Privacy Policy

PumpStriker / Bathyr Alpha Engine Version 1.1 · Effective: July 2026 · Data Collected by the Software: Zero

🔒 PRIVACY SUMMARY


> The Bathyr Software does not collect, transmit, store, sell, or share any user data with the Developer. All personal and sensitive data, wallet keys, positions, settings, trade history, is stored exclusively on the user's own machine. The Developer has no access to this data and operates no server to receive it. This is not merely a policy statement; it is an architectural fact verifiable by inspecting the open-source code.


> The single exception happens at purchase: the wallet address you paid from and the payment transaction ID (TXID), used only to verify your payment on-chain before your download unlocks. Both are already public on the Solana blockchain. Nothing else is ever requested. See Section 3.

1. Overview

This Privacy Policy ("Policy") describes how the Bathyr Software handles information in connection with its use. Unlike most software services, the Bathyr Software operates as a fully local, self-custodial application, all data processing occurs on your own computer, and no data is transmitted to the Developer's infrastructure, because the Developer operates no servers for this purpose.

This Policy also discloses the nature of the Software's interactions with third-party services, so that Users understand which external parties may receive data as a result of normal Software operation.

This Policy forms part of the Bathyr legal documentation package and must be read together with the Terms of Use (TERMS_OF_USE.md), the Risk Disclosure & Disclaimer (DISCLAIMER.md), and the Refund Policy (REFUND_POLICY.md).

2. Zero Data Collection by the Developer

The Developer does not collect any data from Users of the Software. Specifically, the Developer has no access to and does not collect:

  • Private keys, seed phrases, or wallet credentials of any kind
  • Trade history, position data, P&L figures, or portfolio information
  • User identity, email addresses, IP addresses, or device identifiers
  • Configuration settings, preference data, or strategy parameters
  • Usage patterns, session data, or analytical telemetry of any kind
  • Number of active users, installations, or deployments
  • Any communication data, Telegram IDs, or social identifiers
This is not merely a policy commitment, it is an architectural reality. The Software contains no telemetry, no analytics SDKs, no beacon calls, no heartbeat pings, and no mechanism to communicate with the Developer's infrastructure. Users who wish to verify this can inspect the open-source code directly.

Due to the distributed and community-operated nature of this Software, the Developer does not know and cannot know how many Users exist, how the Software is being used, or by whom.

The single, narrow exception to the above is the purchase and refund verification described in Section 3. It concerns the website checkout, not the Software itself.

3. The Single Exception: Purchase & Refund Verification (Website)

There is exactly one situation where we ask you for information: buying the Software on pumpstriker.fun, and, if it ever comes to it, requesting a refund. Even then, only two things are requested:

  • The wallet address you sent the payment from, and

  • The transaction ID (TXID) of that payment on the Solana network.

    • Why this is required. Payments are made in crypto directly on the Solana blockchain, with no payment processor and no account system in between. The only way to confirm that a payment is real, confirmed on-chain, for the correct amount, and sent to the official payment wallet, is to check the transaction itself. When you paste your TXID at checkout, the system verifies it on-chain before your download of the bot package is unlocked. You are also asked to sign a short message with the paying wallet; that signature proves you control the wallet and stops anyone else from claiming your purchase with a copied TXID. Without this verification step, access to the Software could not be granted safely.

    What this information is, and is not. A wallet address and a TXID are already public information: every Solana transaction is permanently visible to anyone on the public blockchain. Providing them to us reveals nothing that the blockchain does not already show. We do not ask for, and never will ask for, your name, email address, phone number, identity documents, KYC of any kind, seed phrase, or private key. There is no account and no registration.

    What we store and why. The verified TXID and paying wallet address are recorded in a private purchase ledger on the web server, outside the publicly accessible web root. This ledger exists for three purposes only: to prevent the same transaction from being used to claim more than one copy, to attribute your license (each delivered package is watermarked to its buyer), and to send an eventual refund back to the same wallet that paid. Standard security logs, including the IP address of checkout requests, are kept for fraud prevention and rate limiting. The web server may be located outside your country of residence; by completing a purchase you consent to this data being processed and stored wherever the server is hosted.

    Refund requests. A refund request asks for the same two identifiers, plus the bot's log file, which is used solely to confirm the Software did not run on your machine, and an optional contact email if you want a reply. See the Refund Policy for the full process.

    What we never do with it. We do not sell it, share it, rent it, use it for advertising, or link it to any other data. It is used exclusively to verify payment, deliver the Software, and honor the refund guarantee.

    4. Local Data Storage

    The Software stores the following data locally on your machine, within the directory where the Software is installed:

    FileContents
    data/wallets.jsonEncrypted wallet records. Private keys are encrypted using AES-256-GCM with a key derived from your Telegram Bot Token via SHA-256. The raw private key is never written to disk in plaintext.
    data/settings.jsonUser configuration: buy/sell preferences, slippage settings, signal thresholds, score tier presets, and strategy parameters.
    data/positions.jsonOpen position data: token contract addresses, entry amounts, entry timestamps, and wallet assignments.
    data/orders.jsonActive limit orders: take-profit, stop-loss, and trailing stop-loss orders associated with open positions.
    found_tokens.csvLocal CSV log of tokens discovered and scored by the Alpha Engine. Retained for user reference and backtesting.
    spotted_tokens.csvSecondary local log of all tokens spotted during scanning sessions.
    You are the sole custodian of all locally stored data. It is your responsibility to protect your machine and the Software's data directory from unauthorised access. The Developer assumes no responsibility for the security of data stored on your device.

    5. Third-Party API Interactions

    In the course of normal operation, the Software makes outbound HTTP and WebSocket connections to the following third-party services. Each connection may result in those services receiving certain data as described below. All such interactions are governed by the respective third party's own privacy policies and terms of service.

    Helius RPC (helius-rpc.com, sg-sender.helius-rpc.com)

    • Receives: Your Helius API key (from your .env file), standard JSON-RPC queries for Solana chain data (blockhash, balances, token accounts), and serialised transaction bytes when submitting trades.
    • Note: Helius may log API key usage, IP addresses, and request metadata per their own Privacy Policy.

    DexScreener (api.dexscreener.com)

    • Receives: Token contract addresses queried by the scoring engine for market data (price, volume, liquidity, transaction counts).
    • Note: No personal identifying information is transmitted. DexScreener may log IP addresses per their terms.

    GoPlus Security (gopluslabs.io)

    • Receives: Token contract addresses for smart contract security analysis (honeypot, mint authority, freeze authority, holder data, sell tax).
    • Note: Uses API key authentication. Subject to GoPlus's own Privacy Policy.

    InsightX Atlas (api.insightx.network)

    • Receives: Token contract addresses for proxy wallet and bubble map analysis.
    • Note: Uses API key authentication. Subject to InsightX's own Privacy Policy.

    Jupiter DEX (lite-api.jup.ag)

    • Receives: Swap quote requests including input/output token mint addresses, swap amounts, and your wallet's public key (a non-sensitive on-chain identifier that is already publicly visible on the Solana blockchain).
    • Note: Jupiter does not receive your private key. Your public key is sent only to obtain a swap quote and construct the transaction.

    Telegram Bot API (api.telegram.org)

    • Receives: Your Bot Token and Chat ID (configured by you in your .env file) to deliver alerts and process trading commands.
    • Note: All communications with Telegram are subject to Telegram's own Privacy Policy. The Developer has no visibility into your Telegram account or message history.

    Solana Public RPCs (Fallback Only)

    • In cases of primary RPC failure, the Software may fall back to api.mainnet-beta.solana.com or solana.drpc.org. These receive standard RPC queries and submitted transactions only, identical to Helius interactions.

    Important: All third-party API keys are configured exclusively by the User in their own .env file. The Developer does not supply, manage, rotate, or have access to the User's API keys or the data exchanged through them.

    6. Private Key Security Architecture

    Private keys stored by the Software are protected by the following security architecture:

    • Encryption algorithm: AES-256-GCM (authenticated encryption with integrity protection)
    • Key derivation: SHA-256 hash of the User's Telegram Bot Token
    • Stored format: JSON object containing IV (hex), encrypted ciphertext (hex), and GCM authentication tag (hex)
    • Storage location: Local filesystem only, at data/wallets.json
    • Runtime handling: Keys are decrypted in memory only at the moment of transaction signing and are never written to disk in decrypted form

    Critical Security Warnings

    • The security of your private key encryption is entirely dependent on the secrecy of your Telegram Bot Token. If your Bot Token is exposed, your encrypted key material may be at risk. Treat your Bot Token with the same care as a password.
    • Never share your .env file, data/wallets.json, or Bot Token with any third party under any circumstances.
    • The Developer strongly recommends using dedicated hot wallets with limited funds for use with this Software. Never connect wallets holding your primary long-term holdings to any automated trading bot.
    • If you suspect your Bot Token or wallets.json has been compromised, immediately transfer all funds to a new wallet that has no association with the Software.
    • The Software does not support hardware wallets or multi-signature schemes. All execution is done via software-managed keypairs.

    7. Local Logging

    The Software generates local console logs and CSV files for operational visibility and user reference. These logs are stored entirely on your local machine and include:

    • Token scoring events and signal detections (found_tokens.csv, spotted_tokens.csv)
    • Wallet analysis results (wallet-analysis-.csv, social-audit-.csv)
    • Console output via standard Node.js process stdout (not written to a file by default)
    These logs are never transmitted to the Developer or any central server. They exist solely for the User's own reference, analysis, and debugging. You may delete these files at any time without affecting core Software functionality.

    8. Open-Source Verification

    Because the Software is open-source, every claim made in this Privacy Policy can be independently verified by inspecting the source code. Users, security researchers, and distributors are explicitly encouraged to review the codebase to confirm:

    • No telemetry, analytics, or beacon calls are present in server.js or tg-bot.js
    • All outbound HTTP/WebSocket connections go only to the named third-party services
    • Private key encryption and local storage logic matches what is described in Section 6
    • No data is written to any remote endpoint under Developer control
    • All file I/O operations write only to the local filesystem
    Transparency is a core design principle of this Software. If any discrepancy is found between this Privacy Policy and the actual code behaviour, users are encouraged to report it publicly through official community channels.

    9. User Rights & Data Control

    Apart from the purchase ledger described in Section 3, the Developer holds no personal data about you, so traditional data subject rights (right of access, right to erasure, right to rectification) do not apply to the Developer in the conventional sense. For the purchase verification data itself, you may request a copy or correction at any time via the contact email; note that the record of a verified transaction must be retained while your license is active, because it is what prevents your purchase from being claimed by someone else. Beyond that, you retain full control over your own data:

    • Right to Delete: You can delete all locally stored data at any time by removing the Software's data directory. No data exists anywhere else to delete.
    • Right to Inspect: All data stored locally is in human-readable JSON or CSV format and can be inspected, modified, or exported at any time.
    • Right to Portability: Local data files can be copied, backed up, or transferred freely at your discretion.
    • Right to Audit: The open-source code provides complete visibility into how your data is processed.
    For data that may be held by third-party services (Helius, Telegram, GoPlus, InsightX, etc.), you must exercise your rights directly with those services under their own privacy policies.

    10. Children's Privacy

    The Software is not intended for use by persons under the age of 18. The Developer does not knowingly collect any data from minors. Since the Developer collects no data from anyone, this applies universally, but users under 18 are nonetheless prohibited from using the Software as stated in the Terms of Use.

    11. Changes to This Policy

    This Privacy Policy may be updated when new versions of the Software are released. Material changes will be noted in the Software's changelog or release notes. Your continued use of the Software after a policy update constitutes acceptance of the revised Policy.

    If you do not agree with any change to this Policy, your sole remedy is to cease using the Software and delete all local data files.

    12. Contact

    Questions or concerns about this Privacy Policy, including requests about the purchase verification data described in Section 3, may be directed to bathyrdev@pumpstriker.fun or the official Bathyr community channels. Given the minimal data involved, there is no designated data protection officer; requests are handled directly by the Developer.

    PumpStriker is operated by Bathyr Devs, IFZA, Building A2, Dubai Silicon Oasis, Dubai, United Arab Emirates.

    This Privacy Policy is part of the Bathyr legal documentation package. It must be read together with TERMS_OF_USE.md, DISCLAIMER.md, and REFUND_POLICY.md.

    Last reviewed concurrent with the release of the Software version to which these documents are attached.

    Terms of UseRisk Disclosure & DisclaimerRefund Policy (Full Legal Text)Refund Request Form