Privacy Policy

Last updated: August 2, 2026

Who we are

blohunter.com is an independently operated project. For privacy-related questions, contact [email protected].

What we collect

Always (no consent needed — strictly necessary or legitimate interest):

• Server access logs. Our server writes standard web access logs: your IP address, timestamp, requested URL, HTTP status, user-agent, and referer. These are used to keep the site secure, debug issues, and detect abuse. They are rotated and deleted after 7 days.
• Cloudflare edge. Cloudflare acts as a CDN and DDoS protection layer in front of the site, so all of your requests pass through them. They may set a short-lived bot-management cookie (__cf_bm, ~30 minutes) and process your IP. See Cloudflare's privacy policy.
• Your consent choice. When you click Accept or Decline on the consent banner, your choice is stored in your browser's localStorage (key bh_consent). It never leaves your browser.

Only if you accept the consent banner:

• Google Analytics 4. Property G-2QK6J2RHT9. Google sets analytics cookies (e.g. _ga, _ga_2QK6J2RHT9), receives information about your browser, device, approximate geography (Google infers this from IP and then discards the full IP), pages viewed, and on-page events. See Google's privacy policy. If you don't accept, GA sends only anonymous, cookieless pings (no identifier).

What we do not collect through the site itself: the website has no accounts, no sign-ups, no logins, no payment forms, and no contact/comment forms — so the site itself does not collect your name, email, address, or any other directly identifying information. (BloHunter Desktop accounts are covered in the Accounts section below.) The market data shown on BloHunter is public exchange data — it is not yours.

Accounts (BloHunter Desktop sign-in)

BloHunter Desktop requires a one-time sign-in. When you create an account we process:

• Email address (required) — your sign-in and account identifier.
• Profile data from the sign-in method you choose — if you sign in with Discord, Google, or X, the provider shares basic profile data with us (provider user id, username/avatar, and email where the provider includes it). Email-code sign-in shares only your email address.
• Authentication/session data — sign-in timestamps, your account id, and session tokens used to keep you signed in and to access authenticated features (such as the desktop trade stream).

Account data is processed and stored by Clerk (Clerk's privacy policy) as our authentication provider, on our behalf. We use it only to authenticate you and operate your account — not for advertising or analytics. Our servers additionally log authentication events (account id, timestamp, IP address) in the same short-retention security logs described above. You can delete your account from the app's account settings or by emailing us — deletion removes the account and its associated personal data from Clerk.

Embedded content (third parties)

The dashboard embeds live video and news streams from third parties. When you choose to play them, your browser connects directly to those services and they can see your IP and standard request data:

• YouTube (Google) — embedded YouTube players follow Google's standard embed behavior and may set cookies on youtube.com.
• News HLS streams — Sky News, France 24, Deutsche Welle, Sky News Arabia, and TRT World are loaded from each broadcaster's own CDN.

BloHunter does not send any of your data to these services on your behalf — your browser simply connects to them when you watch.

Why we process the data we do

• Site operation, security, and abuse prevention — server access logs.
• Understanding how the site is used in aggregate — Google Analytics, only if you consent.

Lawful bases (GDPR)

• Consent (Article 6(1)(a)) — for Google Analytics and any non-essential cookies.
• Legitimate interest (Article 6(1)(f)) — for short-retention server access logs, to keep the site running and secure. We've balanced this against your interests: logs are minimal, retained briefly, and used only for site operation.

Cookies and similar storage

• bh_consent — localStorage, not a cookie. Stores your consent choice (granted or denied). Stays in your browser.
• _ga, _ga_2QK6J2RHT9 — set by Google Analytics, only if you accept. Typically persist up to 2 years.
• __cf_bm — set by Cloudflare for bot management. Short-lived (~30 minutes).

Third parties

• Clerk — authentication provider for BloHunter Desktop accounts; processes and stores account data (email, optional profile data, sign-in metadata) on our behalf. See Clerk's privacy policy.
• Discord, Google, and X — only when you choose to sign in with them; authentication happens directly between you and the provider under that provider's own privacy policy.
• Google LLC — Google Analytics, only with your consent.
• Cloudflare, Inc. — CDN, TLS, and DDoS protection in front of the site.
• Vultr Holdings — server hosting. They provide the underlying infrastructure but do not directly process visitor data.

Retention

• Server access logs: 7 days, then automatically rotated and deleted.
• Google Analytics data: per Google's retention settings (in aggregate; not tied to you by us).
• Your bh_consent choice: until you clear your browser storage.
• Account data (Clerk): retained while your account exists; removed when the account is deleted.

Your rights

If you are in the EEA, UK, or another jurisdiction that grants similar rights, you have the right to:

• Access, correct, or delete personal data we hold about you
• Object to or restrict processing
• Withdraw consent at any time (see below)
• Lodge a complaint with your local data-protection authority

In practice, because the website has no accounts, the only site data identifiably linked to a visit is in short-retention server logs and (if you consent) Google Analytics. If you want us to delete a specific log entry, email [email protected] with the date/time and IP of the visit; if the logs haven't already rotated out, we'll remove them. For a BloHunter Desktop account, you can access or delete your account data from the app's account settings at any time, or email us and we'll do it for you.

How to withdraw consent

• Clear the bh_consent key in your browser's localStorage — the consent banner will re-appear on your next visit, and you can decline.
• Install Google's opt-out add-on: tools.google.com/dlpage/gaoptout.
• Use your browser's "clear site data" option for blohunter.com.

Children

BloHunter is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided data, contact us and we'll remove it.

BloHunter Desktop application

BloHunter Desktop is a desktop application that mirrors supported BloHunter trade lifecycle events to a user-configured futures account and provides optional monitoring and Discord webhook alerts. It operates separately from this website: the application performs no analytics, sets no cookies, does no advertising or tracking, and loads no remote executable code into its trading runtime. (The sign-in screen loads Clerk's hosted authentication script from your Clerk instance domain to render sign-in; nothing else is loaded remotely.)

Data we store locally. BloHunter Desktop stores data locally on your device in an encrypted store protected by your operating system's encryption. This includes:

• an encrypted credential vault created from data provided by you
• trading settings such as order size, leverage, and max position settings
• API Lock settings and recent route verification results
• Discord webhook settings (only if you enable alerts)
• recent activity log entries
• local trade state, Hold state, Recovery state, OVERRIDE state, and sync diagnostics
• account equity history and close-history data used for dashboard monitoring

When you unlock the application by signing in, decrypted exchange credentials are held in memory only for the current unlocked session so the application can place or manage exchange requests. Those unlocked session credentials are cleared when the application is locked, closed, or the session ends. Any exchange credentials you provide are entered by you and stored locally in encrypted form on your own device; they are never sent to or stored by BloHunter. When you connect to authenticated features (such as the desktop trade stream), the application presents your Clerk session token to blohunter.com; tokens are verified server-side and are not stored by us beyond the security logs described above.

Data sent to third parties. The application makes network requests only to the services needed for its functionality:

• blohunter.com — to receive BloHunter trade lifecycle and policy data.
• openapi.blofin.com — to read account state and place or manage BloFin futures orders on your behalf.
• discord.com — for optional user-configured Discord webhook alerts; this is only used when you enable Discord alerts.
• www.cloudflare.com — to perform API Lock route verification.

How we use data. We use locally stored and remotely fetched data to:

• authenticate user-requested BloFin API access
• mirror supported BloHunter trade actions to BloFin
• enforce local trading safeguards such as API Lock, cooldowns, and exposure controls
• show monitoring and diagnostic information in the dashboard and popup
• send optional Discord notifications when enabled by you

What we do not do.

• We do not sell user data.
• We do not use BloHunter Desktop as a general advertising or tracking tool.
• We do not load remote executable code into the application runtime.

User controls. You can:

• enable or disable trading
• set, replace, or remove exchange credentials
• manage your sign-in session and account
• enable or disable Discord alerts
• configure API Lock behavior
• clear recent activity log data or reset the local application store

Retention. Most stored data remains in the local encrypted store until it is overwritten, cleared by you, or removed when the application is uninstalled. Some diagnostic and dashboard history stores are automatically bounded — for example, Account Growth history is capped at 10,000 samples and 45 days, while incident, sync, and close-detail stores use their own documented caps.

Changes to this policy

We'll update the "Last updated" date at the top whenever this policy changes.

Contact

Questions, requests, or complaints: [email protected].