/ privacy
Your data, first-party only.
A plain-English summary of how we handle your data. The full, binding privacy policy governs in case of any conflict.
What we collect
- Account details: email, and whatever you add to your profile.
- Exchange API keys: encrypted at rest with AES-128, scoped to trade-only (never withdrawal).
- Trading data needed to run the product: your configs, trades, journal entries.
- Product-usage analytics, of two kinds and both named on our cookies page: Google Analytics 4, which stores nothing until you accept the banner, and a first-party pipeline on our own servers keyed by an anonymous account id.
- Your network address: kept coarse and hashed, never sold. To name the country in a security notice we send the surrounding network block to a geolocation provider, never your full address.
How we protect it
- API keys and secrets are Fernet-encrypted, versioned and rotated. A stolen database row reveals nothing without the encryption key.
- Decryption is memory-safe; secrets are scrubbed from logs and crash reports.
- We never request withdrawal scope, so we physically cannot move your funds.
What we do not do
- We do not sell your data. Ever.
- No ad trackers, pixels or session-replay, and nothing that follows you to other sites. Analytics is not in that category and is named above rather than denied: see cookies.
- No sharing of your trading activity with anyone, except where legally compelled.
Your rights
You can export your data and request deletion of your account at any time. Some records (e.g. the immutable trade audit log) are retained as required for integrity and compliance.