Privacy policy

What is kept

• login, email address, name, the hash of the password (the password itself is not kept), the role and status of the profile, language;
• encrypted exchange keys with the right to trade and without the right to withdraw funds: only the platform server can decrypt them, at the moment of a request to the exchange;
• your bots and their settings, deals, a bot’s journal, backtest results;
• sign-in sessions: when started and last used, the address and the name of the browser;
• when Telegram is linked, the identifier of your chat;
• the audit log: the actions of administrators and important changes of profiles (who, what, when and from which address);
• the server log: requests (time, address, path) for diagnosis; passwords and keys do not get into it.

What for

The data is needed so that you can sign in, bots can trade and check against the exchange, notifications can arrive, and a failure or an abuse can be looked into. It is not sold and not used for advertising.

Who sees it

A user sees only their own accounts, bots, deals and backtests: other users’ data looks as if it does not exist.

For each user an administrator of the platform sees: login, email (and when it was confirmed), name, role, status, the creation date and who approved the profile, the number of bots and how many of them run, whether trading and two-factor protection are on, the quotas and their use, and the load of requests to the exchanges by user. They also see the audit log and the state of the platform. By these data an administrator does not see the bots themselves, their deals, or exchange keys in the clear.

What leaves the server

• to the exchanges, the requests of your exchange account: orders, balances and the check of a key; they come from the address of the platform server;
• to Cloudflare, the traffic between you and the platform (the platform is open through a Cloudflare Tunnel), the sending of letters (Cloudflare Email) and the Turnstile check on forms;
• to Telegram, notifications and the bot’s answers if you linked a chat; the Mini App loads Telegram’s script, and only that;
• nowhere else: no ad networks, no third-party analytics.

Cookies and browser storage

The platform sets only functional cookies: the sign-in session and, for a few minutes between the password and the second-factor code, a temporary ticket. There are no advertising or analytics cookies.

The interface language and theme are kept in your browser’s local storage, on this device.

Analytics and third-party scripts

There is no analytics and no counters. There are two third-party scripts: the Cloudflare Turnstile check on the sign-up and password reset forms and on suspicious sign-in attempts, and Telegram’s script inside the Mini App. This page and the site’s home page load no third-party scripts.

How long

A session ends after a week without use, and in any case after 30 days. Unconfirmed applications and the links of letters are cleared automatically. The rest is kept as long as the profile exists.

Your rights and disabling a profile

You can change your name, language and password in the profile, end sessions, unlink Telegram and disconnect any exchange account — disconnecting wipes its keys from the server.

A profile is disabled by an administrator of the platform — ask them. A disabled profile cannot sign in and does not trade. The platform does not currently remove the records of a user entirely: the audit log keeps records of actions. If you need more, write to the administrator.

Changes

A new edition is published on this page with a new date.