Privacy Policy

ByKaranteli is an independent crypto derivatives data platform operated from Türkiye. We are the controller of the personal data described here. You can reach a human at support@bykaranteli.com.

• Your email address. It is the account identifier and the only contact detail we require.
• A password hash, if you set a password. We store an argon2id hash, never the password itself. Accounts created through Google sign-in, a one-time email link or an app sign-in code have no usable password.
• Your interface language, so emails and pages arrive in the right one.
• Timestamps: when the account was created, when the email was verified, when you last signed in.
• Profile fields some accounts entered before 25 September 2026: a handle, display name and short bio. No page shows them any more, and they are cleared when the account is deleted.
• A Solana wallet address, only if you save one in Settings to buy USDC through Coinbase Onramp. It is where the purchase is delivered, nothing else.

• Product events such as page views inside the member workspace and successful sign-ins. These records hold an opaque session identifier and a coarse device family such as ios, android or desktop. They do not hold your IP address.
• What you set up in the workspace: watchlists, alert recipes (symbol, condition, channel), saved chart layouts and drawings, the Hyperliquid addresses you choose to follow with the labels you give them; a Telegram chat id if you link Telegram for alerts, with the username and language Telegram reports and the time of your last command or button tap; a browser push endpoint if you turn on push notifications; a webhook URL if your plan allows one.
• A chat that opens the bot before it has an account: the chat id, the Telegram user id, the username and language Telegram reports and the source tag of the link, kept to finish the sign-in link you start.
• API keys as a hash plus a short display prefix, when each key was last used, and daily call counts per key for quota and billing. Calls to the MCP server without a key are counted per client address for that day only. Apps you connect with OAuth: the app's name and redirect address, the grant, its tokens as hashes and the key it runs on, until you disconnect it.
• Security and audit records for account actions such as sign-in, password reset and email verification. These do hold the IP address the request came from, the country Cloudflare attaches to that request and the browser's user agent, because an audit trail without them cannot answer the question it exists to answer. The same three are kept on each sign-in session so that our support can tell your devices apart when you ask. When our support acts on an account by hand (grants or ends a plan, marks an invoice paid, ends sessions, bans the account or changes its email address at your request), a record of that action is kept with the account's email address.
• How you first arrived: the utm source, medium and campaign on your first visit, the landing page, and a referral code if a member referred you. These live in the bk_acq and bk_ref cookies and are attached to the account at signup.
• Standard server logs at our web server and at Cloudflare, which sits in front of the site. These contain IP addresses, requested paths and user agents, and exist for abuse prevention, rate limiting and debugging.
• If you subscribe to the weekly funding report, a separate list holds the email address you entered, the language of the page you subscribed from, a confirmation token, the subscription status with its confirmation and unsubscribe times and the time of the last mail. It is double opt-in, carries no tracking pixels and every mail has an unsubscribe link. This list is separate from any account and is not changed by deleting an account.
• If you use the AI desk (Ask BYK): the questions you ask, the answers you receive, the page you asked from, the time of each, whether you marked an answer helpful and any note you added, and the daily allowance or prepaid balance each conversation used. If you buy a prepaid balance, also the invoice, the on-chain transaction that paid it and every charge and return on the balance, the ledger the balance page shows. If you share an answer at a link, also the link's identifier, when you created and withdrew it, and how many times it was opened; the shared page shows the question and the answer, never your name or account. If you ask from the Telegram bot, also the chat's message identifiers of the questions and answers, which let the bot continue a conversation when you reply to one. If you rate a desk reading (a reading the desk writes on its own), that rating, any note you add and the time.

The ByKaranteli app for Android and iOS is free, sells nothing and shows the same data as the site. Signing in with the six-digit code emailed to you opens the same account as on the site; no password is set. The app uses no cookies: its session tokens live in the operating system's secure storage on your device.

• A random install identifier the app generates on first launch. It ties a sign-in code to the phone that asked for it and keeps one live session per phone. It is not an advertising identifier and it changes when you reinstall the app.
• For each app session: the platform (Android or iOS), the operating system version, the app version, the device model, the interface language, the IP address, country and user agent of the sign-in, and when the session was last used. A session ends after 30 days without use and in any case after 90 days; you can end any session from the app.
• A push notification token from Expo, Firebase Cloud Messaging (Google) or the Apple Push Notification service, only if you allow notifications in the app. It delivers the alerts you set up and is switched off when you sign out or when the provider reports the device unreachable.
• The watchlist symbols and alert recipes you create in the app are stored on your account, the same records as the workspace on the site. When the account is deleted every alert rule is switched off and these records stay in our database keyed only to the anonymised account id, unreachable through the product; write to us if you want them purged.
• A device integrity verdict from Firebase App Check, backed by Google Play Integrity on Android and Apple App Attest on iOS. It tells us whether a request came from an unmodified copy of the app on a genuine device; it carries no personal data and is kept with the session.
• If you use Ask BYK in the app: the same records as on the site (the questions, the answers, the screen you asked from and what paid for the conversation), kept with your account. A model provider key you save in the app stays in the phone's secure storage, is sent only to the provider you chose with each question, and is removed when you sign out; we never store it.
• Crash and error reports sent to Sentry, plus a session record per app launch (start, end, whether it crashed): the stack trace, the device model, the operating system version and the app version, plus a random identifier the Sentry SDK generates for each installation to count how many installs a problem affects; it is not linked to your account. No email address, account identifier or IP address is attached, and the app is set not to send personal data to Sentry.
• The app contains no third-party analytics or advertising SDK, does not read your contacts, location, photos or clipboard, and asks for no permission other than notifications. It sends us anonymous screen statistics, the same first-party measurement as our own page-view beacon on the site: which screen was open (and which coin, board, chart type or account page it showed) and for how long, the interface language, the app version, the update identifier and the release channel, the Android version, whether the device is a phone or a tablet, and the country of the connection. No install identifier, account, IP address or push token is stored with them.

• Exchange API keys. We never ask for them and there is nowhere in the product to enter one.
• Custody of any funds. We hold no assets on your behalf and cannot place a trade for you.
• Card or bank details. Subscriptions settle on chain, so no payment card ever reaches us.
• Your IP address inside product analytics. That table is deliberately IP-free.
• Cross-site advertising identifiers. We run no advertising pixels and no retargeting tags.

Some pages show public blockchain addresses, for example the largest Hyperliquid accounts and the positions Hyperliquid publishes for them. We attach no names and we do not try to identify the people behind an address.

If an address is yours and you want it off our public pages, write to support@bykaranteli.com. We stop displaying it on our public pages and, where the law requires more, we remove it from our records.

Memberships are paid in USDC or USDT on Solana. For each attempt we store the plan, the token, the expected amount, a unique on-chain reference key used to match your transfer, the status and the relevant timestamps. We do not store your private keys and we cannot move funds.

Pay-per-call API access and prepaid API keys (the x402 protocol) settle in USDC on Base or Solana per request through a payment facilitator, Coinbase Developer Platform, which verifies and settles the transfer and therefore sees the paying address, the amount and the route paid for. Our own payment ledger keeps the same fields plus the transaction id, the request's IP address and user agent.

If you choose to buy USDC through Coinbase Onramp, the purchase happens on Coinbase's pages under Coinbase's terms and privacy policy; the card never reaches us.

Blockchain transactions are public and permanent by design. Anything you send on chain is visible to anyone, independently of this site, and cannot be deleted by us or by you.

• bk_session: your sign-in session. Strictly necessary. Without it you cannot stay signed in.
• bk_acq and bk_ref: first-touch attribution and referral credit, set on your first visit.
• bk_pending_watch: a small interface preference, the symbol you chose to watch before signing in.
• bk_pending_plan: the plan you picked on the pricing page before signing in, kept for 24 hours so checkout can resume.
• bk_g_next: set for ten minutes during a Google sign-in, the page to return to afterwards; deleted when the sign-in completes.
• bk_tg_link: set for up to one hour when you arrive from the Telegram bot's sign-in or sign-up button; it holds the one-time code of that chat so Settings can ask you to confirm it, and is deleted when you confirm or refuse.
• Browser sessionStorage (never sent to our servers): bk_pending_watch_checked, so the watchlist symbol you chose before signing in is added once per browser session, and bk-rail-scroll, so the menu keeps its scroll position while the tab is open.
• Browser localStorage (never sent to our servers): bk-theme, bk-palette, bk-density, bk-sidebar-collapsed, bk-nav-open and bk-rail-collapsed for how the interface looks on your device; bk-legend:* for the series you hid on a chart; bk-superchart-tz for the time zone of your charts; bk-funding-arb-screens for the funding arbitrage screens you saved; byk.ask.callout to remember that the Ask BYK introduction was shown; bk-analytics-consent to remember your analytics choice; and bk-android-bar-dismissed and bk-android-app-seen so that the bar offering the Android app stays away for a while after you close it, and so that neither that bar nor the browser's own install prompt appears for a while once the app has opened a page in this browser.
• Browser localStorage that is also saved with your account while you are signed in: bk-superchart-layout-v1 (your chart layout) and bk-drawings:* (the lines you drew on a chart). Signed out, they stay in the browser only.
• Your own model provider key for Ask BYK, if you save one: it is kept in this browser's localStorage under byk:ask:own-key: followed by your account identifier, with the provider and the model you chose. It is sent through our servers to that provider with each question you ask on that key, and when you press Check key in Ask BYK settings, and we never store it. Signing out from the menu removes it from this browser.
• Google Analytics cookies beginning with _ga: see the next section.

• Cloudflare, as CDN and security layer in front of the site. It processes IP addresses and request metadata for every visit.
• Cloudflare Turnstile, on the sign-in, one-time link, sign-up and password reset forms: a bot check that runs in your browser as soon as one of those forms is shown. It processes your IP address and browser signals to tell a person from an automated script and rarely asks you to do anything. Its result is only used to accept or refuse that one form submission. A check that fails, does not finish or cannot be completed is recorded with the IP address and user agent in the audit records described above, whether or not the submission is refused; the signals themselves are not stored.
• Google Analytics 4, property G-VC79YWMSCT, for aggregate traffic measurement, and ONLY if you accept it in the consent banner: nothing loads and no cookie is set until you choose Accept, and Manage lets you save it switched off. If you accepted and change your mind, clear this site's data in your browser and the banner will ask again. The site works identically either way.
• Our own page-view beacon: after a page loads, your browser sends us the page path, the site language, a device class (mobile, tablet or desktop), the browser family, the country Cloudflare attaches to the request, the referring site and the loading timings of that view (the Core Web Vitals). No cookie, no identifier and no IP address are stored; the rows are summarised per day and deleted after 90 days.
• Google, if and only if you choose to sign in with Google. In that case Google tells us your Google account identifier, your email address and whether Google has verified it. We request no other permission and we never gain access to your Gmail, Drive or contacts.
• Hostinger, our email provider, for verification, sign-in links and codes, alerts and digests you have asked for. It sees your email address and the message.
• Telegram, if you link it: alerts you set up are delivered through Telegram's bot API to the chat you linked, the bot answers your commands there, and we keep a record of each delivery attempt (which alert, which channel, when, delivered or not).
• Anthropic, whose language model generates the AI desk's answers. When you ask the desk a question, the text of your question, the earlier messages of that conversation and the market data the desk looks up for the answer are sent to Anthropic's API, which runs in the United States. When your question is about your own alerts, watchlists or the Hyperliquid addresses you follow, the desk reads those records to answer, and what it reads is sent as well: your alerts (name, scope, symbols and conditions, whether each is switched on, its cooldown, when it last fired and how many times, and the channels it delivers on), which kinds of delivery channel your account has set up (Telegram, email, push or webhook, never the chat, address or link behind them), your watchlists (names and symbols), the addresses you follow (the address, your label, whether its alerts are on, when it last alerted, and the equity and positions last seen on it), the name of your plan with how many alerts and addresses it keeps, and the record identifiers of those alerts and watchlists. Your name, email address, account identifier and IP address are not sent. Under Anthropic's commercial terms, API inputs and outputs are kept for up to 30 days for abuse monitoring and are not used to train its models.
• If you choose to use your own key, the text of your question, the earlier messages of that conversation, the market data the desk looks up and, when your question is about them, the account records named above are sent to the provider you chose (listed in Ask BYK settings) under that provider's terms, together with your key for that request. We do not store the key. The conversation itself is kept with your account as described above, with the provider's name and the model you chose.
• The agent in your browser, if you use one that supports WebMCP (for example agent extensions or developer tools): on the public boards the page registers read-only data tools with your browser. When your agent calls one, your browser fetches the answer from our server exactly as the page does (same session, same depth) and hands it to the agent, so the agent's provider sees that answer. We send nothing to the agent's provider ourselves, we do not learn which agent it is, and we store nothing the agent sends. The statistics we keep count calls per day, page and tool, with no account or address; the usual short-lived rate-limit counters per address and session apply as on the rest of the API.
• Expo Application Services, which distributes the app's updates and relays its push notifications. For an update check it receives the platform, the runtime version, update identifiers and a random client identifier generated by the update library; for a notification it receives the push token and the message.
• Google, for the Android app: Firebase App Check with Play Integrity verifies the app and the device, Firebase Cloud Messaging delivers notifications, and Google Play distributes the app under Google's own terms. Apple, for the iOS app: App Attest, the Apple Push Notification service and the App Store, under Apple's terms.
• Sentry, which receives the app's crash and error reports and session records as described under The mobile app.
• Your browser's push service (run by the browser vendor, such as Apple, Google or Mozilla), if you turn on push notifications: it relays the alert to your device.
• Coinbase, if you buy USDC through Coinbase Onramp, and Coinbase Developer Platform as the facilitator of pay-per-call payments (see Payments).
• Blockchain RPC providers we query to confirm payments. They see the public addresses and transactions we look up, never your account.
• GitHub, which stores our weekly database backups in a private repository. Each backup is encrypted on our server before upload (AES-256, key kept only on our server), so GitHub holds ciphertext it cannot read.
• Market data sources such as exchanges and public data providers. These receive requests from our servers, not from your browser, so they do not see you.

• Account records, watchlists, alerts and API keys: while the account exists, then removed or anonymised on deletion as described under Your rights.
• Sign-in sessions: 7 days from sign-in, or until you sign out; expired rows are removed daily.
• One-time email tokens: they expire quickly and are single use, and the used ones are kept only as a record that they were spent.
• App sessions: 30 days after the last use and at most 90 days, or until you sign out; the row of an ended session is removed 90 days after it was signed out or reached its limit. App sign-in codes: ten minutes, single use; the row (hashed email address, install identifier, IP address, country) is removed after 180 days.
• Mobile push tokens: switched off when you sign out, delete the account or the provider reports the device unreachable, and removed 90 days later.
• Product events (page views and sign-ins inside the workspace): 180 days.
• Security and audit records for account actions: 180 days.
• Records of actions our support takes on an account by hand, and the record of an account deletion: kept without a time limit. After an account is deleted they hold a hashed fingerprint of its email address, not the address itself.
• Our operating logs (service metrics, reports, incidents, request probes): 30 to 180 days depending on the log.
• Notification delivery records (which alert went to which channel, when, and whether it arrived): kept with the account.
• AI desk conversations: kept with your account so you can reopen them, then anonymised with the account on deletion as described under Your rights. The market data looked up for an answer is not stored with the conversation. A technical record of each answer (which data tools ran, how many tokens, what it cost us) is kept with the conversation.
• The page-view beacon rows: 90 days; the daily totals derived from them are kept.
• The app's screen statistics rows: no deletion window; they hold no install identifier, account or IP address.
• Billing and payment records, including the x402 ledger: as long as we are required to keep a record of the transaction.
• Market data we record is not personal data and is kept indefinitely: nothing a collector records is deleted, except that a public blockchain address is removed where the law requires (see Public blockchain addresses).
• Weekly funding report subscriptions: until you unsubscribe; the unsubscribed row keeps the address and the time of the unsubscription so that no further mail is sent.

You can ask us for a copy of the personal data attached to your account, ask us to correct it, or delete the account from your Account page on the site (the Data tab, Danger zone). Deletion works like this, precisely: your email address is replaced with an anonymous tombstone, every sign-in method, session and pending sign-in link is destroyed, and your profile fields are cleared immediately. Workspace records such as watchlists and alerts remain in our database keyed only to the anonymised account id, unreachable through the product; write to us if you want them purged. A hashed fingerprint of the old address (not the address itself) is kept in the deletion audit record. Nothing already published on a public blockchain can be removed by anyone. In the app, the More tab, Account section, Delete account does the same after you confirm with a fresh sign-in code; on the site use the Account page (the Data tab, Danger zone) or write to support@bykaranteli.com. Deletion also revokes every app session, push token, API key, connected OAuth app, alert rule, webhook and Telegram link at once. Billing and payment records stay for as long as the law requires us to keep them. A step by step guide for the Android app is at bykaranteli.com/delete-account.

Write to support@bykaranteli.com from the address on the account and we will act on it. If you are in a jurisdiction with a supervisory authority for data protection, you also have the right to complain to it.

Passwords are stored as argon2id hashes. Session tokens are stored as SHA-256 hashes, so the value in your cookie does not exist anywhere in our database. API keys are stored the same way, as a hash plus a short display prefix, which is why we can never show you a key again after you create it. Transport is HTTPS only.

No system is perfectly secure. If you believe you have found a vulnerability, please write to support@bykaranteli.com before disclosing it publicly.

This service is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18.

If this policy changes in substance, we will change the date at the top of this page. Material changes affecting existing members will also be sent by email to the address on the account.

Questions about this policy, or a request about your data: support@bykaranteli.com.