Privacy Policy

1. Information We Collect

TechMalak Inc., a Canadian corporation based in Kitchener, Ontario, Canada (corporation number 1132591-4), is responsible for the personal information described in this policy. "TechMalak", "we", "us" and "our" mean TechMalak Inc.

At TechMalak, we collect information that you directly provide and data seamlessly integrated via APIs, including:

• Account Information: Name, email address, password, avatar, location, bio, and UI preferences.
• Optional Demographic Information: If you choose to provide it, we may store a coarse age range and country to improve our anonymized business records. This is optional and is not collected automatically.
• Financial Exchange Data: Order history, execution times, trade sizes, PnL, portfolio balances, and asset allocations via read-only API connections to the exchanges you connect (Bitget today; others are shown as coming soon).
• Exchange API Credentials: Read-only API keys, secrets, and passphrases required to connect your exchange accounts. These are encrypted at rest using AES-256-GCM encryption and are never stored in plaintext.
• Linked Wallet Data: If you link a Hyperliquid or GMX wallet and prove you own it by signing a message, we read that address's public trading history (its trades and funding payments), store it with your account, and build your positions from it. Signing only proves ownership; we never ask you to approve a transaction or a token. If you paste a Hyperliquid address after signing in, we save the address with your account, marked as unverified, and show you a preview of its public trades; we don't import its trades unless you link that wallet and sign. For a Hyperliquid wallet you've linked and signed for, we also keep a copy of its own Hyperliquid history, as Hyperliquid serves it, and update it regularly: its orders (including cancelled ones), fills, TWAP orders and fills, funding payments, and deposits, withdrawals and transfers. Transfer and vault entries can include the other address involved. We keep it so your record stays after Hyperliquid stops serving older entries; we can't recover entries Hyperliquid had already stopped serving before our first copy. It's shown only to you, never to other users or on public pages, and it's in your data export. We never keep this copy for an address you only pasted.
• Behavioral & Psychological Data: Psychological assessment responses, profile classifications (e.g., cognitive style, risk tolerance, emotional regulation), behavioral observations generated by our AI engine, profile history snapshots, and disciplinary score histories.
• AI Chat Data: All conversations with TechMalak AI are stored, including your messages and AI responses. Chat sessions are retained for continuity and personalization.
• Engagement & Gamification Data: Interactions with training modules, XP events, level progression, trader archetype classifications, and achievement data.
• Browser Storage: We cache market data in your browser (IndexedDB) so pages load faster. What else we keep in your browser, and why, is described in Section 4 (Cookies And Similar Technologies).
• Anonymized Retention Records: When you delete your account, we generate a single anonymized summary row containing bucketed demographic and usage data (country, age range, archetype, engagement level, account lifetime, exchanges used). This row contains no information that identifies you and cannot be linked back to your account by any reasonable means. It is retained indefinitely for our internal business analytics.
• Security & Audit Logs: We maintain limited audit logs containing user ID, IP address, event type, severity, and event metadata to detect fraud, investigate security incidents, and prevent abuse. These logs are retained for up to 12 months and are accessed only when investigating a specific incident. When you delete your account, the direct identifiers (your user ID and IP address) are removed; only de-identified event records remain until the 12-month purge, as described in Sections 7 and 8.
• Hosting Request Logs: Like most websites, the services that run our site and backend (Netlify for the website, Supabase for our database and functions) automatically log each request they receive, including your IP address, the time and what was requested. These logs exist for security and to keep the service running. We look at them only for those reasons, never to build a profile of you or for advertising. They're deleted automatically: Supabase's after about 90 days, Netlify's after a limited time that Netlify sets.

2. How We Use Your Information

Our goal is to hold up a mirror to your trading psychology. We use your data securely to:

• Calculate metrics, win rates, and populate your personalized trading journal dashboard.
• Power our proprietary Behavioral Engine to deliver real-time psychological nudges (via Yahsuke, the AI coach) specifically triggered by your unique execution patterns.
• Personalize AI chat responses based on your psychological profile and trading history.
• Aggregate portfolio balances across your connected exchanges.
• Deliver curated news intelligence with AI-generated sentiment analysis.
• Maintain, debug, and secure the TechMalak platform infrastructure.

3. Third-Party Service Providers (Subprocessors)

We share data with the following providers only as needed to run TechMalak. We never sell your data, and we never share identifiable trading data for advertising.

• Supabase — database, authentication, file storage, and backend functions (hosted in Canada, ca-central-1). Its request logs include your IP address and are kept for about 90 days.
• Google (Gemini), OpenAI, and Anthropic — AI models powering chat, behavioral analysis, and news sentiment. We send only the content needed for the analysis, including the display name you chose for your profile — never your email or exchange credentials.
• CoinGecko and CoinMarketCap — cryptocurrency market and price data.
• Firecrawl — extracts the text of public news articles. We send article URLs only, never your personal data.
• OneSignal — delivers web push notifications; receives your user ID to register your device for push.
• OpenSea — read-only NFT market data.
• Reown / WalletConnect — the window you use to link a wallet, only if you choose to link one. When you open it, it loads from Reown's servers, which receive your IP address and can tell the request comes from TechMalak. When you connect a wallet, it asks Reown's servers about that wallet's network and balance, so Reown also receives the wallet's address. This happens whether or not you allow Analytics. We don't send Reown your name, email or trades.
• Netlify — website hosting. Like any web host, it logs each request, including your IP address, for a limited time.
• Cloudflare Turnstile — checks that a person, not a bot, is using our contact form when you are not signed in. It runs in your browser on that page only; we send Cloudflare nothing but the check's own result token.
• Upstash — short-lived counters that limit abuse of our services, such as our ad-arrival count, the AI chat and the contact form. A counter can include your IP address or account ID, and it expires on its own (after about 10 minutes for the ad-arrival count). Upstash also holds a 24-hour cache of public Hyperliquid wallet reads, filed under a hash of the address.
• Resend — delivers email: your account emails (such as sign-up confirmation and password reset), the messages you send us through the contact and feedback forms (with the name and email you give), and any behavioral digest emails we send you.
• Railway — hosts our market-data collector, the job that keeps the copy of Hyperliquid history for wallets you've linked and signed for (see Linked Wallet Data in Section 1), and our internal admin tools, which read account data so we can support you and keep the service secure.
• Google Analytics — only if you allow it. Google Analytics is not loaded at all until you choose Accept All (or switch Analytics on and save). With your consent, it collects aggregate usage statistics (pages visited, device type, approximate region), and it also records on its own when you scroll to near the end of a page, click a link to another website, start or send a form (only which page it's on and the label on its button, never what you type in it), and, where a page has them, play an embedded video or download a file, so we can see which pages help traders and improve the rest. We never send it your name, email, trades, wallet address or behavioral data, and we don't use it for advertising. If you say no, or don't choose, it never loads and nothing is sent to Google.
• Sentry — error reports, so we can find and fix what breaks. A report describes the error and the page; we don't put your name, email, cookies or request contents in it, and values that look like secrets, such as keys or tokens, are removed before it leaves your browser. Like any web request, Sentry's servers see your IP address when a report arrives, and we've told Sentry not to store it. Only with your consent to Analytics does Sentry also receive performance timings and a count of page visits.
• PostHog — only if you allow Analytics. PostHog is not loaded at all until you choose Accept All (or switch Analytics on and save). With your consent, it records the steps people take as they arrive, sign up and get started (for example, the page you landed on and which ad, link or site brought you there, whether you pasted an address and the read appeared, whether you signed up, and whether you linked a wallet, connected an exchange or imported trades), along with your browser, device type and screen size, so we can see where people get stuck. These records are tied only to a random ID in your browser, never to your account: they never include your name, email, wallet addresses, anything you type, your trades or your balances. PostHog does not record replays of your visit. Like any web request, PostHog's servers see your IP address; we've told PostHog not to store it. If you say no, or don't choose, PostHog never loads and nothing is sent to it.
• On our blog, if you allow Analytics, Google Analytics also counts the pages you view, and on Data Desk posts Google Analytics and PostHog record how far you read, which charts came into view, which buttons you pressed on the dashboard at the top, and whether you clicked our sign-up button. They never receive anything you type, or anything from your wallets or exchanges. Your choice in the app's cookie banner covers the blog too; withdrawing it in Cookie Settings stops both from the next page you open.
• X (Twitter) advertising pixel — only if you allow Analytics. X's pixel is not loaded at all until you choose Accept All (or switch Analytics on and save). With your consent, it tells X when a page on our site is visited, an address is pasted or an account is created, with basic browser details such as time zone, language and screen size, so we can measure which of our ads on X lead to sign-ups. We tell the pixel to leave out the page's address and the page you came from, and we switch off its automatic reading of forms, so X never gets your name, email, phone number, wallet address, anything you type, your trades or your account details. Like any web request, X's servers see your IP address, and X handles what it receives under its own privacy policy. If you're signed in to X in the same browser, X can connect these steps to your X account; that's how it tells which ad you saw. If you say no, or don't choose, it never loads and nothing is sent to X; if you withdraw, it stops and its cookies are removed from our site.
• Hyperliquid and GMX — public market and wallet data. The leverage calculator and the charts and live prices on Yahsuke's desk read Hyperliquid's public market data (prices and price candles) straight from your browser; these requests carry no wallet address. The free preview on our homepage does too, for the address you paste: your browser reads that address's public trades, funding and account figures (such as its profit and loss over set periods and its account value) from Hyperliquid. For an active address, your browser may keep reading further back in time, one request after another, while the preview is open, until it reaches our limit or you press Stop Here. We don't receive the address you paste into the free preview: your browser asks Hyperliquid directly. When you paste an address after signing in, or link a Hyperliquid or GMX wallet, our servers read that address's public history. For a Hyperliquid address you paste after signing in, they also read its account figures (such as its account value). If our read service is busy, your browser reads a pasted address from Hyperliquid directly. Whenever your browser contacts Hyperliquid, Hyperliquid sees your IP address, like any web request, and the address if you pasted one.
• Sanity — hosts our blog articles and the images on our blog and on some /news stories. Your browser loads those images from Sanity's servers, which, like any web request, see your IP address.
• Cryptocurrency exchanges you connect (Bitget today; others are shown as coming soon) — we use your read-only API keys to import trade history. Keys are encrypted (AES-256-GCM) and are never used to trade or move funds.

We require these providers to protect your data and use it only to deliver the service. We do not sell, rent, or trade your personal information to any third party for marketing or commercial purposes.

4. Cookies And Similar Technologies

We use two kinds of storage on your device:

• Strictly necessary — always on. These keep you signed in, remember your cookie choice and the settings you pick (such as language, time zone and which guided tours you have seen), and stop bots on our contact form (Cloudflare Turnstile). If you arrive from one of our ads, this browser tab keeps a note of which sign-up the ad offered, so we can show it to you. The note holds no campaign details and ends when you close the tab. If you close the cookie banner with ×, the tab also notes that you'll decide later, so we don't ask on every page; that note ends when you close the tab too. If you sign up, your account notes which sign-up path you used, so the right first steps follow you to any device. None of these are used to track you across other sites.
• Analytics — off unless you turn it on: Google Analytics, PostHog and X's advertising pixel, as described above (PostHog keeps a random ID in your browser's storage; X's pixel may set its own cookies); Sentry's performance timings and visit counts; and, if you arrived from one of our ads, a record of which ad it was (source, campaign and the page you landed on), kept on your device and added to your account when you sign up so we can tell which ads bring people who stay.

We ask for your choice on your first visit. Reject All is as easy as Accept All. Nothing optional runs before you choose, with the one exception described next. Closing the banner with × decides nothing: nothing optional runs, we stop asking while that tab stays open, and we ask again on your next visit.

Two things run before you choose, and neither uses cookies.

A count of arrivals from our ads. When you arrive from one of our ads, your browser tells our own server which ad it was, whether you are on a phone or a computer, whether you opened it in an app's built-in browser, whether the link carried X's click marker (never the marker itself), and whether the page stayed open for 3 seconds and for 10 seconds. Nothing is stored on your device for it. Each page load gets its own random code, made in your browser, so one visit can't be counted twice and its 3- and 10-second checks are matched to the right arrival. The code changes on every page load and isn't linked to your account or to anything else we keep. We delete each arrival record after 90 days. We never store your IP address for it: a keyed hash of it serves as a short-lived limit against abuse (about 10 minutes), and it is never saved with the count.

Daily totals of the steps people take. This runs for every visitor, whether you say yes or no. When you reach a step (arriving, pasting an address and whether it was valid, whether the free preview appeared, opening the sign-up page, starting to sign in, signing up, linking a wallet, connecting an exchange or finishing an import), your browser adds one to that day's total for that step, the kind of page (such as the homepage or the sign-up page) and, for the steps up to starting to sign in, which of our ads brought you, if any. If a pasted address isn't valid, your browser also adds one to the total for the kind of problem, such as a shortened address. The counter never sends what you pasted. A total counts steps, not people: doing a step twice counts twice, except pressing “See my read” with nothing in the box, which counts once each time the page is opened. Nothing is stored on your device for it, it carries no identifier, it records the day but not the time, and it is never tied to your account, even when you are signed in. We don't store your IP address for it. On our blog's Data Desk posts, your browser also adds one, at most once each time a post is opened, for: opening it; reading a quarter, half, three quarters or all of it; the dashboard or each chart coming into view; and clicking our sign-up button. These totals also record which of our ads brought you, if any, but say only “a Data Desk post”, never which post you read.

Like any web request, both are seen by our hosting providers' request logs, which include your IP address (see Section 1).

You can change or withdraw your choice at any time from Cookie Settings in the footer of our pages, or here: Cookie Settings. Withdrawing stops future collection and removes the analytics cookies and the ad record from your device; it doesn't affect use made before you withdrew. We keep a record of your choice (what you chose and when, no other personal details) to show we asked: on your device if you are not signed in, and with your account if you are, until you delete it. We ask again after 12 months, or sooner if we add a new kind of storage.

The only advertising pixel we use is X's, and only if you allow Analytics. We don't use any other advertising or social-media tracking cookies.

5. AI Profiling & Automated Analysis

TechMalak uses AI-powered automated profiling to analyze your trading behavior. This includes:

• Classifying your trader archetype based on psychological assessment responses.
• Detecting behavioral patterns such as revenge trading, stop-loss modifications, and emotional decision-making.
• Generating behavioral insights, trader stats, and AI coaching feedback based on your trading activity.
• Providing personalized coaching nudges based on your behavioral patterns.
• Status badges (optional): if you turn on Status Badges in Settings, we read your own Hyperliquid perp account value across all your perp markets (including HIP-3 markets other teams list on Hyperliquid) and how your orders fill (resting or immediate, and how often) to award badges such as Whale, Big Fish or Market Maker.

Status badges are off unless you turn them on, are shown only to you, and are never shown on public pages or to other users. You can turn them off at any time in Settings → Display & Privacy; we then stop reading your data for badges and delete the badges we stored. XP already awarded stays. The free preview shows public facts about any Hyperliquid address, such as its perp account value; it never shows a badge. A badge records the date it was earned and is not a statement about your current account.

These automated analyses are advisory only and do not result in any decisions that produce legal or similarly significant effects. You may contact us to request human review of any automated assessment.

You can opt out of behavioral analysis at any time — see “Your Rights & Data Control.”

6. Data Aggregation And Anonymization

We may aggregate and anonymize trading and behavioral data for analytical refinement and to improve our behavioral models. Any such aggregated data is stripped of all personally identifiable information and cannot be tied back to your specific exchange account or identity.

7. Data Security & Storage

• Encryption at Rest: Exchange API credentials are encrypted using AES-256-GCM before storage. All other data is stored in Supabase with platform-level encryption.
• Encryption in Transit: All data transmitted between your browser and our servers uses HTTPS/TLS encryption.
• Access Control: Row-level security policies ensure that each user can only access their own data. Administrative access is restricted to essential platform operations.
• Read-Only API Keys: We only accept read-only exchange API keys. We never request trading or withdrawal permissions.

While we implement rigorous security measures, no system is completely immune to all threats. You agree to utilize our service with an understanding of this inherent risk.

8. Data Retention

We retain your data for as long as your account is active. Specifically:

• Account & Profile Data: Retained until you delete your account.
• Trade History: Retained until you delete your account or manually remove trades.
• Hyperliquid Wallet History Copy: Retained until you disconnect that wallet or delete your account, at which point it is permanently deleted.
• AI Chat History: Retained until you delete your account.
• Behavioral Profiles: Retained with historical snapshots until you delete your account.
• Exchange Credentials: Retained until you disconnect the exchange or delete your account, at which point they are permanently destroyed.
• Anonymized Retention Records: Retained indefinitely after account deletion. Cannot be linked back to you. See Section 9 for details.
• Analytics Records (PostHog): kept for up to 12 months, then deleted automatically. Because they aren't linked to your account, we can't look them up per person; withdrawing consent in Cookie Settings removes the random ID from your browser.
• Security Audit Logs: We keep de-identified security event metadata for up to 12 months for fraud detection and incident investigation, after which it is automatically deleted. When you delete your account, we remove the direct identifiers (your user ID and IP address) from these logs at deletion, keeping only de-identified event records.
• Hosting Request Logs (Supabase, Netlify): kept by those providers for a limited time (about 90 days at Supabase), then deleted automatically. We can't remove single entries, so they aren't erased when you delete your account; they expire on schedule.

9. Your Rights & Data Control

You have the following rights regarding your personal data:

• Right to Access & Export: You can download a complete copy of your data at any time from Settings. It is generated on our servers and covers every record we hold that is linked to you — your profile, trades, positions, connected wallets, behavioral assessments and history, chat history, gamification progress, imports, and saved reports. For your security, platform secrets are redacted (exchange API keys and wallet signatures). Purely operational and security records that are not your personal data — such as rate-limit counters and security audit logs — are not included, and the export documents what it leaves out. The export either completes in full or fails visibly; we never hand you a partial file described as complete.
• Right to Rectification: You can update or correct your personal information through your profile settings.
• Control over behavioral analysis: You can turn behavioral analysis on or off at any time in Settings → Privacy. While it is off, we stop generating and storing new behavioral observations and psychological insights from your activity. Insights already generated remain until you delete your account; to remove them, delete your account (see Right to Erasure).
• Right to Erasure: You can request deletion of your account from Settings. When you delete your account, we permanently remove every piece of information that identifies you — your name, email, exchange credentials, chat history, trade details, behavioral assessments, and personal profile. We retain a separate anonymized summary of platform usage (such as country, age range, account lifetime, engagement level, and trader archetype) for our internal business records. This summary cannot be linked back to you by any reasonable means. Separately, any messages you sent us through the contact form and any feedback you submitted in-app are retained after deletion with your name, email, and account link removed — we keep the substance of what you told us for our business records, but can no longer tie it to you. Deletion of your identifying information is irreversible. Our security audit logs keep only de-identified event metadata — your user ID and IP address are removed at the time of deletion — and that metadata is automatically purged after 12 months. Your IP address may stay in our hosting providers' request logs until they expire (see Section 8).
• Right to Data Portability: Your exported data is provided in standard JSON format for easy portability.
• Right to withdraw consent: You can withdraw consent to analytics at any time from Cookie Settings in the footer, as easily as you gave it.
• Right to Object: You may object to automated profiling by contacting us at info@techmalak.com.

10. International Data Transfers

Your data may be processed in jurisdictions outside your country of residence. Specifically: our database infrastructure (Supabase) is hosted in Canada (ca-central-1 region). Our AI model providers, and the other services named in Section 3 (such as Sentry, PostHog, X, Upstash, Resend, Railway, Netlify, Google and Cloudflare), may process data in the United States or elsewhere. We ensure appropriate safeguards are in place for all international data transfers in accordance with applicable data protection laws.

11. Age Restrictions

TechMalak is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately at info@techmalak.com and we will promptly delete such information.

12. Changes To This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you via email or through a prominent notice within the platform at least 30 days before the changes take effect. Your continued use of TechMalak after the effective date constitutes acceptance of the updated policy.

13. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Province of Ontario, Canada, and the federal laws of Canada applicable therein. Any disputes arising from this policy shall be resolved in accordance with our Terms of Service.

If you live in Quebec, the Act respecting the protection of personal information in the private sector (Law 25) also protects your personal information. If you live in the European Union or the United Kingdom, the GDPR or UK GDPR applies. We apply the same choices and protections to everyone, wherever you are. The person in charge of the protection of personal information at TechMalak is Matthew Barnes, Founder & CEO, reachable at info@techmalak.com.

14. Contact Us

If you have questions about this Privacy Policy, wish to exercise any of your data rights, or need to report a privacy concern, please visit our Contact Us page via the side menu or email us directly at info@techmalak.com.

TechMalak Inc. · Kitchener, Ontario, Canada · info@techmalak.com