Skip to main content
This Privacy Policy describes how Everstrike Labs (“Everstrike,” “we,” “us,” or “our”) collects, uses, shares, and safeguards personal information in connection with the Everstrike exchange, the Everstrike Assistant, AI strategies, the MCP server, the REST and WebSockets APIs, and related services. By accessing or using the Services, you acknowledge that your personal data will be handled as described in this policy.

​
1. Scope

This Privacy Policy applies to personal information collected when you: In this policy, “Services” refers collectively to Everstrike’s websites, applications, APIs, MCP server, and related services.

​
2. Information We Collect

We collect only the information we need to operate the Services, meet our legal obligations, and communicate with you.

​
2.1 Information You Provide

When you register, we collect your email address, a nickname, and your country of residence. This information is required to create and operate your account.
If you choose “Sign up with Google,” we receive the email address associated with your Google account through Google’s OAuth flow. This becomes the primary email for your Everstrike account and is retained until you close your account.
When you contact support, submit a support ticket, subscribe to a newsletter, or otherwise communicate with us, we retain a record of your correspondence for quality, security, and compliance purposes.
To comply with Know Your Customer (KYC), Anti-Money Laundering (AML), and Counter-Terrorist Financing (CTF) obligations, we may collect government-issued identification, proof of residence, and, for corporate users, corporate registration information verified against public company registers.
When you use DEX mode, we collect the public blockchain address of your primary wallet, the signed ownership message that links that wallet to your account, and the on-chain transactions you initiate through the Services. The ownership message is published to the blockchain and is publicly visible. We do not receive or store your private key or recovery phrase.
When you use CEX mode, Everstrike generates and stores a public key associated with your account and derives the corresponding deposit address. The private key is derived from an offline master key controlled by Everstrike Labs and is never exposed to the internet. See the CEX Mode documentation for the technical details.
When you use the Everstrike Assistant, we process the messages you send during a conversation in order to generate a response. When you create an AI strategy, we process your natural-language prompt each time the strategy is evaluated. See Section 8 for how prompts and completions are handled.
When you create an API key, we generate and store a hashed record of the associated secret. The plaintext secret is shown to you only once at creation time and is never retrievable afterwards. You are responsible for storing your secret key securely.
We store cryptographically hashed passwords, records of Two-Factor Authentication (2FA) enrollment, and metadata about active sessions and connected devices for the purpose of securing your account.

​
2.2 Information Collected Automatically

Standard web log information, including browser type, IP address, device identifiers, language preference, referring site, timestamp of access, operating system, and mobile network information.
Records of orders, trades, positions, funding payments, deposits, withdrawals, staking, minting, redeeming, and other account activity you carry out on the Services. This information powers your trading history, statistics, reporting, tax exports, and the event log for AI strategies.
For each AI strategy evaluation, we retain metadata about the event, including the market evaluated, the action taken, the AI’s confidence score, the reasoning text, the model used, and the number of tokens and credits consumed. Event metadata is retained so you can audit AI decisions.
We log API requests, WebSockets subscriptions, and MCP server calls for security, rate limiting, abuse prevention, and diagnostics. MCP server requests are logged by IP address rather than account, because the server does not require authentication.
We infer the approximate location of your device from your IP address to understand geographic usage patterns and to enforce jurisdictional restrictions described in Restricted Jurisdictions.
We use cookies and similar technologies to identify visitors, remember preferences, maintain sessions, and analyze usage. You can configure your browser to reject cookies, but some features of the Services may not function correctly as a result.

​
3. How We Use Information

We use the information we collect to:
  • Provide, maintain, and secure the Services, including account management, order placement, custody, and fund transfers
  • Operate and improve AI features, including strategy evaluation, event recording, and the Assistant
  • Develop and improve the Services and their user experience
  • Analyze usage trends and measure engagement and retention
  • Detect, prevent, and respond to fraud, market abuse, unauthorized access, and other unlawful activity
  • Verify your identity and comply with applicable KYC, AML, CTF, tax, and other legal and regulatory requirements
  • Enforce jurisdictional restrictions and our Terms of Service
  • Communicate with you about your account, security matters, service updates, and, where permitted, marketing
  • Personalize your experience and deliver relevant content
If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:
  • Contractual necessity to perform the Terms of Service and administer your account
  • Legal obligation to comply with applicable laws and regulations, including AML, CTF, tax, and sanctions requirements
  • Vital interests to protect your vital interests or those of another person
  • Legitimate interests to provide, secure, and improve the Services, communicate with you, and analyze usage
  • Consent where you have specifically opted in, for example to receive marketing communications

​
5. How We Share Information

We do not sell your personal information. We share personal information only in the following circumstances:
  • Service providers and sub-processors. Trusted third parties that assist us with hosting, identity verification, fraud prevention, email delivery, customer support, marketing, analytics, and AI model inference. These providers are bound by contractual confidentiality and data protection obligations. See Section 8 for AI-specific processors.
  • Affiliates and personnel. Employees, contractors, and affiliates who require access to perform their duties, subject to equivalent confidentiality obligations.
  • Legal and regulatory disclosures. Where required by subpoena, court order, regulatory request, sanctions screening, or applicable law, or to report suspected unlawful activity.
  • Protection of rights. Where reasonably necessary to protect the rights, property, or safety of Everstrike, our users, or the public.
  • Corporate transactions. In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to the acquiring party continuing to honor this Privacy Policy.
  • With your consent. Where you have expressly authorized disclosure to a specific third party.
  • Aggregated or de-identified information that cannot reasonably be used to identify you.

​
6. Public Blockchain Data

Blockchain transactions are, by their nature, public and permanent. When you deposit, withdraw, stake, mint, or redeem through the Services, or when you register a primary wallet in DEX mode, the associated transactions and signed messages are recorded on the underlying blockchain. Anyone can view these records, including the sending and receiving addresses and the transaction amount. Everstrike cannot alter, redact, or delete information that has been published to a blockchain.

​
7. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this policy or as required by applicable law:
  • Account information is retained for the life of your account and for a reasonable period afterwards to meet legal and regulatory obligations.
  • KYC and AML records are retained for the periods required by applicable financial regulation, typically five to seven years after account closure.
  • Web server logs are retained for approximately five years to support account security and incident investigation.
  • Trading and event records are retained for the life of your account to power reporting and audit features.
  • Information subject to legal hold, regulatory reporting, or ongoing claims may be retained for longer.
Deleted content may persist in encrypted backups until those backups are rotated out of retention.

​
8. AI Services and Third-Party Model Providers

The Everstrike Assistant, AI strategies, and other AI features rely on third-party large language model providers to generate responses. When you interact with these features:
  • Prompts and account context are processed by the relevant model provider on a transient basis to generate a response.
  • Account context is anonymized before it is included in an AI query, so it cannot be traced back to your identity by the model provider.
  • Prompts and completions are not retained by Everstrike after the interaction is recorded, other than the event metadata described in Section 2.2.
  • Model providers may process data under their own privacy terms. We select providers that offer commercially reasonable data protection commitments, including zero-retention or short-retention arrangements.
See the AI Privacy page for the technical details of how Everstrike handles AI queries. The MCP server is a public, read-only interface for market data. It does not receive account information and cannot place, modify, or cancel orders. MCP requests are logged by IP address for rate limiting and abuse prevention.

​
9. Automated Decision-Making

AI strategies may place, modify, or close orders automatically when the AI’s confidence score exceeds the minimum threshold you configure. These are automated decisions that produce financial effects. You control:
  • Whether a strategy is ACTIVE or PAUSED
  • The minimum confidence required before an order is submitted
  • The maximum trade quantity per order
  • Whether the Assistant runs in Safe Mode (explicit approval required) or Blitz Mode (no approval required)
You may disable AI features, restrict their permissions, or delete individual strategies at any time from your account settings. If you are subject to GDPR or a similar law that grants rights in relation to automated decision-making, you may also contact us to request human review of an AI-initiated action.

​
10. Security

We implement administrative, technical, and physical safeguards designed to protect your personal information:
  • All data submitted to the Services is transmitted over encrypted TLS connections.
  • Data at rest is encrypted using AES-256, and encryption keys are rotated on a regular schedule.
  • Passwords are cryptographically hashed using Bcrypt with a work factor of 12.
  • API secret keys are stored as one-way hashes and are never retrievable in plaintext after creation.
  • CEX mode custodial keys are derived from an offline master key that is never exposed to the internet.
  • Internal electronic communications are PGP-encrypted.
  • Access to personal data is limited to vetted, authorized personnel on a need-to-know basis.
No security program is perfect. You are responsible for maintaining the confidentiality of your account credentials, API secret keys, and, in DEX mode, your wallet recovery phrase. You should enable Two-Factor Authentication (2FA) in your account security settings.
Everstrike will never ask for your password, private keys, seed phrases, API secret keys, credit card number, bank account number, PIN, or similar sensitive information by email, text message, or any other channel. If you receive such a request from someone claiming to represent Everstrike, do not respond and contact support immediately.

​
11. Your Choices

You have several ways to control how we use your information:
  • Limit what you provide. You may choose not to submit optional information such as support chat messages.
  • Manage AI features. You may pause or delete AI strategies, disable the Assistant, or revoke API keys at any time from your account settings.
  • Manage marketing communications. Follow the unsubscribe instructions in any marketing email, or contact us directly. You will continue to receive essential account, security, and legal notices.
  • Manage cookies. Configure your browser to block or delete cookies. Some features of the Services may become unavailable.
  • Close your account. Contact support to request account closure. We may retain certain information after closure to comply with legal obligations, resolve disputes, and enforce our agreements.

​
12. Your Rights

Depending on your jurisdiction, you may have some or all of the following rights with respect to your personal data:
  • Access the personal data we hold about you
  • Request correction of inaccurate or incomplete data
  • Request deletion of your personal data
  • Object to or restrict certain processing activities
  • Request portability of your data in a machine-readable format
  • Withdraw consent where processing is based on consent
  • Request human review of automated decisions that produce significant effects (see Section 9)
You can exercise many of these rights directly from your account settings. For requests that cannot be handled in-account, contact support. Individuals in the EEA and UK also have the right to lodge a complaint with a supervisory authority. California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including the right to know what personal information is collected and the right to opt out of the sale or sharing of personal information; note that Everstrike does not sell personal information as defined by the CCPA.

​
13. Do Not Track and Global Privacy Control

Some browsers offer a “Do Not Track” (DNT) signal or a Global Privacy Control (GPC) signal. There is currently no industry consensus on how to interpret DNT, and we do not respond to DNT signals. Where required by applicable law, we honor GPC signals as a valid opt-out of the sale or sharing of personal information; because we do not sell personal information, GPC signals have no additional effect on how we process your data.

​
14. International Data Transfers

The Services are offered globally. Your personal information may be processed, stored, or accessed by personnel and service providers located outside your country of residence, including outside the European Economic Area and the United Kingdom. Where we transfer personal data internationally, we take appropriate steps to ensure that the recipient protects it in accordance with this policy and applicable law, including through standard contractual clauses where required.

​
15. Children’s Privacy

The Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact support so we can take appropriate action. The Services may contain links to third-party websites, applications, or integrations, including wallet software, blockchain explorers, and AI clients that connect to the MCP server. This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before providing personal information.

​
17. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the effective date, posting a notice on the Services, or sending you a direct notification. Your continued use of the Services after the effective date of any revision constitutes your acceptance of the updated policy.

​
18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact Everstrike support.