Privacy Policy
What syntaka keeps about you, why, who else sees it, for how long, and how to get it or delete it.
Version of Nov 2, 2026Versions
This policy covers the syntaka app (app.syntaka.xyz), these docs, and syntaka.xyz. It says what we keep about you, why, who else sees it, how long we keep it, and what you can ask of us.
syntaka is a tool for trading on Hyperliquid. It never holds your money. We keep what we need to run your account, keep it safe, and carry out your trading: the orders you confirm, and the orders your live copies place inside your limits.
The EU's data protection law (the GDPR) applies to the data in this policy. For anything about your data, write to support@syntaka.xyz.
What syntaka keeps
Your account
- your email address and your account's name;
- a hash of your password, never the password itself;
- your authenticator app's secret and your backup codes, encrypted, if you set one up;
- your ways to sign in: email and password, Google or X. If you use Google or X, we keep the link to that account, the name and picture link it shares, and the tokens it gives us (its access tokens encrypted);
- your sessions: when each one started and was last used, its browser, and the IP address it signed in from;
- a hashed mark of each browser you signed in from, so that we can email you when a new one signs in;
- your role, when you joined, and how (for example, through an invite);
- which versions of the Terms of Service and of this Privacy Policy you accepted, and when: at sign-up, and each time you accept a newer version.
Your workspace
- the traders you follow, and when you followed and unfollowed them;
- your watchlist, chart drawings, price alerts, and the alerts that fired;
- your settings, and the state your screens keep;
- your practice trades, your copies and their logs, and your copy plan;
- your results by day and by coin;
- your notification choices.
Live trading
If you turn on live trading, syntaka also keeps:
- the address of the wallet that approved syntaka's trading key;
- the trading key itself, encrypted (see Your trading key);
- a journal of every action syntaka signed for your account on Hyperliquid (orders, cancels and changes), with Hyperliquid's answers;
- your live copies' orders and fills, with their fees;
- your own limits, and each change to them, with when and from which IP address;
- your kill switch, and when it was switched;
- daily counts for your limits;
- when you confirmed that you understand the risks of trading with real money (asked once, before your first live order or copy).
Your orders and positions are also on Hyperliquid, where every account's trades are public. Hyperliquid also publishes, for each day, the fills that carried syntaka's builder fee, with the account of each. So anyone can see that your wallet traded through syntaka.
Invites and push notifications
- your invite link's code. For each friend who joined through it: when they joined and how much they saved, but not who they are;
- if you joined through someone's link: who invited you, which halves your fee;
- when you signed up;
- for each browser or phone where you turned on push notifications: the address its push service gave it, and the keys that encrypt messages to it; and whether you muted them.
Technical and security data
- IP addresses: of each sign-in; and, counted per address and day, for the limits on sign-ins, sign-ups and emails.
- Events: sign-ins, the first page you open each day, follows, alerts, and copies started and stopped. Page views are counted without who saw them.
- Visitors: a count of browsers per day. It doesn't store who you are or your IP address.
- Error reports: when a page or the server fails: the error, the page (without addresses in it), the app's version, and your account's id if you are signed in.
- The security log: security and admin actions, such as a data export, an account deleted, or live trading turned on or off: who, what, when, and from which IP address.
- Server logs: the server's own record of what it did.
Feedback and support
- the notes you send with Send feedback, with the page you were on;
- the emails you send to support@syntaka.xyz, and our answers.
The waitlist
If you joined the waitlist on syntaka.xyz before the launch: your email address and when you joined. Our email provider keeps a copy in our contact list there.
Cookies
syntaka uses only the cookies it needs:
- sign-in cookies, to keep you signed in;
- a browser mark, so that we can tell you when a new browser signs in to your account;
- an invite link's code, for 30 days, until you sign up.
There are no advertising cookies, and no third-party analytics or trackers. Your browser also keeps some of your settings on your device.
Why we use it, and on what basis
The GDPR lets us use your data only for a reason it accepts (a "legal basis"). Ours:
| What we use it for | The basis |
|---|---|
| Running your account and your workspace | Our contract with you: the service you signed up for |
| Your trading: the orders you confirm, the orders your live copies place inside your limits, your results and your fees | Our contract with you |
| The emails syntaka must send you: sign-in, security, and your account | Our contract with you |
| Keeping accounts safe: sign-in checks, emails about new browsers, limits on attempts, the bot check, and the security log | Our legitimate interests: keeping syntaka and its users safe |
| Your live limits and their daily counts | Our legitimate interests: keeping your trading inside the limits you set |
| Fixing errors, and seeing in counts how syntaka is used | Our legitimate interests: keeping syntaka working |
| Answering your emails to support | Our legitimate interests, or our contract with you when it is about your account |
| Emails you can turn off, and push notifications | Your consent. You can withdraw it at any time, in the email's link or in the app's settings |
| The waitlist | Your consent, given when you joined it |
Your trading key
- syntaka makes your trading key on its server when you turn on live trading. Only the key's address leaves the server: your wallet approves that address.
- The key is stored encrypted, under a master key that is not stored with it. Each stored key is bound to your account, your wallet and the network, so it can't be used for anyone else.
- The key is never in a backup, a log, or an answer to your browser.
- It can place, change and cancel orders, and set leverage. It can't withdraw or move your money: on Hyperliquid, only your own wallet can sign that.
- It works for 90 days. You can revoke it at any time in the Live trading section of Your wallet: syntaka destroys it at once. You can then remove it on Hyperliquid too, with one more signature. If you remove syntaka's approvals on Hyperliquid yourself, syntaka stops trading with the key.
- syntaka destroys a key 7 days after it expires, a key your wallet never approved after one hour, and your key when you delete your account.
Public trading data
- Hyperliquid is public: anyone can see any account's trades, positions and balances.
- syntaka reads this public data to rank traders and to show them in Explore, For You and the traders' pages. It keeps a history of it. Anyone can see these pages, without an account.
- syntaka can't make Hyperliquid's data private. If you trade on Hyperliquid, your account can appear in syntaka's rankings like any other.
- If you are a trader shown on syntaka and you object, contact us.
What syntaka doesn't do
- It doesn't sell your data.
- It doesn't hold your money, and it can't withdraw or move it.
- It never asks for your wallet's seed phrase or private key.
- It shows no ads, and it has no third-party analytics or trackers.
Who else handles your data
| Who | What for | What they get |
|---|---|---|
| Hyperliquid | Prices, the traders' public data, and your live orders | Your wallet's address, and the orders and cancels syntaka signs for you |
| Resend | Sending syntaka's emails | Your email address, and each email |
| Your browser's push service (Google, Mozilla, Apple or Microsoft) | Delivering push notifications | A message encrypted for your device, which the service can't read |
| Cloudflare | The bot check on sign-up, password resets and some sign-ins; off-site storage for syntaka's backups | For the check: your IP address and your browser's details. The backups are encrypted before they leave our server |
| Google and X | Signing in, if you choose them | They tell us your name, your picture's link and, usually, your email address |
| WalletConnect | Connecting a phone wallet, if you choose it | A pairing between this page and your wallet; the messages are end-to-end encrypted |
| Hostinger, our hosting provider | Running syntaka's server | Everything stored on the server, on our behalf |
Each of them handles data under its own privacy policy.
Data sent outside the EU
syntaka's server is run by Hostinger, in Lithuania, in the EU. Some of the services above work from outside the EU, for example Resend, Cloudflare, Google and X in the United States. When your data goes to them, the transfer is covered by the EU's standard contractual clauses, or by another safeguard the GDPR accepts.
Security
- Passwords are stored only as hashes. Authenticator secrets, backup codes, and the access tokens from Google or X are stored encrypted.
- Trading keys are encrypted, kept apart from the rest of the data, and never in a backup.
- Backups are encrypted before they are stored.
- The sign-in cookies are sent only over HTTPS, and scripts on the page can't read them.
- Live trading, and changing its limits, need a fresh code from your authenticator app.
- syntaka emails you when a new browser signs in, when your password or your email changes, when your authenticator is turned off, and when a new way to sign in is added.
No system is perfectly secure. Keep your password, your authenticator and your wallet safe, and tell us if something looks wrong. See Security.
How long we keep it
| What | How long |
|---|---|
| Your account, workspace, practice trading, copies, copy plan, results, invite code, notification choices and push devices | Until you delete your account |
| Fired price alerts | 30 days |
| The IP address of a sign-in session | 30 days after the sign-in. A session is deleted once it ends, 30 days at most after the sign-in |
| Sign-in events with an IP address | 30 days |
| Other events | 90 days |
| Feedback notes | 90 days, or until you delete your account |
| Emails to support | 2 years after the last message in the conversation |
| Error reports | 30 days |
| Server logs | 14 days |
| Counts of attempts per IP address | Until the end of the day (UTC). A sign-in lock: until it ends, 15 minutes at most |
| Daily counts for your live limits | 90 days |
| Your trading key | Until you revoke it or delete your account, or 7 days after it expires. A key never approved: one hour |
| The live trading journal, your live copies' orders and fills, and the changes to your live limits | No set end. They are not deleted with your account |
| The security log | No set end. It is kept after your account is deleted |
| Which versions of the Terms and this policy you accepted, and when you confirmed the risks of live trading | No set end. They are kept after your account is deleted, as the record of what you agreed to. They hold no email or IP address |
| The waitlist | Until you ask to be removed |
| Backups | Encrypted. On our server: the last 7 nightly and the last 4 weekly backups. Off-site: 30 days |
Data you delete stays in the backups made before, until those backups are deleted.
Your rights
Under the GDPR, you can ask us to:
- access your data: tell you what we keep, and give you a copy;
- export it: in a file you can take elsewhere;
- correct it, if it is wrong;
- delete it;
- object to a use of it, or restrict it.
You can also complain to the data protection authority in your EU country.
What you can do yourself
In syntaka's account menu:
-
Your account › Export my data downloads a file with your account, your sessions, your events and feedback notes, your workspace, practice trading, copies, copy plan, invites, notification choices and results, and the versions of the Terms and this policy you accepted, with your confirmation of the risks. It never holds your password's hash, your secrets or keys. It doesn't hold your live trading journal, your live copies' orders and fills, the security log or error reports yet: ask us for those.
-
Your account › Delete my account asks you to type "delete" and to confirm with your password, an authenticator code, or a fresh sign-in. Then syntaka:
- stops your copies, and closes the positions your live copies opened;
- then revokes and destroys your trading key, so it can't sign anything more for you;
- ends your sessions, and deletes your account and everything listed under "Until you delete your account" above;
- keeps your events only as counts, without your name or IP address.
Positions you opened yourself, and your money, stay in your own Hyperliquid account. Friends who joined through your invite link keep their lower fee. What is kept, and for how long, is in the table above. When we close an account for breaking the Terms, the same happens to its live trading.
-
Profile (Settings › You) changes your name, your email and your ways to sign in.
-
Each email that isn't about security has a link that turns such emails off. Push notifications are turned off in the app's settings.
How to ask
Contact us for anything else. We answer within one month.
Before we answer a request about your data, we check that it comes from you, for example by asking you to write from your account's email address or to confirm in the app. We don't give your data to someone who can't show it is theirs.
Anyone under 18
syntaka is only for people aged 18 or older. If we learn that an account belongs to someone younger, we close it and delete its data, as for a deleted account.
Changes
We may update this policy. The date at the top shows the latest version. We tell you about an important change in the app or by email.
Versions
Each version of this policy, newest first. When a version changes, the app asks you once to accept the new one, before your next live order or copy.
| Version | What changed |
|---|---|
| Nov 2, 2026 | In force from 2 November 2026. The draft notice is removed. |
| Oct 31, 2026 | The first version. |
Contact
Questions about your data, and privacy requests: support@syntaka.xyz. You can also use Send feedback in the app's account menu.