Privacy Policy

Mishmar Inc. decides how and why the information described here is used, which makes it the “controller” under the laws that use that word. Write to support@mishmar.io about anything in this policy.

• Visit counts. The website and the docs load Umami Cloud’s script, which records the pages you view with their address (including tags such as ?ref= and utm_ in the link), the site that sent you, your browser, operating system, device type, screen size and language, your approximate location (country, region and city, worked out from your IP address), and these actions: on the website, clicking a link to the testnet sign-up, the docs or the demo; in the docs, copying a command or code example with its copy button, and the step of the guide it is in. Umami sets no cookies and, by its own description, does not store your IP address. We use the counts to see which pages and links bring people, and how far readers get through a guide.
• Hosting. Firebase Hosting serves the website and the docs. Like any web host, it receives your IP address and browser details in order to deliver the pages.

Neither sets cookies. The docs keep your choice of light or dark theme in your browser’s local storage (starlight-theme), and which sidebar sections you opened in session storage (sl-sidebar-state), gone when you close the tab.

• Email address. Your user is your email address. We use it to send you sign-in links and the emails listed below, and to show the other people in your accounts who you are. When you approve or reject an order, the account’s records, the audit ledger included, keep your email address as the person who decided.
• When. When you created your user and when you last signed in.
• Sign-in links. We store a fingerprint (a hash) of each link, not the link itself, with the address it was sent to and when it was made, when it expires (after 15 minutes) and when it was used. An invitation also stores the account, the role and who sent it, so if someone invites you, we hold your email address before you sign up.
• Sessions. When you sign in, we set a session cookie and store a hash of its token, when the session started and when it ends (after 30 days), when you last proved a passkey or wallet in it, and your browser’s user-agent string. Signing out deletes the session.
• Passkeys. The passkey’s ID and public key, what your browser reports about it (such as the authenticator’s model identifier and a use counter), the name you give it, and when you added it and last used it. Your face, fingerprint or device PIN never leave your device.
• Wallets. The wallet’s public address, the name you give it, when you added it and last used it, and the messages you are asked to sign with it. A wallet address is public on its blockchain; adding one links it to your email address in our records. We never receive a wallet’s private key or seed phrase.
• Accounts and people. Each account’s name, plan and owner; its members, their roles and who invited them; open invitations; whether you want approval emails; and the account’s API tokens, with their name, role, who made them, when, and when each was last used. Tokens, like sign-in links and sessions, are stored only as hashes.
• Keeping the account running. When the account last took a call and whether it is running or stopped, and, for the expiry warnings below, each active trading key’s agent name, trading account name and expiry date.

Each account has its own engine, with its own database, and its own signer service. They hold what you and your agents put in, and what the exchanges send back:

• Trading accounts: their names and exchange; for Hyperliquid, the master wallet’s address; for Binance, a read-only API key and its secret, stored encrypted.
• Agents: names, descriptions, portfolios and status, and each agent’s public key. The agent keeps its private key.
• Trading keys: for each agent and trading account, the public key or API wallet address, the key ID the exchange issued, the results of our checks (withdrawals off, IP allowlist on), status and expiry. Mishmar’s share of each key is held by the signer service, encrypted; your agent’s share never reaches us.
• Configuration: portfolios, allocated capital, rules, and a record of every change to them.
• Orders: every proposal your agent sends, the verdict, the rules it was checked against and the numbers they were judged on, the signatures, the exchange’s answer, and approvals with who decided, when, and any comment.
• From the exchanges: fills, positions, prices, equity, funding, transfers in and out, trades Mishmar did not place, and daily profit and loss.
• The audit ledger: an append-only, hash-chained record of decisions, approvals and fills. Each entry is chained to the one before it, so entries cannot be changed or removed one at a time; the ledger goes when the account’s data is deleted.

Most of this is about trading rather than about you. We use it only to run your account: to check and co-sign orders, to show you what happened, and to send the emails below.

To place and follow your agents’ orders, your account’s engine talks to Hyperliquid’s testnet and Binance’s demo trading. It sends orders and cancels signed with the agent’s trading key, reads balances, positions, fills and orders with the master wallet’s address or the read-only key, and reads market prices. These requests come from Mishmar’s own IP addresses, not yours. The exchanges are independent of us: what they do with this is governed by their own terms and privacy policies.

Resend delivers our emails, which come from notifications@mishmar.io. The service sends only these:

• sign-in and sign-up links, and invitations into an account;
• a notice when a passkey or a wallet is added to or removed from your user;
• a notice that an approval is waiting, with a link to it and nothing about the order. An account’s owner gets these from the start; approvers and admins can turn them on, and anyone can turn theirs off, under Profile;
• to an account’s owner and admins: warnings 7, 2 and 1 days before a trading key expires, and before an unused account is removed, and a notice when the address the account’s orders leave from changes.

We also keep every user’s address as a contact at Resend, so we can send news about Mishmar now and then, such as when real money opens, and send one welcome email to an address the first time it reaches that list. Every news email has an unsubscribe link. Unsubscribing stops the news only: the emails above still come, because the service needs them.

Our servers log each request’s method, path, status and how long it took, and events such as these: a sign-in link sent, or an email that failed, with the address it went to; a sign-in, with your user ID; an account created. They do not log your IP address. The logs are kept in Google Cloud Logging.

To slow down abuse, the service counts recent requests per IP address, in memory, for up to about an hour, and never writes those counts down. Google’s load balancer, which receives every connection first, processes your IP address to route it and may record it in its own request logs.

The console uses these, and nothing else:

mishmar_session

A cookie set by api.testnet.mishmar.io that keeps you signed in. Scripts on the page cannot read it, it is sent only over HTTPS, and it lasts 30 days or until you sign out.

sidebar_state

A cookie on app.testnet.mishmar.io that remembers whether the sidebar is open, for 7 days.

mishmar.theme

Local storage: whether you chose the light or the dark theme.

mishmar.account

Local storage: the account you last opened.

mishmar.proofPromptDismissed

Session storage, gone when you close the tab: whether you dismissed the prompt to add a passkey.

mishmar.reloadedForBuild

Session storage, gone when you close the tab: when the console last reloaded itself for a new version.

All of them are needed for the console to work or to remember your choices. The console has no analytics, advertising or other third-party scripts, and neither the website nor the docs set cookies.

Where the law asks us to name a legal basis, as in the European Economic Area and the United Kingdom, these are ours:

• Contract: to give you the service you signed up for: your user, sign-in, your accounts and their engines, and the emails that come with them.
• Legitimate interests: to keep the service secure and free of abuse (logs, rate limits), to count visits to the website and the docs, and to send our users a welcome and news about Mishmar. You can object to these, and unsubscribe from the news at any time.
• Legal obligation: when a law requires us to keep or disclose information.

We do not sell your personal information or share it for advertising. These providers handle it for us:

Google Cloud

Runs the hosted service: its servers, the databases, the signer’s encrypted key shares, the encryption keys (Cloud KMS), secrets, logs and the load balancer.

Resend

Delivers our emails: your address, the subject and the text, which can name your account, agents and trading accounts. Keeps every user’s address as a contact, and whether they unsubscribed, for the news.

Firebase Hosting

Serves mishmar.io, the docs at docs.mishmar.io and the demo at demo.mishmar.io (Google).

Umami Cloud

Counts visits to mishmar.io and docs.mishmar.io.

Google Workspace

Our email, including what you send to support@mishmar.io.

Our own staff see account records only through an internal console on a private network, to run the service and to help you.

We may also disclose information when the law requires it, to protect the service, our users or others from harm or fraud, or to a company that takes over Mishmar, which would then be bound by this policy. The exchanges you connect are not our providers: you choose them, and they act under their own terms.

Nor is Discord. If you join our server at mishmar.io/discord, Discord’s own terms and privacy policy cover your Discord account and what you post, and everyone in the server can read what you post in its channels. We see your Discord username and your posts, and use them to answer you.

The hosted service runs in Google Cloud’s Tokyo region (asia-northeast1), in Japan: the servers that handle your requests, the databases and the encrypted key shares. Some of our providers process data elsewhere, including in the United States, where Resend sends our emails from, and Google may keep some of it, such as logs, in other regions. Mishmar Inc. is a United States company. Where the law requires safeguards for these transfers, we rely on the ones our providers offer, such as the European Commission’s standard contractual clauses.

• Your user, its passkeys and wallets, and your memberships: until your user is deleted.
• Sessions: until you sign out or the session ends (after 30 days); records of ended sessions are deleted within the hour. Sign-in and invitation links: deleted a week after they were used or expired. Passkey and wallet sign-in challenges: deleted within the hour after they expire.
• An account’s data in its engine and signer service: while the account exists. A free account not used for 90 days is removed: its database (agents, keys, rules, orders and ledger), its key shares and their storage are deleted. We warn its owner and admins 7, 2 and 1 days before. The account’s name, members and settings stay, so you can sign in and start again with an empty account.
• Earlier versions of the encrypted key shares: 30 days after they change, and no longer than the account.
• Database backups: up to 14 days, so deleted information can remain in them until they expire.
• Logs: as long as Google Cloud Logging keeps them, 30 days by default.
• Your contact for the news at Resend: while your user exists. If you unsubscribe, Resend keeps your address marked as unsubscribed, so the news does not reach you again.
• If we reset or end the testnet service, we may delete any of it sooner.

Depending on where you live, you may have the right to access your personal information, to correct it, to delete it, to receive it in a portable form, to restrict or object to how we use it, and to withdraw your consent. We offer these to everyone: email support@mishmar.io from the address on your user, and we will answer within 30 days. We may ask you to confirm that it is you.

You can also do some of it yourself:

• see your email address, passkeys and wallets under Profile, and remove passkeys and wallets there;
• turn approval emails on or off for each account, under Profile;
• unsubscribe from the news, with the link in any news email;
• sign out, which ends the session;
• read your account’s data in the console and through the API, and export the audit ledger;
• as an owner or admin, remove members, withdraw invitations and revoke API tokens.

There is no button yet to change your email address or to delete your user: we do both by hand when you ask. Deleting your user also deletes the accounts you own and everything in them. The audit ledger cannot be edited, so an entry that names you goes only with the account’s data.

If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority.

• Every connection to Mishmar uses HTTPS, and Google Cloud encrypts everything the service stores.
• Sign-in links, session tokens and API tokens are stored only as hashes, and the session cookie cannot be read by scripts on the page.
• Mishmar’s share of each trading key, and read-only exchange keys, are encrypted again under keys held in Google Cloud KMS.
• Each account runs in its own engine, with its own database.
• Mishmar holds only one share of each trading key, so a breach at Mishmar alone cannot sign an order.
• Approving an order takes a passkey or wallet proof from the last 10 minutes, and so does changing your passkeys or wallets once you have one.

No system is perfectly secure. If a breach affects your personal information, we will tell you as the law requires. To report a vulnerability, follow our security policy.

Mishmar is not for anyone under 18, and we do not knowingly collect information from children. If you think a child has given us information, email support@mishmar.io and we will delete it.

When what we collect or how we use it changes, so will this page, with a new date. For a change that matters, we will tell you by email or with a notice on this page before it takes effect.

Write to Mishmar Inc. at support@mishmar.io about your information or this policy.