Privacy Policy

Last updated: October 25, 2026

Who we are

blohunter.com is an independently operated project. For privacy-related questions, contact [email protected].

What we collect

Always (no consent needed — strictly necessary or legitimate interest):

• Server access logs. Our server writes standard web access logs: your IP address, timestamp, requested URL, HTTP status, user-agent, and referer. These are used to keep the site secure, debug issues, and detect abuse. They are rotated and deleted after 7 days.
• Cloudflare edge. Cloudflare acts as a CDN and DDoS protection layer in front of the site, so all of your requests pass through them. They may set a short-lived bot-management cookie (__cf_bm, ~30 minutes) and process your IP. See Cloudflare's privacy policy.
• Your consent choice. When you click Accept or Decline on the consent banner, your choice is stored in your browser's localStorage (key bh_consent). It never leaves your browser.

Only if you accept the consent banner:

• Google Analytics 4. Property G-2QK6J2RHT9. Google sets analytics cookies (e.g. _ga, _ga_2QK6J2RHT9), receives information about your browser, device, approximate geography (Google infers this from IP and then discards the full IP), pages viewed, and on-page events. See Google's privacy policy. If you don't accept, GA sends only anonymous, cookieless pings (no identifier).

What we do not collect through the site itself: the website has no accounts, no sign-ups, no logins, no payment forms, and no contact/comment forms — so the site itself does not collect your name, email, address, or any other directly identifying information. (Web app accounts are covered in the Accounts section below.) The market data shown on BloHunter is public exchange data — it is not yours.

Accounts (BloHunter Trading web app)

The web app at app.blohunter.com is invite-only. You sign in with an e-mail code or a passkey. For your account we process:

• Email address (required) — your sign-in and account identifier.
• Authentication/session data — your account id, sign-in and last-seen times, active session metadata (device label and approximate country for Account → Security), and the session cookie that keeps you signed in (see Cookies below).
• Exchange API credentials — when you connect a BloFin Futures API key on app.blohunter.com (Account → Exchange), BloHunter verifies that the key is Futures Trade-only (strictly refusing any key with Withdrawal or Transfer permissions and refusing read-only keys) and stores the validated credentials encrypted at rest on the BloHunter application server using AES-256-GCM with per-account HKDF key derivation.
• Automated execution and account state — your dedicated static Netherlands egress IP assignment, trading settings, and position/activity records so your server-side trading worker can manage trades 24/7 and display live status across your signed-in sessions.
• Credits and payments — your credit balance and its ledger (purchases and the credits charged for trades), and for Solana Pay purchases the payment reference, amount and on-chain transaction. Solana payments are public on the Solana blockchain; we never receive your wallet's keys.

Account authentication data is processed and stored by Clerk (Clerk's privacy policy) as our authentication provider, on our behalf. We use it only to authenticate you and operate your account — not for advertising or analytics. Our servers additionally log authentication events (account id, timestamp, IP address) in the same short-retention security logs described above. You can revoke or permanently delete stored exchange API credentials at any time from Account → Exchange. To delete your entire account, email us — deletion stops any active trading worker, purges stored exchange credentials, and removes the account and its associated personal data from Clerk and from our app database (except records we must keep for accounting, such as payments).

Embedded content (third parties)

The dashboard embeds live video and news streams from third parties. When you choose to play them, your browser connects directly to those services and they can see your IP and standard request data:

• YouTube (Google) — embedded YouTube players follow Google's standard embed behavior and may set cookies on youtube.com.
• News HLS streams — Sky News, France 24, Deutsche Welle, Sky News Arabia, and TRT World are loaded from each broadcaster's own CDN.

BloHunter does not send any of your data to these services on your behalf — your browser simply connects to them when you watch.

Why we process the data we do

• Site operation, security, and abuse prevention — server access logs.
• Operating your BloHunter Trading account and 24/7 automated execution — authentication, encrypted exchange API credentials, dedicated static egress IP routing, and credit ledger records when you use app.blohunter.com.
• Understanding how the site is used in aggregate — Google Analytics, only if you consent.

Lawful bases (GDPR)

• Contract (Article 6(1)(b)) — to provide the BloHunter Trading web app, account authentication, credit ledger, and automated futures execution you request.
• Consent (Article 6(1)(a)) — for Google Analytics and any non-essential cookies.
• Legitimate interest (Article 6(1)(f)) — for short-retention server access logs, to keep the site running and secure. We've balanced this against your interests: logs are minimal, retained briefly, and used only for site operation.

Cookies and similar storage

• bh_consent — localStorage, not a cookie. Stores your consent choice (granted or denied). Stays in your browser.
• _ga, _ga_2QK6J2RHT9 — set by Google Analytics, only if you accept. Typically persist up to 2 years.
• __cf_bm — set by Cloudflare for bot management. Short-lived (~30 minutes).
• __Host-bh_session — web app only (app.blohunter.com): keeps you signed in. Strictly necessary; lasts until you sign out or it expires.
• Sign-in cookies — set by our authentication provider while you sign in to the web app; strictly necessary for sign-in.
• Web app local preferences — UI layout and sound alert preferences stored in your browser's local storage for app.blohunter.com. Exchange API credentials are never placed in browser storage; they are encrypted at rest (AES-256-GCM with per-account HKDF key derivation) on the BloHunter application server.

Third parties

• Clerk — authentication provider for web app accounts; processes and stores account data (email, sign-in metadata) on our behalf. See Clerk's privacy policy.
• BloFin — your futures exchange. Authenticated automated futures execution routes from a dedicated static Netherlands egress IP assigned to your account using Futures Trade-only API permissions (Withdrawal and Transfer permissions are strictly refused).
• Solana network — only when you buy credits with Solana Pay; your payment is a public on-chain transaction.
• Google LLC — Google Analytics, only with your consent.
• Cloudflare, Inc. — CDN, TLS, and DDoS protection in front of the site.
• Vultr Holdings — server hosting. They provide the underlying infrastructure for our application services.

Retention

• Server access logs: 7 days, then automatically rotated and deleted.
• Google Analytics data: per Google's retention settings (in aggregate; not tied to you by us).
• Your bh_consent choice: until you clear your browser storage.
• Encrypted exchange API credentials: retained on the application server only while connected; immediately purged from active storage when you delete your credentials in Account → Exchange or delete your account.
• Account data (Clerk and our app database): retained while your account exists; removed when the account is deleted, except payment records kept for accounting.
• Instruction delivery and operational records: retained for a short rolling window.
• Web app browser preferences: until you clear site data in your browser.

Your rights

If you are in the EEA, UK, or another jurisdiction that grants similar rights, you have the right to:

• Access, correct, or delete personal data we hold about you
• Object to or restrict processing
• Withdraw consent at any time (see below)
• Lodge a complaint with your local data-protection authority

In practice, because the website has no accounts, the only site data identifiably linked to a visit is in short-retention server logs and (if you consent) Google Analytics. If you want us to delete a specific log entry, email [email protected] with the date/time and IP of the visit; if the logs haven't already rotated out, we'll remove them. For a web app account, email us to access or delete your account data and we'll do it for you.

How to withdraw consent

• Clear the bh_consent key in your browser's localStorage — the consent banner will re-appear on your next visit, and you can decline.
• Install Google's opt-out add-on: tools.google.com/dlpage/gaoptout.
• Use your browser's "clear site data" option for blohunter.com.

Children

BloHunter is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided data, contact us and we'll remove it.

BloHunter Trading web app

BloHunter Trading (app.blohunter.com) is an invite-only web application that automates supported BloHunter futures strategies on a BloFin account you connect. Automated execution runs on the BloHunter application server so trade entries, risk controls, and position protections operate continuously 24/7 without requiring an open browser tab. The web app performs no analytics, advertising, or third-party tracking, and loads application code only from app.blohunter.com (the dedicated sign-in and account security windows on blohunter.com load our authentication provider's script).

Exchange API credentials and dedicated egress. When you connect a BloFin Futures API key on app.blohunter.com (Account → Exchange), BloHunter verifies that the key is Futures Trade-only — strictly refusing any key with Withdrawal or Transfer permissions and refusing read-only keys. Validated credentials are encrypted at rest on the BloHunter application server using AES-256-GCM with per-account HKDF key derivation, and automated futures execution routes from a dedicated static Netherlands egress IP assigned to your account for 24/7 operation. Your browser never stores your exchange API credentials or signs exchange requests directly.

Revocation and credential deletion. You can revoke or permanently delete your stored API credentials at any time from Account → Exchange (or directly in BloFin API Management), which immediately halts your server-side trading worker and purges the encrypted credentials from active storage.

Network connections. When you use the web app:

• Your browser connects only to app.blohunter.com and blohunter.com (for dashboard state, live market feeds, account controls, credits, and our authentication provider's sign-in and security frames).
• Our application server communicates with BloFin's futures API on your account's behalf from your assigned static Netherlands egress IP.

What we do not do.

• We do not sell user data.
• We do not use the web app as an advertising or tracking tool.
• We never take custody of your exchange funds, never accept API keys with Withdrawal or Transfer permissions, and never receive your Solana wallet's private keys.

Changes to this policy

We'll update the "Last updated" date at the top whenever this policy changes.

Contact

Questions, requests, or complaints: [email protected].