Privacy

Last updated 15 October 2026

Halyx is an interface for trading on Arcus and Hyperliquid. This page says what the site and the app handle about you. The venues have their own privacy practices, and your wallet provider does too.

What we have

• Wallet address and the signature you use to sign in. That starts a session. The session is an HttpOnly cookie.
• Invite, if you used a code to get in. That is a separate cookie.
• Trade-only keys for bots. The server generates them, stores them encrypted, and they cannot withdraw. You can revoke them.
• Referrals: your referral code, who referred you and whom you referred, and the 30-day volume of referred accounts through Halyx, read from Hyperliquid's public data. It sets your fee discount. Referred accounts appear to their referrer only as a shortened address.
• Bot and algo settings and results: the markets you picked, sizes, fills, fees and the campaign record. This is what the bots page shows you.
• IP address, to apply the regional block below and to limit repeated sign-in and invite attempts. The web server keeps ordinary request logs.

The trade-only keys you turn on in the app are made in your browser and stay in its storage, encrypted with a key that can't leave it. Link mobile is the one exception: it hands them to your phone in the QR link's fragment (the part after #), which browsers don't send to any server. The bots sign-in rides along as a one-time code that expires within minutes.

We do not ask for your name, email or identity documents. We do not hold your funds. We do not sell data, and we do not run advertising or third-party analytics.

Regional block

Halyx is not offered in the United States and its territories, Canada, the United Kingdom, Cuba, Iran, North Korea, Syria, or the regions of Crimea, Donetsk and Luhansk. That is the same set of places Hyperliquid and Arcus restrict, taken together. Canada is included as a whole because Arcus restricts Canada, which covers Ontario, the province Hyperliquid names.

Cloudflare tells our server the country of the connection, and the region when that header is present. We use it to refuse the site, the app and the API from those places. We do not build a location history from it. The Terms of Use explain who counts as restricted. Getting around the block with a VPN breaks the terms.

Who else sees data

• Arcus and Hyperliquid receive the orders, keys and account activity you send them. Their systems hold your positions and fills.
• Your wallet sees the messages it asks you to sign. Halyx does not see your seed phrase.
• Cloudflare proxies the sites and provides the country and region used for the block.
• Amazon Web Services hosts the app and the bot server.

Cookies

Two cookies, both there so the product works: the sign-in session, and the invite pass. There are no tracking cookies.

How long

A session ends when you sign out or it expires. Bot keys stay until you revoke them. A campaign and its runs stay until you delete them. Server logs rotate on the host. Invite redemptions are kept so a code cannot be reused past its limit.

Your choices

Disconnect the wallet, sign out, revoke a key, and delete a campaign from the app. Those remove the access and the records those actions cover. Traffic logs and the venue's own records are separate.

Changes

If this page changes, the date at the top changes with it.

Questions: @Halyxxyz on X.