Privacy Policy

Last updated: 2026-09-28

1. What We Collect

Account data: Your Google email address, name, and profile picture (via Google OAuth).

Usage data: Strategies you create, chat messages you send to the AI, backtest results, and paper-trading positions.

Exchange credentials: API keys you upload for automated execution. Stored encrypted (Fernet AES-128) at rest.

Telemetry: Anonymous page views, counted by us — no third-party analytics, no advertising or tracking cookies. A view records the page, the referring site and a one-way hash of your IP address and browser string, which we cannot reverse into an identity. We use it only to see which pages people reach.

Server logs: IP address, User-Agent, and request paths for security/debugging. Retained 30 days.

2. What We Do NOT Collect

Payment card data — handled by Stripe; we never see it.
Exchange withdrawal keys — API keys should be trading-only.
Behavioral tracking pixels (Facebook, Meta, Google Ads).
Third-party analytics that track you across sites.

3. How We Use It

Authenticate your account and enforce tier quotas.
Run backtests, paper trades, and (if enabled) live orders on your behalf.
Improve the AI prompting by reviewing anonymized error patterns.
Send transactional email (payment receipts, kill-switch alerts).

4. AI Providers

Your chat messages are sent to third-party LLM APIs (Google Gemini, Cerebras, or Anthropic Claude — whichever is available). These providers may retain your prompts per their retention policies. We do NOT send exchange keys, Google tokens, or PII to LLM APIs.

5. Sharing

We do not sell your data. We share it only with:

Exchange APIs (Bybit, Binance) — as directed by your strategy execution.
LLM providers — chat message text only, as above.
Stripe — for payment processing.
Law enforcement — only under valid legal process.

6. Social Platform Integrations

Trading Bot House publishes its own educational and marketing content to social platforms through their official APIs — currently TikTok, Instagram, Threads, YouTube, Facebook and X. This section describes exactly what that involves.

Whose account. These integrations publish to accounts we own and operate. We do not post on behalf of our users, and connecting a social account is not part of the product.
What we obtain. An OAuth access token and refresh token for our own account, plus the account identifier the platform returns. Nothing else.
What we send. The video or image we produced, its caption, and the privacy setting for that post.
What we do NOT do. We do not read, collect, store or process any other person's profile data, follower lists, direct messages, comments or content. We do not use platform data for advertising, profiling, training models, or any purpose beyond publishing our own posts.
Storage. Tokens are kept in server-side environment configuration on our own infrastructure, never in the browser and never in our database alongside user records. They are used solely to authenticate the publishing calls described above.
Retention and deletion. Tokens are retained only while the integration is active and are refreshed or revoked as the platform requires. Revoking our app's access from the platform's own settings immediately and permanently ends our access; we retain no copy of platform data afterwards.
Compliance. Each integration is used in accordance with that platform's developer terms and policies.

7. Security

All connections are TLS 1.2+ enforced (HSTS). Exchange API keys are encrypted with Fernet AES-128 with a server-side master key. Sessions are HttpOnly + Secure + SameSite=Lax cookies. Kill-switch is enforced server-side, not just client-side.

8. Data Retention

Account data: while your account exists + 30 days after deletion.
Chat history: 90 days, then purged.
Server logs: 30 days.
Backtest & paper trading results: retained until you delete them.

9. Your Rights (GDPR)

You may:

Request a copy of your data.
Delete your account (wipes all encrypted API keys immediately).
Export your strategies and backtest results as JSON.
Object to LLM prompt retention (contact us for LLM opt-out).

Contact: [email protected]

10. Cookies

We use one cookie: app_session, a 30-day HttpOnly session token. No analytics or advertising cookies.

11. Children

The Service is not for anyone under 18. If we learn we collected data from a minor, we will delete it.

12. Changes

We will notify you via email of any material changes. Continued use constitutes acceptance.

13. Contact

Privacy questions: [email protected]

← Back · Terms · Risk Disclosure