Privacy policy

The short version

• You sign in with an email code, Google, Telegram, or a wallet you already have. A company called Privy runs the sign-in and your DarkTrade wallet for us.
• We store your email address or Telegram id, your wallet address, the address of the trading key you approve, your trade and transfer records, and the country your connection comes from, which the eligibility check needs.
• We never hold your wallet's key, and we never hold your trading money. We hold a trading key for your Hyperliquid account and, if you connect an exchange account, the key you make for it. We use them to trade, and never to withdraw. The only money we hold is a fee balance, if you add one to pay our fee on exchange trades.
• We earn a fee on the trades we place for you. Once we have a Hyperliquid referral code, we also earn a referral share from Hyperliquid. We do not sell your data, and we show no ads.
• Our analytics are our own. There is no Google Analytics and no Microsoft Clarity.
• You can delete your account. Deleting it never deletes your wallet and never moves your money.

1. Who we are

DarkTrade runs darktrade.ai and the DarkTrade app. DarkTrade is operated by Arshia Shahrabadi, an individual based in the United Arab Emirates (Tower B, Paramount Hotel, Business Bay, Dubai). DarkTrade is not a registered company. In this policy, "we" and "us" mean Arshia Shahrabadi, operating DarkTrade.

Contact for privacy questions and deletion requests: info@darktrade.ai

2. How your account is made

You sign in in one of four ways:

• a code sent to your email address;
• your Google account;
• your Telegram account;
• a crypto wallet you already have.

Privy runs all four for us. We never sign you in by text message.

You agree before an account exists. You tick one box: "I've read the terms, privacy policy and risk disclosure". We make no DarkTrade account until you tick it.

• On the website, Privy's sign-in window opens first. Privy may therefore hold your login, for example your email address, a moment before you tick our box. If you stop there, we make no account. If no wallet was made either, we ask Privy to delete that login after 24 hours.
• Inside Telegram, you tick our box before Privy starts. After that, opening DarkTrade in Telegram signs you in without a tap.

The eligibility check comes before your wallet. Privy creates your DarkTrade wallet only after you pass the check in section 10. If you sign in with a wallet you already have, we make no new wallet for you.

3. Privy, our sign-in and wallet provider

Privy runs sign-in and your DarkTrade wallet for us. It handles your data on our behalf, as our processor. The company behind Privy is Horkos, LLC, which does business as Privy.

• Privy's privacy policy: https://www.privy.io/privacy-policy
• Privy's list of the companies it uses to process data (its sub-processors): https://trust.privy.io/subprocessors

What Privy holds about you:

• The login you use. For an email code: your email address. For Google: your Google email, your name and your Google account id. For Telegram: your Telegram id, your first and last name, your username and a link to your profile photo. For a wallet: its address.
• Your DarkTrade wallet: its address, and its key in encrypted key shares (section 5).
• Your authenticator, if you add one (section 13).
• Your session, so you stay signed in for up to 7 days.
• Your device and connection, as Privy's privacy policy describes: your IP address, the location it suggests, and the type of device, operating system and browser you use.

We do not keep your Google name, your Telegram name, your Telegram username or your profile photo, even though Privy has them.

4. What we store

To know it is you

• Your email address (from an email code or Google), or your Telegram id.
• Your Privy user id. It links your Privy login to your DarkTrade account.
• How you last signed in, and when, and whether you have added an authenticator.

If you sign in with Telegram, your Telegram id is also your DarkTrade account number. It therefore stays on the records we keep after a deletion (section 12).

Your wallets and the trading key

• Your DarkTrade wallet's address.
• The address of any wallet you sign in with.
• The address of the trading key you approve, and its expiry date. The key itself is covered in section 6.
• Your Hyperliquid account value, as we last read it.

The eligibility check (section 10)

• The country your internet connection comes from, as Cloudflare reports it, and the region, where Cloudflare reports one.
• Your eligibility statement: the exact words you ticked, the version of the restricted list you were shown, the time, and a one-way scrambled form of your IP address, made as described under "Your agreement".
• If you connect from Canada and we ask, the province you say you live in.
• The statement your wallet signs when you turn on trading, with your wallet's address and the list version.
• If you answered an earlier version of the check, the country you said you lived in (and your province or region where it mattered) and your citizenship, as you gave them.
• Hyperliquid's own eligibility answer for your address.
• The sanctions screening result for your wallet.
• The result, and when the check ran.

Your agreement

• The box you ticked and the exact words beside it.
• The version, and a fingerprint, of each of the three documents.
• The time; how you signed in; where you were (the website, the installed app or Telegram); and the country of your connection.
• A one-way scrambled form of your IP address, made with a key that changes each day. We delete each day's key after two days.

Trading

• Each mimic and each copy you set up, with its settings.
• Every order we place for you, and every fill: coin, side, size, price, leverage, stop, take-profit, the fees and our builder fee, why it closed, and the whale it followed.

Money movements

• Each USDC transfer that reaches your DarkTrade wallet: the amount, the sending address, the time, and the sanctions screening result for the sender.
• Each deposit move you sign: the signed authorization, its amount and fee, and the transactions that carry it to Hyperliquid.
• Each withdrawal: the amount, the destination address and Hyperliquid's answer.
• Each Recover send, and the gas top-up if you used it.

Exchange accounts (section 6A)

• The exchange, your account's id there, and your account's region, where the exchange gives one.
• A short fingerprint of your API key; its permissions, settings and expiry, as the exchange reports them; and the IP address it works from.
• Your exchange account's balance and positions, as we last read them, and every order we place there and every fill.
• Your fee balance: each top-up, with its amount, the sending address and Hyperliquid's transaction id; each fee taken; and each refund.
• The boxes you tick to connect an exchange and to add a fee balance, with their exact words.

Settings and alerts

• Your default settings, your alert choices and the whales you follow.
• The alerts we sent you.
• The address your browser gives us for push alerts.

Security records

• Sign-in events that Privy sends us, with email and phone fields removed. Kept 400 days.
• Counts of sign-ins and failed checks, with no identity attached. Kept 90 days.
• Reports your browser sends when something on a page breaks our security policy: the page path, what broke it, a short browser name and a scrambled IP. Kept 30 days.
• Our web server's logs. Access logs hold the IP address, the time, the page path without its query, the referring page without its query, and the browser details your browser sends. Error logs, written when a request fails, hold the IP address, the time and the full address requested, query included, and sometimes the referring page. Both are kept up to 15 days.

What we do not store

• Your wallet's key, or any share of it.
• A password. There is none.
• Your Google name, your Telegram name, your Telegram username or your photo.
• Card or bank details.

5. What we never hold: your wallet's key and your trading money

Your wallet's key. Privy runs your wallet. Its key is split into key shares and is never stored whole. DarkTrade holds no key share. Our app asks your wallet to sign; you approve each request in Privy's window, except one: moving USDC that arrived at your wallet into your own Hyperliquid account.

That one move has fixed limits. Its amount is the USDC that arrived, up to the limit for one move. Its destination is your own Hyperliquid account, and nothing else. If you have added an authenticator, Privy asks for your passkey or app code for this move as well. Once you use one, Privy does not ask again for 15 minutes.

If you sign in with a wallet you already have, its key stays in your own wallet app.

Your money. Your USDC sits in your own DarkTrade wallet or in your own Hyperliquid account. Money on an exchange account you connect sits with that exchange. When you add funds, the USDC moves from your wallet to your Hyperliquid account over Circle's transfer route (CCTP). Our relayer pays the network fee (gas) to send the transfer your wallet signed. The signed transfer fixes where the money goes and the fee, so the relayer cannot send it anywhere else. No transfer passes through an address we control, except a fee top-up, which you send to DarkTrade's fee address (section 6A).

What we do hold is one key for each account that turns on trading: the trading key in section 6, or the key for an exchange account you connect (section 6A). We also hold your fee balance, if you add one (section 6A).

6. The trading key (agent)

In short: the trading key can place and cancel orders and set leverage on your Hyperliquid account. It can't withdraw, it's never used to move your funds. It expires after 90 days, and Disconnect deletes it on our side. In detail:

When you turn on trading, you sign three things in Privy's window:

1. 1. a statement that you are eligible (section 10);
2. 2. your approval of a trading key that DarkTrade creates for your Hyperliquid account;
3. 3. your approval of DarkTrade's builder fee, up to a maximum rate (section 7).

What the trading key can do. It places and cancels orders, and sets leverage, on your Hyperliquid account. Once DarkTrade has a Hyperliquid referral code, it also sets that code on your account (section 7). Our signing service signs nothing else: orders and cancels on the coins we allow, isolated margin only, leverage up to 10x, our builder fee at your approved rate or below, and our own referral code.

What it is never used for. Our signing service refuses everything else, including any withdrawal, any transfer of your funds, the approval of another key and a higher fee. In DarkTrade, your own wallet signs each withdrawal and each approval, in Privy's window.

Where it is kept. DarkTrade creates the key inside a separate signing service on our server. The key is stored encrypted. The key that unlocks it is held only in memory, and is typed in by hand after each restart. Our database holds the trading key's address, never the key. Nobody is shown the key, you included.

How long it lasts. 90 days. We remind you 7 days before, 2 days before, and on the day. Renew makes a new one. If it expires, your open positions keep their stop orders on Hyperliquid. Closing with the whale, take-profit handling and new entries stop until you renew.

How to revoke it.

• Disconnect in the Wallet tab deletes the trading key on our side. Deleting your account does the same. We stop using it at once, and its approval on Hyperliquid lapses on its expiry date. An encrypted copy can stay in our backups until those copies are removed (section 11).
• You can withdraw the builder fee approval at any time on Hyperliquid (https://app.hyperliquid.xyz/builderCodes), signed by your wallet. If you sign in with a wallet you already have, connect it there. With a DarkTrade wallet, you can sign there after you export its key (Account → Export wallet) into a wallet app.
• Disconnecting does not close your open positions.

6A. Exchange accounts

This section applies only if you connect an exchange account. The app lists the exchanges it supports.

Your key. You make an API key on the exchange and give it to us in the app.

• We accept it only if the exchange shows that it cannot withdraw or transfer funds, and that it works only from our IP address, which the app shows. We check again regularly.
• It is kept encrypted in a separate signing service, apart from the trading key. Our database holds a short fingerprint of it, never the key. Nobody is shown the key, you included.
• We use it only to read that account and for the futures trades you mimic or copy, and never to withdraw or transfer funds.
• Disconnect deletes it on our side, and deleting your account does the same. Neither closes your positions on the exchange. An encrypted copy can stay in our backups until those copies are removed (section 11). Delete the key on the exchange too.

What we keep, and why. Section 4 lists the data under "Exchange accounts". We use it to place and protect your trades, to apply the exchange's restrictions, and to take and refund our fee. We need it to give you the service you asked for, and we keep fee records as accounting records too. Section 11 says how long.

Your fee balance. A top-up is a USDC transfer your wallet signs, from your own Hyperliquid account to DarkTrade's fee address. Like your other transfers there, it is public on Hyperliquid's chain. A refund goes back to the address the top-up came from.

7. How we make money

• Builder fee. 0.05% of the value of each fill of an order DarkTrade places for you: entries, stops, take-profits and closes. When you turn on trading, you approve a maximum of 0.1% per fill. We can never charge more than the maximum you approved. Hyperliquid collects the fee with the fill and pays it to DarkTrade.
• Referral share. Once DarkTrade has a Hyperliquid referral code, our trading key sets it on your Hyperliquid account when you turn on trading, if no one has referred your account yet. Under Hyperliquid's referral terms, Hyperliquid then pays DarkTrade 10% of the trading fees your account pays Hyperliquid, less any fee discount Hyperliquid gives you, on your account's first $1 billion of volume. This covers all trading on your account, not only the orders DarkTrade places. You get a 4% discount on your Hyperliquid fees on your account's first $25 million of volume. Hyperliquid sets these terms and can change them.
• Fee on exchange trades. If you connect an exchange account, 0.05% of the value of each fill of an order DarkTrade places there, taken from your fee balance (section 6A). If you opened that account through a link in the app, the exchange may also pay us a share of the fees you pay it.
• Nothing on transfers. We take nothing on deposits, withdrawals or Recover. We pay the Arbitrum gas for deposits, and for one Recover gas top-up.
• We do not sell your data, rent it out, or use it for advertising.

All fees are listed in the terms, section 11: https://darktrade.ai/legal/v5/terms

8. Who else sees your data

• Privy runs sign-in and your wallet (section 3).
• Hyperliquid. Your trades, positions, deposits, withdrawals, the trading key's approval, the builder fee approval and your referrer are recorded on Hyperliquid's public chain. Anyone who knows your address can read them. The whale data we show is public in the same way. Your browser sends your signed approvals and withdrawals straight to Hyperliquid, so Hyperliquid also sees your IP address.
• An exchange you connect receives our orders on your account from our IP address, so it can tell that DarkTrade uses your key. It holds its own data about you under its own privacy policy.
• Circle runs the transfer route (CCTP) that moves your deposits. Those transfers are public on Arbitrum and on Hyperliquid's chain.
• Arbitrum One is a public chain. Your wallet's transfers on it are public. We read the chain through network nodes that others run, and they see which addresses we look up. Recover also reads your wallet's balances on Ethereum and Base through public network nodes.
• Cloudflare carries all traffic to darktrade.ai. It sees IP addresses, and it tells us the country a connection comes from. It also delivers the emails we send you about your account, so it sees your email address and the message.
• Google or Telegram, if you sign in with them. Telegram also sees that you opened DarkTrade inside Telegram, and it carries the alert messages the DarkTrade bot sends you.
• WalletConnect and Coinbase Wallet, if you sign in with a wallet app through them. Their relay services carry the connection between your wallet app and the site, and see your IP address.
• Sanctions screening. We check wallet addresses with Hyperliquid's own check and with a public on-chain sanctions list, read through public network nodes.
• Push alerts are delivered by your browser maker's push service, for example Apple's or Google's. The alert is encrypted, so that service cannot read it. If you signed in with Telegram and have no push device, we send the same alerts as messages from the DarkTrade bot; Telegram can read those messages.
• Our hosting provider, DigitalOcean, runs our server in Amsterdam, the Netherlands. Our database, and the backups in section 11, are on that server.
• Authorities, only where the law requires it, for example under a court order.

We share nothing with advertisers or data brokers.

9. Cookies, local storage and analytics

Cookies we set

• dt_attr is our own analytics cookie. It holds a random visit id, the first page you landed on, and the time. If a visit came from a campaign link, it also holds that link's campaign tags. Page scripts cannot read it (HttpOnly). It lasts 30 days.
• dt_v5p lets invited testers into parts of the app that are not yet open to everyone. Page scripts cannot read it (HttpOnly). It lasts up to 90 days, and only invited testers get it.

Cookies Privy sets for darktrade.ai

• Once Privy's cookie setup for darktrade.ai is live, Privy keeps your sign-in in its own cookies, such as privy-token and privy-session, set for darktrade.ai and its subdomains. Privy's documentation gives these cookies a life of up to 30 days. Your session still ends after 7 days, and then you sign in again. privy-token, the cookie that carries your sign-in, is HttpOnly, so page scripts cannot read it.
• Until that setup is live, Privy keeps the same session data in your browser's local storage instead.

Local storage

• dt_consent_v records, inside Telegram, which versions of these documents you accepted, so we do not ask again.
• dt_signed_in is a marker that you are signed in on this browser, so the app knows to load Privy. It is removed when you log out. It is not a login.
• Privy's own entries, which Privy uses to run sign-in. Until Privy's cookie setup is live, your sign-in session is one of them.
• A few conveniences that stay in your browser: which notices you closed, on how many days you have visited (so we offer to install the app at a sensible time), and, in the open tab only, the page to return to after sign-in and a Mimic or Copy you started before you signed in.

What our analytics record

• The page path (never the query part of the address), the site that sent you, which button you pressed, your device type, and the country your connection comes from.
• A one-way scrambled form of your IP address, made with a key we delete after two days. It lets us count one visitor once in a day, and nothing more.
• The events never hold your IP address, name, email address or Telegram id.
• When you sign in, our server links your visit id to your account, so we can count sign-ups by where they came from. That link is not removed after 180 days, or when you delete your account. Write to info@darktrade.ai to have it removed.
• Single events are kept 180 days. Daily totals are kept after that. They are counts, with no visit id.
• If your browser sends Do Not Track or Global Privacy Control, nothing is recorded.

No third-party analytics. There is no Google Analytics, no Microsoft Clarity and no advertising pixel on any darktrade.ai page.

To clear them, delete this site's cookies and data in your browser. That also signs you out.

10. Restricted places and the eligibility check

DarkTrade's trading is not available to people who live in, are located in, or are incorporated in the United States, Ontario or a sanctioned country or region. It is not available to citizens of Cuba, Iran, North Korea, Syria, Russia or Belarus, wherever they live; to anyone on a sanctions list, or acting for such a person, or to a business that such a person owns or controls; or to anyone under 18. The full rule is in the terms, section 3: https://darktrade.ai/legal/v5/terms. The list itself, with its version number and date, is at https://darktrade.ai/legal/v5/restricted

• The check runs before your wallet is created, and again each time you renew the trading key.
• It uses the data listed under "The eligibility check" in section 4.
• If you do not pass, you can still look at whales, but you cannot make a wallet or trade.

11. How long we keep data

• Your email, the link to your Privy login, and your push subscriptions: until you delete your account. Push subscriptions are also removed when you log out, and after 7 days without a sign-in.
• Your settings, the whales you follow and the alerts we sent you: kept after you delete your account, and they come back if you return. We remove them if you ask at info@darktrade.ai.
• Consent records, eligibility checks, trade records, transfer records, exchange account and fee balance records, and our relayer's audit records: 5 years after your account ends.
• Privy sign-in events: 400 days.
• Sign-in counts: 90 days.
• Security policy reports: 30 days.
• Web server logs: up to 15 days.
• Analytics: single events 180 days; daily totals longer. The key behind the scrambled IP: two days.
• The link between a visit id and your account: no set end. We remove it if you ask.
• Privy logins with no wallet and no agreement: deleted at Privy after 24 hours.
• Backups: copies of our database and of the signing service's encrypted keys. Nightly copies are kept up to 14 days, and one copy a week up to 8 weeks. Copies taken before a major change to the service are kept until we delete them by hand. Data you delete stays in a copy until that copy is removed.
• Anything on a public chain stays there for good. Nobody can delete it, us included.

12. Deleting your account

How to ask. Use Account → Delete account in the app, or write to us at info@darktrade.ai.

If money is left, the app shows you where it is and asks you to confirm. Withdraw it first, or export your wallet's key. Exporting needs an authenticator. If you have an unused fee balance, ask for it back first, or give it up when you delete (terms, section 11).

What deletion does

• Stops your copies. It does not close your open positions. They stay on your Hyperliquid account with the stop orders already placed there, and you close them yourself.
• Does not cancel a Limit Mimic still waiting to fill. Cancel it in the app before you delete. Otherwise it stays open on Hyperliquid, where it can still fill, and you cancel it there.
• Deletes the trading key, and any exchange key, as Disconnect does (sections 6 and 6A).
• Removes your email address, the link between your Privy login and your account, and your push subscriptions.
• Copies in our backups go when those copies are removed (section 11).

What we keep

• Your consent, eligibility, trade and transfer records, for the period in section 11.
• A record of your wallet's address with its Privy id. We use it to notice money sent to the address later, and to give you your old account back if you return.
• Your settings, the whales you followed and the alerts we sent you (section 11). Your follows still count in each whale's follower count.
• The link between your visit id and your account (section 9).

What deletion never does

• It never deletes your DarkTrade wallet, and it never moves your money. Your wallet stays at Privy, and your Hyperliquid account stays on Hyperliquid, each with whatever is in it.
• Privy keeps your login, because your login is how you reach that wallet.

Coming back. Sign in with the same login. You get your old account back after you accept the documents again and pass the eligibility check again.

After you delete, do not send money to your wallet's address. If some arrives, it stays in your wallet. Nothing moves it until you sign in again.

The old Telegram bot. Sending /deleteme to the bot erases your name, username, exchange UID, settings, follows and the messages you sent it, and the bot sends you nothing more. It keeps working after the bot stops sending messages. It does not touch your DarkTrade wallet. The bot keeps your Telegram id, its record of each signal it delivered to you with the risk setting and account size it used, and your sign-up attempts without the exchange UID. Our published accuracy figures are counted from the delivery records. To have these records removed too, or if the bot does not answer, write to info@darktrade.ai.

Your other rights. Whatever data protection law applies to you, you can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, and object to how we use it. Write to info@darktrade.ai, and we answer within one month. Some records stay for the periods in section 11 even after you ask, and we tell you which. If you think we have handled your data wrongly, you can also complain to the data protection authority where you live.

13. Keeping your account safe

Account access is wallet access. Anyone who can sign in to your DarkTrade account can use your wallet. Protect the email, Google or Telegram account you sign in with.

• If you sign in with Telegram, anyone who can open your Telegram account can open your DarkTrade wallet. Add an authenticator before you add funds.
• Add an authenticator: a passkey or an app code. A passkey is a key that your phone or computer keeps and unlocks with your face, your fingerprint or your screen lock. Your face, fingerprint and screen lock never leave your device; Privy keeps the passkey's public part and details of the device that made it, never its private part. An app code is a six-digit code from an authenticator app. You can add one in Account → Add authenticator at any time, and the app also offers it after your first deposit. You need one before your deposits pass $100, and before you export your wallet's key. A deposit that would take your deposits past $100 waits in your wallet until you add one, or until you send it elsewhere with Recover. Text messages are not used.
• Sessions end after 7 days, and you sign in again.
• We work to stop harmful scripts on darktrade.ai, but we cannot rule them out. The risk disclosure, section 5, explains what this means for your wallet: https://darktrade.ai/legal/v5/risk
• We cannot restore a login you have lost, and Privy cannot either. If you lose the only login you sign in with, you can lose access to your DarkTrade wallet and the money in it. A second login gives you another way in: outside the Telegram app, you can link Telegram in Account → Sign-in methods.
• Telegram in a web browser (Telegram Web) is not supported. Use the Telegram app.

14. Age

You must be 18 or over to use DarkTrade. You confirm it in the eligibility statement, and we store that tick with the statement (sections 4 and 10).

15. Where your data is processed

• Our server: the Netherlands (DigitalOcean, Amsterdam).
• Privy: the United States, and possibly other countries, as Privy's privacy policy states.
• Cloudflare: its network worldwide.
• An exchange you connect: where that exchange's privacy policy says.

Your data may therefore be stored and processed outside the country you live in, under data protection laws that may differ from the law where you live.

16. The old DarkTrade site and bot

Until the old DarkTrade site and Telegram bot close, the data they hold is covered by the privacy policy they were run under. After they close, this policy covers any of that data we still hold. Either way, sending /deleteme to the bot erases what section 12 lists, and you can ask us at info@darktrade.ai to delete the rest. You can ask the same address for a copy of the old policy.

17. Changes

Each version of this policy has a number and a fingerprint, and both are stored with your agreement. If we change something that matters, we ask you to agree again before your next deposit, mimic or copy. Withdrawals, Recover, exporting your key, Disconnect and deletion never wait for that.

18. Contact

info@darktrade.ai