Privacy Policy
This policy explains how Ghost618 processes information when you use ghost618.com, the @OnchainPositionMonitorBot Telegram bot or the Mini App at app.ghost618.com.
Who we are and how to contact us
Ghost618 is the operator name used for a monitoring and analytics service for publicly visible Hyperliquid perpetual-futures wallets. In this policy, “Ghost618”, “we” and “us” mean the operator of that service.
Privacy and data-rights requests: privacy@ghost618.com. Legal notices: legal@ghost618.com. General and payment support: support@ghost618.com, /support or /paysupport in the bot. Security reports: security@ghost618.com.
Information we collect
When you use the bot or Mini App, Telegram provides signed login information. We read your Telegram user ID, username if present, first name and language code. Telegram auth_date is used only to confirm that the login data is fresh.
- Account data: account creation time, last-seen time, chosen interface language, a short identifier for the client last used, and — if you opened the bot through a campaign link — the tag from that link (for example yt_01). The tag records which channel introduced you to Ghost618. It is saved once, on your first visit, is never changed afterwards, and is deleted with your account.
- Wallet data you provide: public Hyperliquid addresses, labels, private notes, notification settings and whether an address is marked as your own.
- Public market data: trades, positions, account value, equity history and stop-loss or take-profit levels obtained from Hyperliquid.
- Journal data: your trades, results, matched followed wallet and the delay between the followed wallet’s entry and yours.
- Subscription and payment records: Telegram user ID, subscription status and expiry, Telegram charge identifier, Stars amount, timestamps, processing result, error text, refund status and a technical payment confirmation truncated to 2,000 characters.
- Notification bookkeeping: identifiers showing which alert message was already sent for a position.
- Support-routing data: the identifiers required to forward a support message and route an operator reply back to you.
Cookies, browser storage and logs
Ghost618 does not operate advertising analytics, profiling trackers or data-sale systems. We do count how many people arrived from each of our own campaign links and how many of them subscribed, using the tag described in section 02 — that counting happens inside Ghost618, involves no third party, and is not used to build a profile of you or to target you with anything. The Mini App sets no application cookies. It stores one local browser value for your chosen interface language.
The public website is delivered through Cloudflare. Cloudflare may set the __cf_bm cookie for bot filtering; it normally lasts about 30 minutes and is not used by Ghost618 for advertising or profiling.
The Ghost618 application does not store visitors’ IP addresses or user agents in its own database. Infrastructure providers may record IP addresses and technical request information in their platform logs according to their own retention policies.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Identify your account and provide the service | Performance of a contract |
| Send alerts and maintain your journal | Performance of a contract |
| Take payment and manage Pro | Performance of a contract |
| Answer support and payment questions | Performance of a contract |
| Keep the service secure, operational and backed up | Legitimate interests |
| Retain records required by law | Legal obligation |
Service providers and data recipients
- Telegram: account login, bot messages, alerts, support, Stars payments and current backup delivery.
- Fly.io: hosting for the bot, Mini App and database in the Frankfurt region. Fly.io may process technical request logs and is a United States company.
- Cloudflare: DNS and proxy services for the public website, including security logs and the __cf_bm cookie.
- OpenAI / ChatGPT Sites: hosting and deployment of the public marketing website and related technical request processing.
- Hyperliquid: public API queries. Only wallet addresses are sent; your Telegram identity and Ghost618 account data are not sent.
- Proton: email received at our privacy, legal, support and security addresses.
- Google Fonts: the Mini App currently requests font files from Google, allowing Google to receive the requesting IP address.
We do not sell or rent personal data. We disclose information only as needed to provide the service, comply with law, or establish, exercise or defend legal claims. Where a provider processes data outside the European Economic Area, the transfer is governed by the provider’s applicable GDPR transfer mechanism, such as an adequacy decision or Standard Contractual Clauses.
Support messages
A message sent with /support is forwarded to the operator through Telegram together with your username or first name and Telegram user ID so that a reply can reach you. The message text is not written into the Ghost618 database; it remains in Telegram. Ghost618 stores only the identifiers required to route replies, and removes them when you delete your account.
How long we keep information
| Information | Retention |
|---|---|
| Account, followed wallets, labels, notes and journal | Until you delete your account |
| Public wallet trade history | 120 days |
| Current positions, account state and risk levels | Overwritten by the latest exchange reading |
| Equity history | No fixed automatic deletion period at present; retained while needed to provide the service |
| Notification bookkeeping | Deleted hourly once older than 2 days |
| Subscription record | Until you delete your account |
| Anonymised payment accounting entries | For the period required for accounting, legal and dispute purposes |
| Server backups | 7 daily copies; the oldest is deleted |
| Backup copies sent through Telegram | Until manually deleted from the operator’s Telegram storage |
| Provider platform logs | According to each provider’s policy |
| Email correspondence | As long as needed to resolve the matter and defend legal claims |
Deleting your account removes information from the live database immediately. Existing backups expire according to the schedule above; deleted accounts are not intentionally restored from backups.
Your rights and account deletion
Under applicable data-protection law, you may request access, a copy, correction, erasure, restriction or objection, and may complain to a supervisory authority. In Lithuania, the authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija). Send requests to privacy@ghost618.com. We normally respond within one month, subject to lawful extensions and identity verification.
To delete your account, send /delete_me and then /delete_me confirm. This cancels renewal and removes your account, followed wallets, labels, notes, journal, subscription, notification bookkeeping and support-routing identifiers.
Payment entries are anonymised on deletion: the user ID, payment identifier and raw Telegram payment data are erased, leaving only a non-identifying amount and date. Public market data stored per wallet can remain because other users may follow the same public address, but it is no longer connected to your account.
Automated processing, age limit and changes
Ghost618 does not make automated decisions that produce legal or similarly significant effects about you. It computes statistics from public trading data and matches trades within a time window, but grants or refuses nothing about you as a person.
The service is not intended for anyone under 18. We may update this policy when the service or law changes. The version and effective date will be updated, and material changes may also be announced through the bot.