This Privacy Policy describes how TradingBot ("we," "us," "our") collects, uses, stores, and shares information about you when you use our Platform. By using the Service you consent to the practices described herein.
| Category | Examples | Purpose |
|---|---|---|
| Account Information | Email address, password (hashed), display name | Authentication, account management |
| Payment Information | Billing data processed by Stripe (we never store raw card numbers) | Subscription billing |
| Broker Credentials | API keys and secrets you connect (stored encrypted) | Trade execution on your behalf |
| Configuration Data | Selected tickers, risk settings, strategy rules, Telegram settings | Bot operation and personalization |
| Communication | Support requests, feedback | Customer support |
We do not sell your personal data to third parties. We do not use your individual trading data or strategies to inform our own trading or to build competing products.
We share your information only in the following circumstances:
All broker API keys and secrets you connect to TradingBot are encrypted using AES-256 (Fernet) symmetric encryption before storage. Encryption keys are stored separately from the database and are not accessible to our engineers in normal operations.
API keys are decrypted only in-memory at the time of trade execution and are never logged, displayed in full, or transmitted to any party other than your designated broker. Once entered, API keys are not retrievable in plain text through the Platform interface.
Despite these measures, no security system is impenetrable. You acknowledge that you assume all risk associated with connecting live broker credentials to any third-party platform.
We implement industry-standard security measures including:
If we discover a security breach that affects your personal data, we will notify you by email within 72 hours of discovery, consistent with applicable breach notification laws.
Under the California Consumer Privacy Act (CCPA), we are required to disclose every category of personal information we collect, why we collect it, and how long we keep it.
| Category | Specific Data Points | Why We Collect It | Retention Period |
|---|---|---|---|
| Identifiers | Email address, UUID account ID, IP address at login, session token | Authentication, security monitoring, account management | Active account + 90 days after closure |
| Financial Information | Broker API key references (encrypted), paper/live trading mode, virtual account balance, cumulative P&L figures | Execute trades through your connected broker; display portfolio performance to you | Active account + 90 days; trade records up to 7 years per financial regulations |
| Commercial/Transaction Data | Subscription plan, Stripe customer ID, subscription status, payment history (processed by Stripe — we store only references) | Billing, subscription enforcement, fraud prevention | 7 years per tax/financial record requirements |
| Internet/Network Activity | Pages visited within the Platform, API endpoints called, login timestamps, browser type, operating system | Security monitoring, debugging, service improvement | 90 days in access logs |
| Trading Activity | Every webhook signal received, trade decision (BUY/SELL/HOLD) and reason, order ID, entry/exit price, stop-loss, take-profit, outcome (WIN/LOSS), P&L per trade, pattern name, session, timestamps | Bot operation; display trade history and analytics to you; improve the scoring model (aggregate/anonymized) | Active account + 90 days; up to 7 years per financial regulations |
| Configuration Data | Selected tickers, risk percent, risk:reward ratio, custom strategy rules, Telegram bot token (encrypted), Telegram chat ID, display name | Operate the bot according to your settings | Active account + 90 days after closure |
| Communications | Support emails you send to us | Customer support | 3 years |
We do not sell your personal information. We do not share personal information with third parties for their direct marketing purposes. We do not use your trading data or strategies to inform our own trading activity.
Depending on your jurisdiction, you may have the following rights:
To exercise any of these rights, email privacy@usetradingbot.com with the subject line "Privacy Request." We will respond within 45 days (CCPA) or 30 days (GDPR). We may require identity verification before fulfilling requests. California residents may designate an authorized agent to make requests on their behalf.
The Platform uses an HTTP-only, Secure session cookie (session_token) for authentication. This is a strictly necessary cookie — it cannot be disabled without breaking login. We do not use advertising cookies, third-party tracking pixels, or analytics services. Google Fonts are loaded from Google CDN, which may log your IP address per Google's Privacy Policy.
TradingBot is operated from the United States. If you access the Service from outside the US, your information may be transferred to and processed in the US, which may have different data protection laws than your home country. By using the Service you consent to this transfer. For EU/EEA users, such transfers are made with appropriate safeguards as required by GDPR.
The Service is strictly for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will immediately terminate their account and delete all associated data.
We may update this Privacy Policy from time to time. We will notify you of material changes via email and/or in-app notification with at least 14 days' notice before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.
For privacy-related questions, data requests, or concerns: privacy@tradingbot.app