Privacy Policy

HWMF operates hwmf.io, the HWMF Telegram bots (Harvey and Hercules) and related community services.

For any privacy question or request, write to us on Telegram: @acetomov, @RodriXNetwork, @Matty_HWMF.

• We do not sell your data, show advertising, or use analytics or tracking tools.
• We never ask for, receive or store private keys or seed phrases - only public wallet addresses.
• We use one cookie, and only to keep you signed in.
• Passwords are stored only as salted hashes, and the database is encrypted.
• You can ask us at any time to see, correct or delete your data.

The legal basis for each item is in brackets (Art. 6 GDPR): contract = providing the membership you asked for, legitimate interest = keeping the service secure and working, legal duty = records the law requires us to keep.

Account (contract). Email address, username and a salted hash of your password - never the password itself. If you turn on two-factor login we store the 2FA secret and hashed recovery codes. We use these to sign you in and to send account emails such as verification or password reset where email sending is enabled.

Membership access (contract). The public wallet address you connect, and what that wallet holds on-chain, read from the public blockchain. This decides your tier and what you can see; it happens automatically, with no other profiling.

Telegram (contract). Your Telegram ID and username when you verify your membership or use Harvey or Hercules, so the bots can recognise you, approve your join request and send you messages you asked for.

Portfolio tracker (contract). The wallets and holdings you add, and the value history we record so we can draw your charts. Only you can see it.

Notifications and preferences (contract). Which notifications you have read or dismissed, and your sign-in session.

Security data (legitimate interest). Your IP address is held briefly in memory to limit abuse (rate limiting and login protection). Sign-ins and administrative actions are recorded in an activity log, including time and IP address for administrator sign-ins. Our web server may also keep standard access logs (IP address, time, page requested) for a limited time to detect attacks and fix errors.

Hercules (contract, legal duty). If you use Hercules: your Telegram ID and username, deposit address, balance, trade history, the withdrawal addresses you give us, fee records and related transaction IDs. See the Hercules section below.

We pass data on only where a service needs it to work. None of the following receive your email address or password.

• Telegram delivers bot messages and group invitations. It receives what you send to the bots and your Telegram profile as you use it.
• Market and blockchain data providers - Helius (Solana), Hyperliquid, Binance, CoinGecko, GeckoTerminal, DexScreener and Jupiter. Our server sends them public wallet addresses, token addresses or trading pairs to read prices and balances. Our server makes these requests, not your browser, so these providers do not see your IP address. The exception: in the portfolio search, token logos may load directly from the providers' image servers, which then see your IP address.
• Hercules services - Circle (CCTP transfers), the Arbitrum network and Hyperliquid, to move and trade funds on your behalf.
• Our hosting provider runs the server on which the data is stored and processes it on our behalf.
• Authorities, where we are legally required to disclose data.

Some of these providers are located outside the EU/EEA, for example in the United States. Where personal data goes there, it is limited to what the service needs (typically public wallet addresses or trading pairs), and the providers rely on their own transfer safeguards.

If you use Hercules, you deposit USDC to a Solana address we generate for you. Deposits are held in wallets we control and traded on a Hyperliquid account we operate; your share is tracked in our records. Trades follow fixed rules and run automatically for everyone who has joined. This is not profiling: it does not evaluate you, only your balance.

Hercules deletes anything that looks like a private key or seed phrase from the chat, and you should never send one. Deposit, trade and withdrawal records are kept for as long as accounting and financial rules require, even after you stop using Hercules.

Trading with leverage can lose your deposit. This policy explains data handling only; it is not financial advice.

Deposits, withdrawals and trades are recorded on public blockchains such as Solana, Arbitrum and Hyperliquid. Anyone can read that information and nobody - including us - can delete or change it. Wallet addresses are pseudonymous, but if an address is linked to you it becomes personal data. Please keep this in mind before you connect or use a wallet.

We set one cookie to keep you signed in. It is strictly necessary for the service, so no consent banner is needed, and it is not used for tracking. It is marked HttpOnly (scripts cannot read it) and Secure (sent over HTTPS only).

Your browser also stores one small setting on your device: whether you have already opened the Telegram group from the getting-started card. It never leaves your device.

• Passwords are stored as salted bcrypt hashes. Two-factor login is available and recommended.
• The database is encrypted at rest. Connections to the site use HTTPS.
• Sign-in attempts are rate limited and accounts lock after repeated failures.
• Administrator sessions expire sooner than member sessions, and administrator actions are logged.
• Uploads are checked and stored away from the program files. Access is limited to the people who need it.

No system is perfectly secure. If a breach puts your data at risk, we will tell the people affected and the authorities as the law requires.

• Account and membership data: as long as your account exists. When you ask us to delete your account, we remove your personal data.
• Activity log: the most recent entries only; older ones are removed automatically.
• Notifications: the most recent ones only.
• Portfolio history: while your account exists; older data is thinned out over time.
• Hercules and payout records: for the period the law requires for financial records, even after account deletion.
• Blockchain data: permanent, outside our control.

Under the GDPR you can ask us to: give you access to your data, correct it, delete it, restrict how we use it, give you a copy in a common format, and stop using it where we rely on legitimate interest. You can withdraw any consent you gave, at any time, without affecting what happened before.

To use a right, contact us (see Who is responsible). We answer within one month. To protect your account we may ask you to confirm it is you, for example by writing from your verified Telegram account.

You can also complain to the data protection authority of your country or place of residence.

Age. HWMF is for people aged 18 and over. We do not knowingly collect data from minors.

Links. We link to Telegram, X, marketplaces and explorers. They have their own privacy policies, which we do not control.

Changes. If we change this policy we update the date above, and announce significant changes in the HWMF Telegram.