Privacy Policy

Last updated: September 2026

1. Information We Collect

Account data: username, email address, hashed password (bcrypt)
Broker connection data: which exchange(s) and trading pair(s) you've connected, and encrypted API credentials for them
Trading data: trade history, balances, and P&L reported by your connected exchange account, stored in an encrypted database on our server
Usage data: server access logs, IP addresses (retained for 30 days)
Payment data: handled entirely by Stripe — we store only invoice IDs and payment status, never card details

2. How We Use Your Information

Sign and submit trade orders to the exchange you've connected, strictly to operate the bot(s) you've selected
Send account verification and invoice emails
Send Telegram trade alerts (if you enable them)
Calculate profit-share invoices
Detect and prevent fraud or abuse

3. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. We share data only with:

Your connected exchange (MEXC, WEEX, or another exchange we support) — your encrypted API key is decrypted in memory only to sign the specific requests needed to operate your bot; those signed requests are sent directly to that exchange's own servers. We do not send your credentials anywhere else.
Stripe — for invoice and payment processing
Law enforcement, if required by valid legal process

4. Data Security

All data is transmitted over HTTPS (TLS 1.2+)
Passwords are hashed with bcrypt (never stored in plain text)
API keys are encrypted with AES-256 at rest
The server runs fail2ban and a UFW firewall

5. Data Retention

We retain your account and trade data for as long as your account is active. You may request deletion of your account and all associated data by contacting us. Trade history may be retained for up to 7 years for legal and tax compliance purposes.

6. Cookies

We use a single session cookie (Flask session) to keep you logged in and to remember your language preference. We do not use tracking cookies or third-party analytics.

7. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, and to object to certain processing. If you are in the EU/EEA, this includes the rights available to you under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection supervisory authority. To exercise any of these rights, contact us here.

8. Changes

We will notify you via email of any material changes to this policy.