Legal
Privacy & Cookies
What HafizeBot collects, why, how long it is kept, and how to get it removed.
This site is operated by HafizeBot. For anything on this page — access, correction, deletion, or a complaint — write to [email protected].
What we collect
If you only read the site
Nothing that identifies you, unless you accept analytics. Our host and CDN process your IP address and user agent to serve pages and absorb abuse; those server logs are kept for a short operational period and are not used to build a profile of you.
If you sign in
Signing in uses the Telegram Login Widget. Telegram hands us your numeric user ID, your first and last name, your username and your profile photo URL, signed so we can verify it came from Telegram. We store what we need to recognise your account across visits and to match it to your conversation with the bot. We never receive your phone number or your Telegram password.
If you use autotrading
Autotrading needs a Binance API key and secret that you create yourself. These are encrypted before they are written to our database. We ask you to create them with futures trading permission only — withdrawal permission is never required, and we cannot move funds out of your Binance account. You can delete your keys from your account page at any time, which stops autotrading immediately.
Alongside them we keep your trading settings, the orders placed for you, your balance ledger, the transfer IDs of USDT deposits you credit, and the plans you buy. An internal audit log records changes to security-relevant settings so that a disputed change can be traced.
If you accept analytics
We use Google Analytics 4 to see which pages people find useful. It records the page you viewed, roughly where in the world you are, and which site or campaign sent you. We do not send it your name, your Telegram ID, your email or anything else that identifies you, and we do not use it for advertising.
Analytics runs under Google Consent Mode with every storage signal set to denied until you accept. Declining means nothing is stored on your device; the tag still loads and reports an anonymous, cookieless page view so that we can count traffic at all. Accepting lets it set its own cookies and recognise a returning browser. Either way you can change your mind — see Cookies below.
Why we are allowed to
- Contract — your account, signals, payments and autotrading exist because you asked for them.
- Legitimate interest — keeping the service up, preventing abuse, and the audit log.
- Consent — analytics, and only analytics. Withdrawing it costs you nothing else.
Cookies and local storage
| Name | What it is for | Life |
|---|---|---|
hb_session | Keeps you signed in. Strictly necessary; set only after you sign in. | 30 days |
hb_csrf | Protects account forms against cross-site submission. Strictly necessary. | 30 days |
hb-consent | Local storage, not a cookie. Remembers whether you accepted analytics, so we stop asking. | Until cleared |
_ga, _ga_* | Google Analytics. Set only if you accept. | Up to 2 years |
To change your answer, use — here or in the footer of any page. It clears the stored choice, tells the analytics tag to stop, and asks you again.
Who else sees it
We do not sell personal data and we do not share it for advertising. It reaches only the providers we need to run the service: our hosting and CDN provider, Telegram (for the bot and sign-in), Binance (for the orders you asked us to place), and Google (analytics, if you accepted). Some of these process data outside your country; transfers rely on the providers' own standard contractual clauses.
How long we keep it
Account data and the trading records tied to it are kept while your account exists and for as long afterwards as we are required to keep financial records. API keys are kept until you delete them. Analytics data follows Google's retention setting on our property. Server logs are kept for a short operational window.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interest, or withdraw analytics consent at any time. Deleting your account removes your keys and settings; records we are obliged to retain are kept in a minimised form. If you are in the EEA or the UK you may also complain to your national data protection authority.
Requests go to [email protected]. We aim to answer within 30 days.
Changes
If this policy changes materially we will say so on the site before the change takes effect.