Privacy Policy

1. Information We Collect

To provide the service, we collect the following categories of information:

• Account information: your registered email and password (stored encrypted; we never access it in plaintext);
• Exchange API keys: the exchange API key and secret you choose to add, stored with envelope encryption, with the master key that protects the encrypted data managed separately from the data itself;
• Trading and strategy data: strategy configurations you create, backtest parameters and results, paper/live trading records, and realized P&L;
• Usage and diagnostic data: login times, IP address, browser information, API call records, and diagnostic logs used for troubleshooting (never containing plaintext keys or passwords — see "Data Security" below); and, only if you accept analytics cookies, pseudonymous product-usage events and privacy-masked session replay.

2. How We Use Information

We use the information we collect to: provide and maintain your account and core features such as paper/live trading and AI modeling; send account-verification, password-reset, and trading/risk-control notifications; troubleshoot issues and improve reliability; prevent fraud and abuse; and meet legal and regulatory obligations. We do not use your personal information for purposes beyond those described in this Policy, and we do not sell your trading strategies, positions, or other data to third parties for advertising.

3. Data Security

Your exchange API keys are protected with envelope encryption: the data itself is encrypted with a data-encryption key, which is in turn encrypted with a separately managed master key, so the two are never stored together. Our internal logging standard explicitly prohibits writing plaintext keys, passwords, or tokens to any diagnostic log, audit record, or API response; financial actions such as order placement, fills, risk-control triggers, and key access are recorded in a dedicated append-only audit log for security review and compliance, not routine diagnostics. All communication between the site and the API is encrypted in transit via TLS. Despite these measures, no method of transmission or electronic storage is completely secure, and we cannot guarantee absolute security against unforeseen incidents.

4. Third-Party Service Providers

To provide the service, we share the necessary information with the following third-party providers, each governed by its own privacy policy:

• Supabase (GoTrue) — provides account registration, login, and identity verification;
• Amazon SES — sends account-verification, password-reset, and other transactional emails;
• Cloudflare Turnstile — bot protection during signup and login; not used for tracking;
• PostHog — only after you accept optional analytics cookies, receives a pseudonymous internal identifier and privacy-masked product-usage events to help us improve the Platform. We do not send passwords, tokens, exchange credentials, raw error text, complete profiles, order details, or strategy parameter values;
• The exchange(s) you connect (e.g., Binance) — your trading instructions reach the exchange directly through the API key you provide, and the exchange processes that data under its own privacy policy.

5. Data Retention

We retain information only for as long as necessary: diagnostic and container run logs are kept for 30 days by default and then automatically purged; trading and strategy data is kept for the life of your account to preserve a traceable backtest/trading history; after account closure, we delete or anonymize your personal information within a reasonable period, except for records we are legally required to retain (such as certain financial/audit records).

6. Your Rights

You can view and correct your account information at any time in account settings; you can delete any exchange API key from the vault at any time; you can accept or reject optional analytics cookies through Cookie settings in the site footer; you can request an export of your strategy and trading data, or request account closure and deletion of associated personal information (except where retention is legally required). Contact us using the details below for assistance.

7. Children’s Privacy

The Platform involves trading with real funds and is not directed to anyone under 18. We do not knowingly collect personal information from minors; if we learn that we have done so, we will delete it promptly after verification.

8. International Data Transfers

[PLACEHOLDER — to be completed once the operating entity and hosting regions are finalized: where data is stored and applicable cross-border transfer safeguards.]

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email to your registered address, and the "Last updated" date at the top of this page will be revised accordingly.

10. Contact Us

If you have questions about this Privacy Policy or how your personal information is handled, please contact us at [PLACEHOLDER: contact email].