Privacy Policy

Effective date: 24 October 2026

This Privacy Policy explains what happens to your information when you use Graphite: the application at app.graphite.trade, on the web and on any device it is released for (the “App”), and the website at graphite.trade (the “Site”), together the “Service”. Graphite is published by its developer, reachable at tradegraphite@gmail.com (“Graphite”, “we”, “us”), who is the controller of the personal data described here.

The short version: charting with no account, nothing about you reaches us. With a Graphite account, we keep your email address, the devices you sign in from, and the watchlists, drawings and settings you make, in the European Union, until you delete it. Trading goes from your device to Hyperliquid, not through us: we never receive your trading key, and your Graphite account does not record your wallet address. On the Site, we count page views without cookies and without identifying you. We use no advertising and no trackers, and we sell nothing to anyone.

1. Charting with no account

The App works with no account and no wallet, and then it keeps nothing about you. It stores its preferences in your browser’s storage or your device’s app storage — theme, language, timezone, the market and interval you last used, your panels and chart settings — and none of them is sent to Graphite. Your device makes requests to:

• Hyperliquid, whose public API answers with prices and candles. Hyperliquid sees your IP address and technical details of your connection, under its own privacy policy. Graphite is not in the middle and receives no copy.
• Our host, Cloudflare, which serves the App’s files and the list of markets. Like any web host, it receives your IP address, the address requested, your browser’s user agent and similar technical data for every request, and uses them to serve the request, to protect against abuse and for its own operational logging.

2. Trading

Trading needs a wallet, not a Graphite account. When you trade, the App keeps on your device, and nowhere else:

• Session: the wallet address the App is trading for.
• Agent key: the private key of the agent wallet that signs your orders, in the platform’s secure storage where one exists. It is never sent to Graphite. See the Terms of Use, section 5.
• Consent: the effective date of the Terms of Use and Privacy Policy accepted on this device.
• Device identifiers: a random identifier for this install, and the tag that names its agent on Hyperliquid.

Hyperliquid. The App talks to Hyperliquid’s public API directly from your device. To show your account and place orders it sends Hyperliquid your wallet address, your orders and their signatures, and the approvals you sign. Hyperliquid also sees your IP address and technical details of your connection. Its own privacy policy describes what it does with them. Hyperliquid is the exchange you trade on, not a processor of ours: nothing passes through a Graphite server, and we receive no copy.

Your wallet. When you connect a wallet or sign an approval, the request goes from the App to your wallet software. On the web it stays on your device. In the Android App it travels through the WalletConnect relay run by Reown, encrypted end to end so that Reown cannot read it; Reown sees your device’s IP address and that the request comes from Graphite. Your wallet provider’s privacy policy governs what it does with the request, and Reown’s what it does with what it sees.

Device linking. When you link a second device, the first one encodes your wallet address and agent key into a QR code, encrypted with a PIN. The code travels only in the image and the link it opens; it is not uploaded anywhere. Anyone who obtains both the code and the PIN can decode it, so treat them as secrets.

Public blockchain data. Hyperliquid is a public blockchain. Your wallet address, your orders, fills, positions, deposits and withdrawals, the approvals you sign and the names of your agents are recorded on it and can be read by anyone, permanently. The App reads that public record to build your journal, positions and portfolio; it does not create it and cannot remove it.

3. With a Graphite account

An account exists so that what you make in the App follows you across devices. To provide it we process:

• Identity: your email address, the way you sign in (password, sign-in link or Google), the identifier your sign-in provider gives you, and the time of your sign-ins. A password is stored hashed by our identity provider; we never see it. Signing in with Google gives us your email address and Google account identifier and nothing else from your Google account.
• Devices: for each browser or device signed in, its random identifier, its platform, when it was last seen and, if it trades, the tag that names its agent on Hyperliquid, so that the account screen can list your devices and you can sign one out. A device’s record is removed when it signs out.
• What you make: your watchlists and their symbols, your drawings and their positions on each chart, and your settings — chart settings, layout, the mode you use, and your trading defaults such as default risk, stop and target distances and slippage — each with the time it was last changed, so that your devices agree on the newest version.
• Preferences and acceptance: your language, your timezone, and the effective date of the Terms of Use and Privacy Policy you accepted.

The account does not hold your wallet address, your agent key, your orders, positions, balances or trading results. Note, though, that an agent’s tag is part of its name on Hyperliquid, which is public: someone holding both your account’s device list and Hyperliquid’s public record could match the two. We do not do so.

We use this data to run the account and nothing else: to sync your data between your devices, to send you the emails an account needs (a sign-in link, a password reset), and to show you your devices. We do not profile you, we do not send marketing, and we do not share or sell your data.

4. Crash reports, usage and audience measurement

To find what breaks and what is used, the App may send us:

• Crash reports: when something fails, the error, where in the code it happened, the App’s version, your platform and browser, and the screen you were on.
• Usage measurement: which screens and features are used, and how often, whether the App runs on the web or on Android, and where the App was opened from: the channel its link names (such as ?ref=x), or else the site that sent your browser to it, by its name only, counted under a random identifier that exists for this purpose only.

Neither carries your email address, your wallet address, your orders, your keys, your drawings or the contents of your watchlists, and neither is linked to your Graphite account or to your wallet. They are used for statistics about the App, never to single you out, and are not shared with anyone for their own purposes. You can turn each of them off in the App’s settings. Crash reports are kept for at most ninety days, usage measurement for at most twenty-five months.

Site audience measurement. On the Site, Cloudflare Web Analytics counts page views. For each one it records the page, the page you came from, your browser type, your country as derived from your IP address (the IP address itself is not kept), and how fast the page loaded. It sets no cookie, stores nothing on your device and does not fingerprint you, so it cannot tell one visitor from another or follow you elsewhere, and it is not linked to the App, to a Graphite account or to a wallet. We see only totals, for at most six months. A content blocker stops it.

5. Legal basis

• The account, and everything in section 3, rest on the contract between you and Graphite that the Terms of Use describe (Article 6(1)(b) GDPR).
• Security logging, crash reports, usage measurement and the Site’s audience measurement rest on our legitimate interest in keeping the Service working, safe and improving (Article 6(1)(f)), limited as described in section 4 and open to objection at any time.
• Recording your acceptance of the Terms rests on our legal obligation and legitimate interest in being able to show it.

6. Who processes it for us

We run no servers of our own. The processors below act on our instructions, under contracts that bind them to the GDPR, and each publishes its own privacy policy.

• Cloudflare hosts the App and the Site, runs the App’s backend, measures the Site’s audience, and stores every account row in a database placed in the European Union. Its edge logs carry IP addresses and request details for a short time, for security and operations.
• Google Firebase is our identity provider: Firebase Authentication holds your email address, hashed password or Google identifier and sign-in history, sends the sign-in and password-reset emails, and verifies who you are. Crash reports and usage measurement, where they are not collected by our own backend at Cloudflare, go to Firebase as well. Google may process this data outside the European Union, under Google’s data processing terms and the European Commission’s standard contractual clauses.

Hyperliquid, your wallet provider, Reown for the WalletConnect relay in the Android App, Google Play for installing and updating the Android App and, if you sign in with it, Google as your sign-in account act as independent parties under their own policies, not as our processors. Nobody else receives your data. We will disclose it only if the law requires us to, and then no more than the law requires.

7. Where it lives and for how long

Account data is stored in the European Union and kept for as long as your account exists. When you delete your account, every row it holds — identity, devices, watchlists, drawings, settings, acceptance — and your record at our identity provider are removed at once, and nothing is kept. An account unused for two years may be deleted in the same way. Backups of the database, where our host keeps them, expire within thirty days.

What the App keeps on your device stays there until you clear the site’s data, uninstall the App, or use the App’s own actions: signing out of Graphite removes the account’s synced copy and this device’s record; stopping this device trading removes its agent key; disconnecting the wallet removes the session.

8. Your rights

You can see and change what the account holds from inside the App: your watchlists, drawings and settings are yours to edit or remove, your devices can be signed out, and the account can be deleted from the account screen. For anything else — access to the data we hold about you, its correction, its erasure, a copy of it in a portable form, a restriction of or objection to its processing — write to the address below. We answer within a month.

What sits on the public blockchain, at Hyperliquid or at your wallet provider is theirs and not ours; exercise your rights over it with them.

If you are in the European Economic Area, the United Kingdom or Switzerland, you also have the right to lodge a complaint with your supervisory authority. In France that is the CNIL.

9. Cookies and local storage

The Service uses no advertising cookie, no tracking cookie and no third-party cookie, and loads no fonts or scripts from anyone else, except, on the Site, the measurement script of our host, Cloudflare (section 4). What the App keeps in your browser’s or device’s storage is described in sections 1 and 2; signed in, our identity provider also keeps your session token there so that you stay signed in, and the App keeps a copy of your account data so that it opens at once and works offline. Signing out removes both.

10. Children

The Service is not directed at anyone under 18, and we do not knowingly collect information from children. If you are under 18, do not use it. If you believe a child has created an account, write to us and we will delete it.

11. Changes to this Policy

We may update this Policy when the Service changes. The effective date at the top changes when we do, and the App asks you to accept the new version before you can trade again. A change that widens what we collect or why is announced in the App before it takes effect. The current Policy is always available in the App and at app.graphite.trade/privacy.

12. Contact

Questions about this Policy, or a request under section 8: tradegraphite@gmail.com.