Privacy

What Hyprr stores, what it doesn't, and where the data goes.

Wallet keys

Hyprr never asks for your main wallet’s private key or seed phrase. The link flow uses WalletConnect: your wallet app holds the key, Hyprr only sees the signed messages your wallet returns.

When you link a wallet, Hyprr generates a fresh agent key locally on your device. You approve this agent key once via WalletConnect (Hyperliquid’s approveAgent action). From then on, order signing happens locally with that agent key — your main wallet is only used to revoke the agent if you want to disconnect.

The agent key is stored on-device:

• Android: in an SQLCipher-encrypted database. The encryption passphrase is held in Android’s hardware-backed Keystore via EncryptedSharedPreferences.
• iOS: in a SQLite database protected by NSFileProtectionCompleteUntilFirstUserAuthentication — AES-256 at rest with a per-file key derived from your passcode entangled with the device’s hardware key; unreadable on a stolen device that hasn’t been unlocked since boot.

The database is excluded from cloud backup (Android allowBackup=false + iOS NSURLIsExcludedFromBackupKey).

Network traffic

Hyprr contacts three sets of servers, and nothing else:

• Hyperliquid — https://api.hyperliquid.xyz (REST) and wss://api.hyperliquid.xyz/ws (WebSocket) for market data and orders. We pin Hyperliquid’s TLS certificate chain so a compromised CA can’t intercept the traffic.
• WalletConnect — Reown’s public relay, only while you’re actively linking a wallet. Payloads are encrypted end-to-end between your device and your wallet app; Hyprr never proxies wallet signatures through our infrastructure.
• Crash reporting — crash.codeskraps.com, only when an exception fires. See Crash reports below.

Analytics

No usage analytics, no behavioural telemetry, no advertising IDs. Hyprr does not track which screens you visit, which assets you view, or how often you trade.

Crash reports

Hyprr ships unhandled exceptions and selected non-fatal errors to a self-hosted GlitchTip instance at crash.codeskraps.com (no third parties involved — the backend is operated by the same developer as the app).

Each report contains:

• the exception type, message, and stack trace,
• the app release (e.g. 1.1.1) and environment (mainnet or testnet),
• the Sentry SDK’s default device context — model, OS version, locale, free memory at crash time,
• the Sentry SDK’s automatic breadcrumbs from the minutes before the error: the app going to the background or foreground, network type changes, battery level, screen rotation and low-memory warnings,
• on Android, steps of the WalletConnect link and signing flow (for example “pairing request sent to wallet”, “session approved”, relay connected or disconnected, with timings), the package names of the installed wallet apps that can open a WalletConnect link, and the name of the wallet you connected (e.g. “MetaMask”), so we can tell where a failed link got stuck,
• a random installation ID created by the crash SDK, which lets us see that several reports came from the same install. It is not derived from your wallet, account or phone number, and reinstalling the app creates a new one,
• the IP address the report was sent from, as seen by the crash server.

Each report does not contain:

• your wallet address — any 0x + 40-hex-char string in an exception message is redacted to 0x….<last4> on-device before the event is queued for upload, and the WalletConnect steps above never include addresses,
• your agent key, signatures, or any database contents,
• screen contents, what you tap, or which screens you visit,
• your name, email or any account identifier (Hyprr has no accounts).

Hyprr sends no performance traces (timing samples); only crash and error reports, all of them.

There is no in-app opt-out at the moment. If you want to disable crash reports entirely, the only option today is to block crash.codeskraps.com at the network level; an in-app toggle is on the roadmap.

Contact

Privacy questions or data requests: me@codeskraps.com.

To delete data collected by the app, see the data deletion request page.