> ## Documentation index
> Fetch the complete documentation index at: https://hypertake.net/llms.txt
> Use this file to discover all available pages before exploring further.

# What Hypertake stores

> Exactly what Hypertake's server keeps and for how long, the cookies it sets, what stays in your browser and which third parties it talks to

Source: https://hypertake.net/docs/security/what-we-store · Last updated: 2026-10-17

**Hypertake keeps no name, email, ID or password, and runs no analytics or trackers.** Its server stores your wallet address and a 30-day sign-in session for notifications, your notification history for 90 days and, only if you turn on push alerts, your device's push subscription.

## On Hypertake's server

| What | Why | Kept for |
| --- | --- | --- |
| **Session**: a random id in an httpOnly cookie (`ht_session`), linked to your address and the time you signed in | Keeps you signed in for notifications | 30 days |
| **Sign-in challenge** (nonce) | Makes each sign-in message single-use | 5 minutes |
| **Wallets**: each address that has signed in, with its first and latest sign-in times | Knowing which addresses have signed in | No expiry is set |
| **Notifications**: the alerts sent to a wallet | Your in-app notification history | 90 days |
| **Push subscription**, only if you turn push alerts on: your browser's push address and keys, the wallet it follows, your alert switches, your browser's user agent (first 200 characters), timestamps and a failure count | Sending alerts to your device | Until you turn alerts off or disconnect |
| **Alert de-duplication** keys | So the same alert isn't sent twice | 14 days |
| **Online count**: a random visitor id per browser | The number of people online, shown in the status bar | Dropped 75 seconds after your browser goes quiet |

For push alerts, the server watches the wallet your device follows on Hyperliquid (fills, deposits and withdrawals, holdings and perps positions), which is public data. It keeps the list of followed addresses for that purpose. It also caches public market data (the markets snapshot and the trade feed), which isn't about you.

## Cookies

| Cookie | What it holds | Why |
| --- | --- | --- |
| `ht_session` | A random session id (httpOnly, set after sign-in) | Notifications for your wallet; 30 days |
| `ht_wallet` | The address you last connected | So the home page sends you to the markets, and the header appears as you left it |
| `ht_figures` | Your last balance and available amount | So the header shows them before your wallet reconnects |
| `ht_onetap`, `ht_npos`, `ht_charth` | Whether one-tap trading was on, how many positions you had, the chart's height | So pages load without jumping |
| `ht_surface`, `ht_activity`, `ht_activity_tab`, `ht_flow_win` | Phone or desktop layout, the right panel's state | Layout preferences |

_Hypertake's own cookies last a year (SameSite=Lax), except the 30-day session. The wallet and balance cookies are cleared when you disconnect._

## In your browser only

Some things stay on your device and are never sent to Hypertake: the **trading key** (encrypted in IndexedDB; see [The trading key](https://hypertake.net/docs/security/trading-key.md)), which wallet you connected with, this browser's key-name id, the visitor id, your settings (theme, markets you hide, perps testnet) and a cache of settled market names. Clearing this site's data removes them all, including the trading key.

## What isn't collected

- **No identity.** No email, name, date of birth, ID document or KYC. Your account is your wallet address.
- **No analytics or trackers.** The web app loads no analytics, advertising or error-tracking scripts.
- **No font or CDN calls.** Fonts are served from Hypertake's own server.
- **No access logs configured.** Neither Hypertake's web server configuration nor its API sets up request logging.

> **Note**
> Hypertake's API also contains endpoints for email accounts and product events that the app as shipped doesn't call. Like any website, Hypertake's server and its hosting network see your IP address when your browser connects.

## Third parties your browser talks to

Hypertake's pages connect your browser directly to these services. Each sees your IP address, and some see your wallet address, under its own privacy terms.

| Service | What for | Sees your address? |
| --- | --- | --- |
| **Hyperliquid** (`api.hyperliquid.xyz`, REST and WebSocket) | Market data, your account, your orders | Yes |
| **Relay** (`api.relay.link`) | Deposit quotes and status, your deposit history | Yes |
| **Arbitrum public RPCs** (`arb1.arbitrum.io`, `arbitrum-one-rpc.publicnode.com`) | Your USDC and ETH balances on Arbitrum | Yes |
| **WalletConnect relay** (Reown) | Only if you connect with WalletConnect | Yes |
| **Coinbase Wallet SDK** | Only if you choose Coinbase Wallet | Yes |
| **Polymarket**'s public API | The crowd's odds shown beside some crypto markets (read-only) | No |
| **Your browser's push service** (Apple, Google or Mozilla) | Only if push alerts are on | No; it delivers alerts to your device |

> **Info: The Privacy Policy**
> This page describes what the code does as of 2026-10-17. The formal commitments, legal bases and your rights are in our [Privacy Policy](https://hypertake.net/privacy).

- [Self-custody](https://hypertake.net/docs/security/self-custody.md): Why there's no account to hold your details.
- [Phone app](https://hypertake.net/docs/phone-app.md): Push alerts: what they are and how to turn them on.