Privacy policy

Last updated: 1 November 2026 (chart signals)

PerpyX is an independent project, not affiliated with Bybit. This page explains what data we handle on this website and in the PerpyX app, and why. The short version: we collect only your email address when you join the beta, and the app keeps your exchange API keys on your phone.

Who is responsible

The data controller is Roman Spacek, Czech Republic, the developer of PerpyX. You can reach us at [email protected] with any question or request about your data.

Beta signup

When you join the beta, we store:

• your email address,
• the date and time you signed up and gave consent, and when you confirmed it,
• a random code used in the confirmation and unsubscribe links.

We send you one email with a link to confirm your address. Only confirmed addresses are on the list; unconfirmed signups are deleted after 30 days.

We use it only to invite you to the beta and to send you occasional important updates about PerpyX. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by emailing us or using the unsubscribe link in any email we send. We don't sell or share your email with anyone for marketing.

We keep your email until you unsubscribe or ask us to delete it, and in any case no longer than 24 months after your last contact with us.

Hosting and service providers

This website and the signup list are hosted by Cloudflare, Inc., which acts as our processor. Like any web host, Cloudflare processes technical data such as your IP address to deliver the site and protect it from abuse; we do not store IP addresses with your signup. Cloudflare may process data outside the EU under the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.

Emails are sent through Resend (Plus Five Five, Inc., USA), which acts as our processor and sends from its EU region. It processes your email address and the content of the messages only to deliver them. As a US company it may access data from the USA; transfers are covered by the EU Standard Contractual Clauses.

Emails you send to us (for example to [email protected] or [email protected]), our replies, and reports from the app are stored in our mailbox at Zoho Mail (Zoho Corporation B.V., the Netherlands), which acts as our processor and keeps the data in its EU data centre.

The PerpyX app itself is served from GitHub Pages (GitHub, Inc., a Microsoft company, USA). Like any web host, GitHub processes the IP address of your device when the app loads or updates; we receive no data from it. Transfers are covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.

The alert server that watches prices for your price alerts runs at Hetzner Online GmbH (Germany, EU), which acts as our processor. Push notifications are delivered through Firebase Cloud Messaging (Google Ireland Ltd. / Google LLC, USA), which acts as our processor; transfers are covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. What they process is described under “Price alerts” below.

If we add other providers — for example Google Play for distribution and payments — we will list them here before they are used.

No cookies, no tracking

This website uses no cookies, no analytics and no third-party scripts or fonts. Our emails contain no tracking pixels and no tracked links.

PerpyX account

To use the app you sign in with your email address (a one-time code, no password). We store:

• your email address and when the account was created,
• a sign-in session per device (stored only as a one-way hash),
• backups of your app data — watchlists, drawings, price alarms, indicator and app settings. Each change creates a new version; we keep versions for 30 days and always the latest one. API keys are never part of a backup.
• one record per day on which you used the app, with the app version. We use it to understand how many people use PerpyX and how often (for example daily and monthly active users) — nothing about what you do in the app.

The legal basis is the performance of the service you asked for (Art. 6(1)(b) GDPR) for the account and backups, and our legitimate interest in understanding and improving PerpyX (Art. 6(1)(f) GDPR) for the daily usage record. Sign-in codes are sent by email through Resend. A session unused for a year expires. You can delete your account and all its backups at any time in the app (Settings → PerpyX account → Delete account); accounts unused for 12 months may be deleted after we notify you by email.

Price alerts

So that your price alerts work even when your phone is asleep, the app sends them to our server: the pair, the alert level (or the points of the line, or the time), the condition, whether it repeats, when it expires, your optional message and the app language. It also sends a push token — a random identifier Android issues for notifications to your device. Our alert server reads public prices from Bybit and, when a level is crossed, sends a notification through Firebase Cloud Messaging; Google receives the push token and the notification text (the pair, the price and your message). We record when an alert fired, so the app can show it.

Chart signals. If you turn on chart signals for a pair (the bell in the RSI panel), the app also sends that pair (only the pair name), the chosen timeframes and when to notify you. Our alert server downloads public candles for these pairs from Bybit and Binance and, when a signal such as an RSI divergence appears, sends a notification the same way as a price alert (the pair, the signal and the timeframe). Deleting a signal in the app removes it from the server too.

Your API keys and the details of your positions (size, side, prices), orders and balances are never sent to the alert server. The legal basis is the performance of the service you asked for (Art. 6(1)(b) GDPR). An alert you delete in the app is deleted on the server too; signing out removes the push token of that device, and deleting your account deletes all your alerts and tokens.

Invites (referrals)

You can invite friends with a personal link (perpyx.com/ref/<your invite name>). We store the invite name you choose; it is shown to anyone who opens your link. When someone joins the beta through your link, we store your invite name with their signup, and when they later sign in to the app with the same email (or enter your invite name in the app), we link their account to yours.

If you join the beta waitlist, you get a personal link as soon as you confirm your email. Its invite name is made from the first four characters of your email address plus three random characters (for example noeg-7k2), so your full address can't be read from it; you can change it later in the app. When someone who joined through your link confirms their email, we send you a short note with the number of friends who joined (at most one such email a day). When you sign in to the app with the same email, your account keeps the same invite name.

You see how many people joined through you and, for each of them, a masked email (only the first two characters, for example ro*******.***) and whether they signed up, started using the app, or became active. We count a person as active from their daily usage record described above — nothing about what they do in the app. The legal basis is our legitimate interest in running the invite programme (Art. 6(1)(f) GDPR). Deleting your account removes these links; if you were invited, the person who invited you no longer sees you.

Reports from the app

During the beta you can report a problem or an idea from the app. We receive your text, any screenshots you attach and basic technical details (app version, phone model and Android version, screen size, language, the screen you were on and the last error message). Your API key is never included. The report is emailed to us through Resend and we reply to your account email. We keep the text and technical details to follow up on your report; the screenshots are only in our mailbox, and we delete reports when they are no longer needed or when you delete your account. Screenshots can show your balances or positions — attach only what you are comfortable sharing.

The PerpyX app

• Your Bybit API key and secret are stored only on your device. They are never sent to us.
• Requests to Bybit are signed on your device; only the signature is sent to Bybit, not the secret.
• The app talks to Bybit directly. Your positions, balances and orders are not sent to us. Bybit receives your requests (and so your IP address) as it does from its own app; it is a separate controller under its own privacy policy. Your drawings, alarms and settings are stored on your device — and, only if you sign in to a PerpyX account, backed up as described above.
• PerpyX works with read-only keys and cannot place orders; it refuses keys that can trade or withdraw.
• The optional app lock (PIN, with fingerprint as a shortcut) stays on your device. The PIN is stored only as a salted hash; your fingerprint is checked by Android and never reaches the app or us.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw your consent at any time. To exercise any of these rights, email [email protected]. You also have the right to lodge a complaint with a data protection authority — in the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ), or the authority in your own EU country.

Changes

If we change this policy, we'll update the date above. If a change affects how we use your email, we'll tell you by email first.