Controller

The controller of the personal data described here is the operator of LiquidScope identified in the Legal notice (QuantX LLC). Privacy requests: contact not yet published — reach the operator through the person who sent your invitation.

What we process, and why

Sign-in identity

Your invited e-mail address, verified by Cloudflare Access with a one-time code. It is the key that ties your records to you and keeps other users out of them. Basis: performance of our agreement and our legitimate interest in securing access. Cloudflare Access sets strictly necessary authentication cookies for this purpose; LiquidScope sets no other cookies.

Operational metadata

The time of your first and latest request (recorded at most every five minutes), a request count, the sign-in identity used and whether the device is a phone or a computer. Nothing about what you looked at. Kept for running and securing the service and visible to the operator only. The operator's page also shows, per workspace, the number of registered accounts and their aggregate figures (equity, net deposits, P&L, declared capital), together with the public addresses registered in that workspace, so that the service's capacity and health can be watched and support given. Basis: our legitimate interest in operating the service.

Your workspace inputs

Public account addresses you register, their labels, strategy names and assignments, declared capital, alert rules and preferences, stored with your sign-in identity on the server. Basis: performance of our agreement.

Account data collected from the exchanges

For each address you register, the server retrieves from the exchange's public interface, about once per minute, the account's positions, orders, balances and equity, and keeps a ledger of its financial events (fills, funding, deposits, withdrawals, transfers) together with the venue's original records, hourly aggregates and daily reconciliation checks. This information is public on the venue; by registering an address you confirm that you own it or are authorised to monitor it, since its financial history is processed from then on. Basis: performance of our agreement.

Push notifications

If you enable them, the push endpoint and the encryption keys issued by your browser, stored with your identity. If you link Telegram, the chat identifier Telegram assigns and the display name it reports are stored to deliver the same notices there; unlinking from Settings or sending /stop to the bot revokes them. Web Push payloads are encrypted end to end and redact amounts by default; they are delivered through the push service of your browser vendor (Apple, Google, Mozilla, Microsoft or Samsung). Telegram messages are not encrypted end to end: Telegram handles their text under its own terms. Basis: your consent, which you withdraw by disabling notifications in your browser, removing the subscription or unlinking Telegram.

Technical and security logs

Cloudflare, as our hosting and sign-in provider, records IP addresses, user agents, request metadata and authentication events for hosting, security and abuse prevention, under its own retention rules. LiquidScope itself keeps operational statistics of its collection runs for 30 days; when a run cannot collect an account, its record names that account's label, visible to the operator only. Basis: legitimate interest in running and securing the service.

On your device

Browser preferences (theme, hidden balances, auto-refresh, time zone, dashboard layout) stay in your browser's local storage. The offline cache holds only the application's static files, never account data or authenticated pages. Clear them in Settings → Clear local data or through your browser.

Recipients

Cloudflare, Inc. (hosting, database, sign-in); the exchanges whose public interfaces are queried (today Hyperliquid), which receive the addresses queried and the network address of the server making the request, and, while the live venue feed is on in Settings (the default), the addresses you follow and your own device's network address, because your browser then connects to the venue directly; if you enable notifications, your browser vendor's push service; if you link a Telegram chat, Telegram. We use no advertising or analytics services, and we do not sell or share personal data for marketing.

Where the data is

The database runs in Cloudflare's Eastern-Europe region; the application and sign-in run on Cloudflare's global network, and Cloudflare, Inc. is established in the United States. Transfers to Cloudflare are covered by Cloudflare's data processing terms and standard contractual clauses. Each exchange's own processing takes place under its own terms.

How long we keep it

• Your sign-in identity and workspace inputs: for as long as you have access to the service, then deleted with your records.
• Minute-level account snapshots: 90 days, then reduced to hourly aggregates.
• Financial events, their original venue records and hourly aggregates: for as long as the address's history is kept, because they are the evidence behind every figure; removing an account in Settings stops collection and keeps this history until you ask for its deletion.
• Push subscriptions and Telegram links: until you disable them, unlink, or the push service reports them expired; revoked entries are kept only as the record of the revocation.
• Collection run statistics: 30 days. Notification delivery receipts: 180 days.
• Database point-in-time recovery at Cloudflare keeps changes for up to 30 days after deletion.

Access requests from liquidscope.net

The public page at liquidscope.net carries a request-access form. Submitting it stores the e-mail address you enter, the wallet-count and amount ranges you choose, the optional context text, the country the request came from, a truncated browser identifier and a salted hash of your network address (never the address itself; it only limits repeated submissions). An operator reviews each request by hand and receives it as a notice; nothing is shared with third parties. Requests that were invited or declined are deleted 90 days after the decision; a pending request stays until an operator decides, and an operator deletes a request at any time on your demand. When a request is invited, the details given on the form (nickname, number of wallets, amount range, how you heard about us) are copied to the new account's profile and kept with it like the other account inputs. When the anti-bot check is enabled, Cloudflare Turnstile runs on that form under Cloudflare's privacy terms.

Your rights

You may ask for access to your data, its rectification or erasure, the restriction of its processing, or a copy in a portable format (the CSV export in Activity already gives you your ledger), and you may object to processing based on our legitimate interests. Write to the privacy contact above from your sign-in e-mail address; we answer within one month. You may also lodge a complaint with the data-protection authority competent for you.

Security

Everything is served over HTTPS behind Cloudflare Access; the application verifies the signed identity on every request, holds no private keys or trading permissions, reads the venue's public interface only, and restricts what the pages may load through a content-security policy. No system is perfectly secure; keep your mailbox and devices protected.

Children

The service is not intended for anyone under 18, and we do not knowingly process their data.

Changes

We update this notice when the service changes; the date at the top of the page is the current version.