. Replies to support requests and necessary service or security communications are operational communications.

5. Public blockchain and protocol records

Transactions and related wallet activity submitted to public networks or protocols may be publicly visible, copied, and retained by independent parties. Such records can remain available indefinitely. We generally cannot alter or delete records maintained by public networks or independent providers. Deleting local application data does not delete those records.

6. Cookies and device storage

The website's optional event collector sends events to our first-party endpoint after consent. It does not set tracking cookies or create a persistent visitor identifier in browser localStorage or sessionStorage. When analytics is allowed, it reads the referring hostname and uses request metadata to derive device category and country code. The website includes its own analytics JavaScript, separately from the native application's Firebase Crashlytics integration.

We use a first-party preference cookie named hypex_analytics solely to remember and enforce your privacy choice for up to 180 days. It contains your allow/reject selection, the consent-notice version, and the time of your choice; it is not used as a visitor identifier or for advertising. The selection and timestamp are not added to our analytics dataset; the notice version is recorded with permitted events. Clearing the cookie or its expiry leaves optional statistics off until you choose again. If the website cannot save your choice, optional analytics stay off on the current page.

The native application does not use browser cookies or browser localStorage/sessionStorage for crash reporting. Native preferences and Firebase SDK identifiers or pending reports use application or operating-system storage instead. Saved account metadata and preferences on the device are distinct from transaction-request payloads, which the application does not persist locally.

You may manage supported browser or application storage through device settings. Removing stored settings may affect functionality and does not necessarily revoke wallet permissions or close positions.

7. Retention

Company-held support emails, screenshots, diagnostic materials, and exported reports have a default retention period of 90 days from receipt or creation, as applicable. We delete or anonymize those records when that period ends, unless a limited extension is required by law or necessary to establish, exercise, or defend legal claims. Any extended retention is limited to the records and period needed for that purpose. Retention and cleanup rules cover the company's relevant mailboxes, files, exports, and backups.

Cloudflare currently documents a three-month retention period for data written to Workers Analytics Engine. This is the provider's period for that dataset and is separate from the 90-day default for copies and exports held by Hypexapp Ltd. Firebase currently documents that Crashlytics retains crash traces and associated identifiers for 90 days before beginning removal from live and backup systems. Provider deletion processes do not imply that every backup copy disappears immediately on day 90.

Local preferences and saved account metadata remain on the device until changed or removed through the application or operating-system controls. Connection and authorization material is also subject to the relevant session's expiry and revocation rules; removing local data does not by itself revoke network permissions.

We retain personal information only for as long as necessary for the disclosed purposes and applicable obligations, then delete or anonymize it as appropriate. Public network records and information controlled independently by third parties are subject to the limitations described above.

8. Security and international transfers

The application communicates with the configured Hyperliquid APIs and WalletConnect relay over HTTPS or secure WebSocket connections. Relevant local wallet-connection features use operating-system Keychain facilities. Firebase documents HTTPS protection for data in transit and encryption at rest for Crashlytics data.

Firebase services may process and store information in countries where Google or its agents maintain infrastructure, including outside Hong Kong. Other hosting, wallet, RPC, and support providers may also process information outside your location under their respective services and policies. A decentralized trading interface does not limit all processing to the user's device or to Hong Kong. [Confirm the applicable international-transfer arrangements and company-controlled dashboard access permissions before final publication.]

No application, network, or storage system can be guaranteed completely secure. You are responsible for protecting your devices and wallet credentials. This statement does not exclude our legal duties to protect personal information or respond to incidents.

9. Your rights and choices

Depending on applicable law, you may have rights to access, correct, delete, restrict processing of, object to processing of, or obtain a portable copy of your personal information, and to withdraw consent. You may also complain to your competent data protection authority. These rights are subject to applicable conditions and exceptions.

These request procedures cover personal information held by Hypexapp Ltd or processed on its behalf, such as support correspondence and any diagnostic records that can reasonably be linked to you. What we can provide, correct, or delete depends on the information actually held and applicable legal requirements.

Send requests to support@hypexapp.xyz, the privacy request contact for Hypexapp Ltd. We will acknowledge receipt within 3 business days. We may request proportionate information to verify your identity; never provide a seed phrase or private key. We will handle the request and provide the required response within applicable legal time limits. The initial acknowledgment is separate from completion of a data access, correction, or deletion request. [Add jurisdiction-specific opt-out, appeal, authorized-agent, and regulator details where required.]

You can stop using optional features, manage local data, and revoke wallet permissions through supported controls. These actions have different effects and do not automatically erase information held by independent providers.

10. Children, changes, and contact

The Service is intended for adults aged 18 or older. If you believe a child has provided personal information to us, contact support@hypexapp.xyz so we can investigate and take appropriate action.

We will identify the effective date of updates to this policy and provide notice of material changes as required by law. We will obtain consent where required before introducing new processing. Contact Hypexapp Ltd, Room 1201, 12/F, 100 Queen's Road Central, Central, Hong Kong; email: support@hypexapp.xyz for privacy questions.