← Back to Trading Bot House

Privacy Policy

Last updated: 2026-07-01

1. What We Collect

Account data: Your Google email address, name, and profile picture (via Google OAuth).

Usage data: Strategies you create, chat messages you send to the AI, backtest results, and paper-trading positions.

Exchange credentials: API keys you upload for automated execution. Stored encrypted (Fernet AES-128) at rest.

Telemetry: Anonymous page views (via privacy-first Plausible analytics — no cookies, no fingerprinting).

Server logs: IP address, User-Agent, and request paths for security/debugging. Retained 30 days.

2. What We Do NOT Collect

• Payment card data — handled by Stripe; we never see it.
• Exchange withdrawal keys — API keys should be trading-only.
• Behavioral tracking pixels (Facebook, Meta, Google Ads).
• Third-party analytics that track you across sites.

3. How We Use It

• Authenticate your account and enforce tier quotas.
• Run backtests, paper trades, and (if enabled) live orders on your behalf.
• Improve the AI prompting by reviewing anonymized error patterns.
• Send transactional email (payment receipts, kill-switch alerts).

4. AI Providers

Your chat messages are sent to third-party LLM APIs (Google Gemini, Cerebras, or Anthropic Claude — whichever is available). These providers may retain your prompts per their retention policies. We do NOT send exchange keys, Google tokens, or PII to LLM APIs.

5. Sharing

We do not sell your data. We share it only with:

• Exchange APIs (Bybit, Binance) — as directed by your strategy execution.
• LLM providers — chat message text only, as above.
• Stripe — for payment processing.
• Law enforcement — only under valid legal process.

6. Security

All connections are TLS 1.2+ enforced (HSTS). Exchange API keys are encrypted with Fernet AES-128 with a server-side master key. Sessions are HttpOnly + Secure + SameSite=Lax cookies. Kill-switch is enforced server-side, not just client-side.

7. Data Retention

• Account data: while your account exists + 30 days after deletion.
• Chat history: 90 days, then purged.
• Server logs: 30 days.
• Backtest & paper trading results: retained until you delete them.

8. Your Rights (GDPR)

You may:

• Request a copy of your data.
• Delete your account (wipes all encrypted API keys immediately).
• Export your strategies and backtest results as JSON.
• Object to LLM prompt retention (contact us for LLM opt-out).

Contact: [email protected]

9. Cookies

We use one cookie: app_session, a 30-day HttpOnly session token. No analytics or advertising cookies.

10. Children

The Service is not for anyone under 18. If we learn we collected data from a minor, we will delete it.

11. Changes

We will notify you via email of any material changes. Continued use constitutes acceptance.

12. Contact

Privacy questions: [email protected]

← Back · Terms · Risk Disclosure