Legal / Privacy

Privacy

Last updated 4 November 2026

In short

No passwords, no cookies and no keys in our hands. You sign in with a social account or a wallet, in our sign-in provider's window. Apart from the sign-in provider's code, the only outside scripts are our network provider's page counter and, in the app, its human check. We do not sell data.
Every account gets its own trading wallet. Its key is held split and encrypted by our sign-in provider, never by us. The provider sees who you sign in as, your trading wallet's address and each request that wallet signs.
What you type to the agent is answered in the page or read by our own model on our own server, used for one answer, then dropped. No outside AI sees it.
The app sends your trading wallet's address from your browser straight to the trading venues, never to our server.
Apart from the sign-in records our sign-in provider keeps for us, the only personal data we keep is an email you send us, through the contact form or to hello@hormos.xyz.
Your browser keeps three small settings for the app, plus the sign-in provider's tokens and analytics ID. You can clear them whenever you like.

What this page covers

This page explains what happens to your data on hormos.xyz (this site and its contact form), app.hormos.xyz (the app) and api.hormos.xyz (our server). “We” means the team that runs Hormos.

Today the app reads accounts and places orders on the trading venues' test networks only. From the main networks it reads public market data and nothing else.

What we never collect

Any wallet's private key or recovery phrase. If you paste something that looks like one into the chat, the page refuses to send it and warns you. Your trading wallet's key is held split and encrypted by our sign-in provider, never by us.
Passwords. You sign in with a social account or a wallet through our sign-in provider, so there is no Hormos password, and our server never receives your sign-in details.
Your funds. We never hold or move them.
Your chat history. Chats live in the page's memory and are gone when you reload or close it.
Cookies, ad pixels or fingerprints: we collect none of them, and we add no tracking IDs of our own. The sign-in provider's code keeps an analytics ID in your browser for the provider (see What stays in your browser). In the app, our network provider's human check reads signals from your browser to tell people from automated scripts; we receive only a pass or a fail (see What you type to the agent). Apart from that check, the network provider's page counter and what the sign-in provider's window loads, our pages load no scripts or fonts from anyone else.

What you type to the agent

The page answers many messages by itself. Only the ones that need our model are sent to our server.

What we get: The text of one message, up to 300 characters. That covers orders, venue comparisons and anything the page cannot answer itself. Messages the page recognises as being about advice, safety grades, settings, limits, charts, pausing or closing everything, or your account, orders or alerts are answered there and not sent.
Why: So our model can work out what you are asking for and which words mean what.
Where it goes: To our own model on our own server, api.hormos.xyz. The answer (the kind of request, the words it found, a tag for each word and how sure the model is) goes back to your page. No outside AI service is involved, and the server refuses model requests from other websites. Like all traffic to our server, it passes through our network provider on the way.
The human check: Before your first message is read, the app runs our network provider's human check in the page. It looks at signals from your browser to tell people from automated scripts, and only shows itself if it needs you to click. To confirm the result, our server sends the check's one-time token and your network address to the provider. We receive only a pass or a fail, and with a pass a session that expires in about 30 minutes. The session stays in the page's memory and goes with each message you send to be read; our server only counts the reads made with it, in memory. Nothing else is kept. If the check does not pass, your message is not sent.
How long: Used for one answer, then dropped. We never log or store it. If the model fails, the log notes only the kind of error.
Never sent: The app never adds your wallet address, signatures, trading key, balances or signed orders to it. If you type your address into a message yourself, it goes like any other text. Text that looks like a private key (64 hexadecimal characters) or a recovery phrase (12 to 24 words) never leaves the page.

You sign in in our sign-in provider's window, with a social account or a wallet. Signing in only tells the app who you are. You can read and compare without signing in.

With a social account: The social network shares your basic profile with the sign-in provider: your name, username or email address, and picture, depending on the network. The page shows your name and picture so you can see who is signed in. Your picture loads from the social network that hosts it.
With a wallet: Your wallet app, in your browser or on your phone, signs one sign-in message on your device. The sign-in provider sees that wallet's address and the message. The page shows the short address and a picture made from it. This wallet only proves who you are. It never trades.
Like any website: The sign-in provider also sees your network (IP) address and the rough location it points to, your device and browser, and the page you came from.
What we see: In the sign-in provider's dashboard we can see each sign-in account (the social account or the wallet address) and the trading wallet address linked to it, and we can delete them. Our server never receives your sign-in tokens, name, email address or picture.
How long: The provider keeps your sign-in and your trading wallet until you ask us to delete them (see Your choices). Signing out ends the session in this browser.

Your trading wallet

Every account, including one signed in with a wallet, gets its own trading wallet, made by our sign-in provider when you first sign in. It is yours, and all trading runs from it: its address is your account at the venues. Its key is held split and encrypted by the sign-in provider, never by us, and the provider says it cannot rebuild the key outside its secure hardware or move funds on its own. The wallet can be used once you are signed in, so whoever gets into your social account or sign-in wallet can use it too. It has no recovery phrase unless you export its key.

What we get: Your trading wallet's public address.
Why: To read your account at the venue, to approve a trading key, and to make sure every order comes from your trading wallet.
Signatures: Your trading wallet signs in three cases, each only after you press to approve it. Approving a trading key, once per key, is sent to that venue's test network. Resuming trading after a pause and loosening your own limits are plain messages, checked in your browser against your trading wallet's address; the app never sends those two to our server or a venue. The signing happens in the sign-in provider's secure hardware, so the provider sees each request.
Where it goes: Your trading wallet's address is held in the page's memory and sent to the venues to read your account and approve trading keys. The sign-in provider knows it because it made the wallet. The app never sends it to our server.
How long: In the page's memory until you sign out, reload or close the page. When you come back still signed in, the sign-in provider gives it to the page again. It also forms part of the names of two browser storage items, described below. No signature is stored.

The trading key is made in your browser, held in the page's memory, never saved and never sent to us. It can place and cancel orders, it can never withdraw or transfer funds, and it lasts about 24 hours. Reloading or closing the page drops it.

What stays in your browser

The app keeps three small items of its own in your browser's local storage on this device. Only the page reads them, and they are never sent anywhere.

plainline-theme: Light or dark: the theme you picked.
panperp-limits:<your address>: Only the limits you changed from the defaults: maximum leverage, maximum total exposure, maximum loss per trade and daily loss limit. Resetting your limits to the defaults removes it.
plainline-halt:<your address>: “pause” or “kill”, so a reload keeps trading stopped. Resuming trading removes it.

The sign-in provider's code in the page keeps its own items in local storage. Unlike ours, they go back to the provider:

Sign-in tokens: They keep you signed in between visits and go with each request to the sign-in provider. Anyone who copied them could use your sign-in, and your trading wallet, until the session ends. Signing out removes them.
Analytics ID: A random ID the provider sends with its requests, for its own analytics. Deleting the site data removes it.
Wallet details: Which wallet you signed in with, so the window can find it again. While a social sign-in is under way, two short-lived codes check that the answer coming back belongs to the sign-in you started.

If you sign in with a wallet app on your phone, the code that links the page to it keeps its own pairing data in your browser too.

Everything else lives in the page's memory and is gone when you reload or close it: your chats and every message you typed, your name, picture and trading wallet address, the trading key, the session from the human check, account data read from the venue, and order cards waiting for Confirm.

To remove all of these items, sign out, then delete the site data for app.hormos.xyz in your browser's settings. Our own code uses no cookies, session storage, IndexedDB or service worker, and the sign-in provider's code is set never to write cookies.

The trading venues

For your account and your orders, your browser talks to the trading venues directly. Our server is not in the middle.

Your account: On the venue's test network: your trading wallet's address, to read your balance, positions, open orders, fills and 24-hour profit and loss. The page reads these regularly while it is open and in view.
Key approval: Your address, the trading key's public address, the key name “hormos”, its expiry and your signature, sent once per key.
Orders: The orders and cancels you confirm, signed in your browser with the trading key.
Market data: For cost comparisons and charts, the page reads public prices, order books, funding rates and candles from about a dozen venues' main networks, two of them through our server (see below). Nothing about you goes with these reads. One venue that prices orders from a pool receives the order's size in US dollars (rounded up) and the market, so it can quote a price. Never an address.
Like any website: Each venue sees your network (IP) address, your browser's user agent and that the request comes from app.hormos.xyz.
How long: The venues keep their own records of key approvals, orders and fills under your trading wallet's address, under their own terms and privacy policies. We keep none of it. Account data read in your browser is dropped when you sign out, change account or reload.

Our server

api.hormos.xyz runs our model, passes on some public market data and serves the files behind the charts. It has no database and no user records. All web traffic reaches it through our network provider, which sees requests in transit. The server opens no web port to the internet.

Market data: Two venues block reads from browsers, so our server fetches their public market data for the page. Only a market symbol or contract number is passed on, never an address, order or size. This part of the server cannot write files at all.
Chart files: Market candles and the bands a forecasting model on our server draws from them. Fetching them sends nothing about you.
Access log: One line per request: the time, method, path, status and how long it took. No query string, no network address, no message text, no wallet address, no human check token or session. Error lines name the path where something broke, the venue call that failed, or only the kind of error when the model fails or a human check does not pass. The log sits in the server's system log. We have not set our own retention period for it yet, so it follows the operating system's default.
Rate limits: To stop overload, the server counts requests per network address (for IPv6, per /64 block): 60 a minute on every route, 30 a minute to the model, 10 human checks a minute, and, from everyone together, 600 a minute to the model and 300 human checks a minute. It also counts reads per session: 30 a minute. The counts live in memory only, are never written to disk, are trimmed when they grow large and vanish on restart.
Location: The server can read the country code our network provider attaches to a request, so it can hide order placing in places where we decide not to offer it. The list of such places is empty today, and the app does not ask yet. The country code is used for one answer and not logged.
Backups: A daily compressed copy of the chart records, kept 90 days on the server. Market data only, no user data.

The contact form

The “Write to us” form on hormos.xyz is the only code that runs for this site.

What we get: Your name (up to 80 characters), your email address and your question (up to 4,000 characters). Two hidden fields help us spot scripts: a trap field people never see, and the time the page loaded. A message with the trap filled in, or sent less than 2.5 seconds after the page loaded, is dropped. Neither field goes into the email.
Network address: Used only to allow at most three messages a minute from one address. Our hosting and network provider's rate limiter does the counting. The address is not put in the email, and our code does not store it.
Where it goes: One plain-text email, sent through our hosting and network provider's email service from form@hormos.xyz. It is addressed to hello@hormos.xyz and delivered to the team's inbox at our email provider. It holds your question, your name and email address, and the line “Sent from the form on hormos.xyz”. Your address is set as the reply address, so a person can answer you from hello@hormos.xyz.
How long: Our code stores nothing: no database, no file, no log of your message. If sending fails, the error is noted without your name, email or question. The email stays in our inbox until we delete it. We have not set a fixed period yet.
Deleting it: Write to hello@hormos.xyz from the same email address and ask us to delete your message.
Never: No file uploads and no cookies. The form refuses messages that a browser sends from any other website.

Writing to hello@hormos.xyz from your own email app reaches the same inbox, if you would rather not use the form.

The introduction page

Our hosting and network provider serves every file. Like any web host, it receives each request (your network address, browser user agent and the page asked for) in order to serve it. Any logs it keeps are under its own terms.
Apart from our network provider's page counter, the page loads nothing from other sites. Its security policy allows hormos.xyz and that one counter only.
It sets no cookies, and our code keeps nothing in your browser's storage.
“Launch app” takes you to app.hormos.xyz. Email links open your own email app.
A small file at the site root proves to a search engine that we own the domain. It collects nothing.

Cookies and analytics

No cookies. Neither site sets any, and neither does our server. The sign-in provider's code in the app is set never to write them. The sign-in provider's wallet frame and a social network's sign-in page are their own sites, with their own cookie rules.

One page counter. Our own code adds no analytics; the sign-in provider's code keeps the analytics ID described under What stays in your browser. Our network provider adds its page counter to the pages of hormos.xyz and app.hormos.xyz as it serves them, so we can see how many visits each page gets. It uses no cookies. Our pages' security policy lets this one script load and report to the network provider. The app's policy also allows the network provider's human check (see What you type to the agent) and the sign-in provider's wallet frame and connections, and no other outside script.

Fewer permissions. Our pages tell your browser to switch off camera, microphone, location, payment, USB and interest-based ad topics for our sites. When you follow a link to another site, your browser shares at most our site's address, never the page you were on.

Who else handles data

Our hosting and network provider serves both sites, carries all traffic to our server, sends contact-form emails, counts form messages per address, runs the page counter and runs the human check in the app. It sees network addresses and requests in transit, and handles the human check under its own terms.
Our email provider holds the inbox that contact-form emails and messages to hello@hormos.xyz arrive in.
Our sign-in provider runs sign-in and makes and runs your trading wallet. It receives what is listed under Signing in and Your trading wallet: your social profile basics, or your sign-in wallet's address and sign-in message; your trading wallet's address and each request it signs; your network address and rough location; and your device and browser. It holds your trading wallet's key split and encrypted. Its service is hosted in the United States. Read its privacy policy.
The social network you sign in with confirms who you are to the sign-in provider and shares your basic profile, under its own terms.
A relay service carries encrypted messages between the page and a wallet app on your phone, if you sign in with one. It sees network addresses but cannot read the messages.
The trading venues you use receive what is listed under The trading venues, under their own terms.
Your wallet app, if you sign in with one, shows you the sign-in message and signs it on your device, under its own terms.

We do not sell data, share it for advertising, or pass it to anyone not listed here.

Your choices

Signing in is up to you; you can read and compare without it. Signing out, reloading or closing the page drops the trading keys.
Delete the site data for app.hormos.xyz in your browser to remove the theme, limits and pause items and the sign-in provider's items.
Email us directly instead of using the form, if you prefer.
Ask us what we hold about you, or ask us to delete it. In our sign-in provider's dashboard we can see your sign-in account and trading wallet address, and we delete them on request once we have checked the sign-in is yours. That deletes your trading wallet for good: signing in again gives you a new, empty one, so move any funds out first. Apart from that, an email you sent us is usually the only thing we can find.

Depending on where you live, the law may give you more rights over your data. Write to us and we will help.

Changes to this page

When what we collect changes, for example when orders move to main networks, we update this page and the date at the top.

Contact

Questions about your data, or a request to see or delete it, go to hello@hormos.xyz. A person on the team reads them and replies.