Privacy Policy

Who is responsible

The Troya Agent operator runs the website, the app at /agent, the MCP server and the API, and is responsible for the data described here.

What we store

• Wallet address. When you sign in, we store the public address you signed with so your settings, journal and inbox belong to you. We never receive your seed phrase or private key.
• Journal. A record of proposals, signatures, refusals and Agent Wallet actions, with the reason the agent gave and the rule that applied. This is what makes the audit trail possible.
• Settings and limits. Your caps, allowlist, playbooks, notification choices and similar preferences.
• Assistant conversations. Messages you send the assistant and its replies, so the chat keeps context and so we can count your daily allowance. Memory features, where offered, can be switched off and cleared.
• Agent Wallet. If you turn it on, its private key is stored encrypted on our servers, together with its address and activity.
• API tokens. Stored as hashes; we can tell a token is valid but cannot show it to you again.
• Basic server logs. IP address, time and request path, kept briefly for security and rate limiting.

What lives only in your browser

Some conveniences, such as having accepted the notice, your default slippage and your last connected wallet, are saved in your browser's local storage. They never leave your device and you can clear them at any time.

What is public anyway

Transactions on Elysium, HyperEVM and Hyperliquid are public by nature. Anyone can see an address's activity on chain; that is a property of the networks, not something we control.

Who we share data with

We do not sell your data and we do not use it for advertising. To answer a question, the assistant may send the relevant text to an AI model provider chosen by the operator; to fetch market data and send transactions, the service talks to blockchain nodes and venue APIs. Those requests contain what is needed for the task, such as an address or an order, and nothing more. We may disclose data if the law requires it.

How long we keep it

Your journal and settings are kept while your account is in use, because the audit trail is only useful if it is complete. Server logs are rotated within a short period. If you ask us to delete your data, we will remove what we are not legally required to keep; the journal of past executions may be retained for a limited time for security and dispute purposes.

Your choices

• Use Troya without signing in to read markets; only chat, the inbox, playbooks and the Agent Wallet need a session.
• Export your Agent Wallet key, withdraw its funds and delete it from the app.
• Revoke API tokens at any time.
• Ask for a copy or deletion of your data through the operator link in the app footer.

Security

We encrypt Agent Wallet keys at rest, hash API tokens, use HTTPS, and limit who can reach production systems. No system is perfectly secure, which is one more reason to keep the Agent Wallet small.

Changes

If this policy changes, the date at the top will change and material updates will be noted in the app. See also the Terms of Use.