Privacy Policy

Version 2026-08-18-v3 · Last updated 18 August 2026

No KYC. No identity documents. No name, address, or phone number. No analytics, no trackers, no advertising. Nothing sold, ever.

Not nothing, though. Here is all of it.

1. What we hold

What	Why
Email address	Login, and warning you when a bot halts or collateral runs short
Password	Login. Stored as a salted PBKDF2 hash — unreadable to us.
Session token	Keeps you logged in
Verification code	Proves the address works. Expires in 30 minutes, deleted on use.
Wallet address	Matches your on-chain collateral to your account. Public anyway.
Exchange API key	Places the orders you configured. Encrypted at rest. Never logged, never returned, never shown back to you.
Bot config, trades, equity	Shows you what your bot did and why
Fee ledger	Shows every charge against your collateral
Compute counters	Meters gas at cost
Consent record	Which Terms version you accepted, when, and the IP it came from

The IP address is the only thing here you didn't type in. It is attached to your acceptance of the Terms and nothing else — not your trades, not your browsing. No profiling, no geolocation, no analytics.

2. What we never have

• No identity documents. No KYC.
• No card or bank details. There is no payment processor in the system.
• No wallet private keys. We could not touch your collateral if we tried.
• No exchange password — only the API key you issue and can revoke.
• No cookies beyond your session token and language choice.

3. Who else sees anything

Who	What
Your exchange	Orders, under your own API key
Email provider	Your address, to deliver your code
Hosting provider	Whatever the servers hold
Signal provider	Market-data queries. Not you.
AI provider	Only strategy text you type into the assistant
BNB Smart Chain	Your wallet address and every vault transaction — publicly, forever

4. How long

What	How long
Exchange API key	Gone the moment you disconnect the exchange or close your account
Verification code	30 minutes
Account, bots, trades	Until you close the account
Fee ledger, consent record	Kept — they evidence what was charged and what was agreed
On-chain records	Forever. Not ours to delete.

5. Security

• API keys encrypted at rest. Passwords only ever hashed.
• HTTPS throughout.
• Value-creating admin actions need a hardware passkey and are written to an audit log.
• Nobody can mark your email verified for you. There is no bypass.

6. Your data, your call

You can do all of this yourself, right now, without asking anyone:

• Erase your exchange credentials — disconnect the exchange. Gone immediately.
• Cut our access entirely — revoke the API key at your exchange. Works even if we do nothing.
• Delete everything else — close your account.

Two things survive that: the fee and consent records in Section 4, and anything already written on-chain.

7. Other

Not for under-18s. Material changes are emailed to your account address before they take effect.