Privacy Policy

In effect from October 31, 2026.

1. Who is responsible

Ismat Samadov, an individual based in the Republic of Azerbaijan, runs Candylario and is responsible for your data. Write to ismat.samadov@candy.surf about it.

2. What we keep

• Account: your email address, a hash of your password (never the password itself), whether your address is confirmed, and delivery problems reported for it.
• Telegram: if you connect a chat, its chat ID and your display name.
• Wallet: once you connect one, your account's address, the agent wallet's key (encrypted) and the trades you place through Candylario.
• Technical: server logs with IP addresses and requests, kept for security for up to 30 days.

3. Why

To send you alerts, place the trades you ask for, keep the service and your account safe, and send you account emails (address confirmation, password resets and security notices). We show no ads and sell no data.

4. Who else handles it

• Hetzner Online (Germany): our servers and backups.
• Mailjet (European Union): account emails.
• Telegram: messages to the chats you connect.
• Hyperliquid: the orders you place and account queries. Hyperliquid is a public blockchain, so your address and its trades are public there by nature.
• UptimeRobot: checks that the site is up; it sees no personal data.

5. How long

As long as your account exists. When you delete it, we delete your email, password and sessions, erase any wallet key we hold for you and disconnect your Telegram chats. Encrypted backups are deleted within 30 days.

6. Security

Wallet keys are encrypted at rest and decrypted only inside the trading engine, never by the website. Every connection uses HTTPS, and access to our servers is restricted.

7. Your rights

You can see, correct, export or delete your data, and object to how we use it. Delete your account in Settings, or write to us for anything else; we answer within 30 days. If you live in the European Union, you can also complain to your data protection authority.

8. Cookies

We use only a cookie that keeps you logged in and a short-lived one that carries a message to the next page. There are no tracking or analytics cookies.

9. Changes

We post changes to this policy here and email you about important ones.