Hypertake is an independent web interface for Hyperliquid's HIP-4 prediction markets (outcomes) and perpetual futures. You connect your own wallet; every order is placed, matched and settled on Hyperliquid, and your money stays in your own Hyperliquid account. Hypertake is not affiliated with or endorsed by Hyperliquid. Markdown of this page: https://hypertake.net/docs/security/what-we-store.md. Full documentation index: https://hypertake.net/llms.txt
Security · Privacy
What Hypertake stores
Exactly what Hypertake's server keeps and for how long, the cookies it sets, what stays in your browser and which third parties it talks to
Hypertake keeps no name, email, ID or password, and runs no analytics or trackers. Its server stores your wallet address and a 30-day sign-in session for notifications, your notification history for 90 days and, only if you turn on push alerts, your device's push subscription.
On Hypertake's server
| What | Why | Kept for |
|---|---|---|
Session: a random id in an httpOnly cookie (ht_session), linked to your address and the time you signed in | Keeps you signed in for notifications | 30 days |
| Sign-in challenge (nonce) | Makes each sign-in message single-use | 5 minutes |
| Wallets: each address that has signed in, with its first and latest sign-in times | Knowing which addresses have signed in | No expiry is set |
| Notifications: the alerts sent to a wallet | Your in-app notification history | 90 days |
| Push subscription, only if you turn push alerts on: your browser's push address and keys, the wallet it follows, your alert switches, your browser's user agent (first 200 characters), timestamps and a failure count | Sending alerts to your device | Until you turn alerts off or disconnect |
| Alert de-duplication keys | So the same alert isn't sent twice | 14 days |
| Online count: a random visitor id per browser | The number of people online, shown in the status bar | Dropped 75 seconds after your browser goes quiet |
For push alerts, the server watches the wallet your device follows on Hyperliquid (fills, deposits and withdrawals, holdings and perps positions), which is public data. It keeps the list of followed addresses for that purpose. It also caches public market data (the markets snapshot and the trade feed), which isn't about you.
Cookies
| Cookie | What it holds | Why |
|---|---|---|
ht_session | A random session id (httpOnly, set after sign-in) | Notifications for your wallet; 30 days |
ht_wallet | The address you last connected | So the home page sends you to the markets, and the header appears as you left it |
ht_figures | Your last balance and available amount | So the header shows them before your wallet reconnects |
ht_onetap, ht_npos, ht_charth | Whether one-tap trading was on, how many positions you had, the chart's height | So pages load without jumping |
ht_surface, ht_activity, ht_activity_tab, ht_flow_win | Phone or desktop layout, the right panel's state | Layout preferences |
In your browser only
Some things stay on your device and are never sent to Hypertake: the trading key (encrypted in IndexedDB; see The trading key), which wallet you connected with, this browser's key-name id, the visitor id, your settings (theme, markets you hide, perps testnet) and a cache of settled market names. Clearing this site's data removes them all, including the trading key.
What isn't collected
- No identity. No email, name, date of birth, ID document or KYC. Your account is your wallet address.
- No analytics or trackers. The web app loads no analytics, advertising or error-tracking scripts.
- No font or CDN calls. Fonts are served from Hypertake's own server.
- No access logs configured. Neither Hypertake's web server configuration nor its API sets up request logging.
Third parties your browser talks to
Hypertake's pages connect your browser directly to these services. Each sees your IP address, and some see your wallet address, under its own privacy terms.
| Service | What for | Sees your address? |
|---|---|---|
Hyperliquid (api.hyperliquid.xyz, REST and WebSocket) | Market data, your account, your orders | Yes |
Relay (api.relay.link) | Deposit quotes and status, your deposit history | Yes |
Arbitrum public RPCs (arb1.arbitrum.io, arbitrum-one-rpc.publicnode.com) | Your USDC and ETH balances on Arbitrum | Yes |
| WalletConnect relay (Reown) | Only if you connect with WalletConnect | Yes |
| Coinbase Wallet SDK | Only if you choose Coinbase Wallet | Yes |
| Polymarket's public API | The crowd's odds shown beside some crypto markets (read-only) | No |
| Your browser's push service (Apple, Google or Mozilla) | Only if push alerts are on | No; it delivers alerts to your device |
Last updated