Privacy Policy

We collect as little as the service can function on. We do not sell personal information, we do not run advertising trackers, and we do not use third-party analytics.

1 · What we collect

• Email address — your account identifier and the only way we can reach you.
• Password hash — stored as a salted scrypt hash. We never store or see your password.
• Account metadata — created date, subscription tier, and the version of the legal terms you accepted, with the timestamp and IP address of that acceptance.
• Billing identifiers — a Stripe customer ID and subscription ID.
• IP address — used transiently for rate limiting and abuse prevention.
• A session cookie — described below.

2 · What we do not collect

We do not collect or store your card number, your legal name, your address, your phone number, your exchange credentials, your account balances, or your positions. Card details go directly to Stripe and never touch our servers.

3 · Cookies

One cookie: a signed session cookie (cltb_s) that keeps you logged in. It is HttpOnly, Secure, SameSite=Lax, and expires after 30 days. It is strictly necessary for the service to work. There are no advertising, profiling or analytics cookies on this site.

4 · Who else processes your data

• Stripe — payment processing. Stripe is the processor for all card data and has its own privacy policy.
• Cloudflare — CDN, TLS and DDoS protection; sees request metadata including IP.
• Amazon Web Services — hosting for the public site.

We do not share your data with anyone else, and we do not sell it. We may disclose information if legally required to do so.

5 · How long we keep it

Account data is kept while your account exists. Acceptance records and billing records are kept as long as needed for legal, tax and dispute purposes. Rate-limiting IP data is transient and is not retained as a profile.

6 · Your rights

Email [email protected] to access, correct, or delete your account and associated data. Deletion removes your account record; billing records required for tax purposes are retained. Depending on where you live you may have additional rights under laws such as the CCPA or GDPR — the same address reaches us for those requests.

7 · Security

Traffic is encrypted in transit. Passwords are salted and hashed. The public site is isolated from our research and trading infrastructure, which is not reachable from the internet. No system is perfectly secure, and we cannot guarantee absolute security.

8 · Children

The service is not directed to anyone under 18 and we do not knowingly collect their data.

9 · Changes and contact

Material changes will be posted here with a new version date. Questions: [email protected].