1. What we collect
- From the public site: Cloudflare access logs (IP address, user-agent, requested page, timestamp). Retained 30 days for security and abuse mitigation. No tracking pixels, no advertising cookies, no analytics scripts.
- From subscribers: the email address you provided at Gumroad checkout, your Gumroad license key, and a hash of your IP at first sign-in. We use these to validate your subscription and prevent abuse. Stored as long as the subscription is active plus 90 days after cancellation.
- From Academy email gate (optional): the email you enter to unlock modules 3-5. Used only to (a) save your progress locally and (b) ping you when content updates. You can opt out at any time by clearing site storage.
- From Telegram: standard Telegram metadata for the BMI Premium and free channels. Telegram operates under its own privacy policy; we don’t store conversations server-side.
2. What we do not collect
- Your wallet addresses or any on-chain identity (you execute on your own infrastructure).
- Any personally identifiable information beyond the email above.
- Behavioral or cross-site tracking data.
- Payment information — that lives with Gumroad and Telegram, not us.
3. Cookies & local storage
We use a small amount of browser local storage to (a) remember if you’ve unlocked the BABA App with a license key, (b) remember your privacy-mode setting, and (c) cache the Academy email gate. We do not set tracking cookies or third-party cookies.
4. Third-party data we surface
The site fetches public market data and on-chain state from third-party APIs — Hyperliquid, Polymarket, Aerodrome, HyperEVM DEXs, BlockScout, and similar. These third parties have their own privacy practices. The site does not share personal information with them; we only pull public market state.
5. How we store & protect
Subscriber data is held in encrypted-at-rest storage with Cloudflare KV and our hosting provider. The engine itself runs on private infrastructure and exposes only sanitized, aggregated data to the public Site and the subscriber dashboard. We follow the principle of least privilege.
6. Your rights
You can: (a) export the data we hold about you, (b) delete it (cancels active subscription), (c) opt out of any forward email communications. Email [email protected] with the subject line “privacy request” and we’ll respond within 14 days.
7. International users
The Site is operated from the European Union and serves a global audience. By using the Site you consent to your data being processed under EU law. Subscribers in the EU, UK, and California have additional rights under the GDPR, UK GDPR, and CCPA respectively; the procedure in Section 6 honors those rights.
8. Changes
We may update this policy by posting revisions here. Material changes will be flagged on the homepage for at least seven days.
This document is a plain-language summary; it is not legal advice and may not satisfy every jurisdiction-specific notice requirement. Consult counsel for complete compliance.
