# What we store, and what we do with it

This is the document you agree to when you create an account. It is committed to
the repository and it is versioned, so what you agreed to on the day you agreed
to it can be reconstructed later. If it changes materially, you will be asked
again; until you accept the new version you continue under this one.

---

## Before anything else

**This is beta software and you are trading real money with it.**

- It **never places, modifies, or cancels an order.** It cannot. There is no
  order path in the code, and the exchange keys it reads are read-only. Every
  trade is one you place yourself, deliberately, on the exchange.
- It shows you analysis. **Analysis can be wrong**, and on beta software it can
  be wrong in ways nobody has noticed yet.
- It is **not financial advice** and not personalised investment advice. It does
  not know your circumstances, and no output here is a recommendation to buy or
  sell anything.

You are the last check before every trade. That is by design, and it does not
change.

---

## 1. What is stored

| | |
|---|---|
| **Your identity** | email address, a hash of your password (never the password), when you signed up, and whether you have confirmed your address |
| **Your books** | the option legs you record, entries, exits, rolls, realised and unrealised results, the notes and rationale you write |
| **Your settings** | risk limits, venue choice, display preferences |
| **Your exchange keys** | read-only API credentials, if you choose to add them — see §4 |
| **This record** | which version of this document you accepted, when, and which optional purposes you turned on |
| **Requests you make about your data** | access, correction, deletion, opt-out or appeal — what you asked for, when, and what was done. Kept 24 months, because the law requires a record of them |

## 2. Why it is stored

Three of these you cannot turn off, because the product does not exist without
them. Two are optional and are **off unless you turn them on**.

| # | Purpose | Required? |
|---|---|---|
| 1 | **Run the service for you** — store your book, compute your analytics, show you your own results | required |
| 2 | **Keep your data if you cancel**, so it is still there if you come back | required |
| 3 | **Contact you about the service** — outages, security, changes to this document, billing | required |
| 4 | **Improve the models** using de-identified, aggregated results | **optional, off by default** |
| 5 | **Marketing email** | **optional, off by default** |

**Turning down 4 or 5 does not reduce what the product does for you.** Nothing is
gated behind them, and nothing will be.

### On purpose 4, plainly

The single most useful thing here is the link between the conditions at entry and
what actually happened afterwards. Learning from that across many books is how
the analysis gets better than what any one book can teach it.

If you turn this on, what is used is **de-identified and aggregated**: the
conditions, the structure, and the outcome — never your identity, never your
exchange keys, never your notes, and never a record that can be tied back to you.
Statistics computed from it may be published. You can turn it off at any time.

**Because it cannot be tied back to you, deleting your account does not remove
it.** That is not a loophole in the deletion — it is the same property that makes
the data safe to hold at all. If it could be found and removed on request, it
was never de-identified.

## 3. How long it is kept

While your account exists, your data stays as it is. If your subscription lapses
you keep everything — it becomes **hidden from the dashboard, not deleted**, and
resubscribing brings it back untouched. You can **export it at any time, whether
or not your subscription is active.**

> **Closed beta, and honest about it:** the exact retention period after
> *cancellation* is not yet stated, because it depends on which jurisdictions
> this service will operate in — a question still being answered. It will be a
> specific number of days, stated in a later version of this document, and you
> will be asked to accept that version. Until then, ask for deletion and it will
> be done.

## 3a. Deletion, and what it actually reaches

You can ask for deletion at any time, in Settings or by asking. When it runs:

- Your account, your books, your settings and your stored keys are removed from
  the live systems **immediately**.
- Your sessions are ended and any outstanding password-reset link stops working.

**Backups are the part most services are vague about, so here it is plainly.**
Backups are taken on a rotation and are immutable — they cannot be edited to
remove you, because a backup you can edit is not a backup. Instead, the deletion
is recorded, and **that record is replayed every time a backup is restored**. So
a restore does not bring your account back. The record is kept for exactly as
long as any backup that could contain your data still exists, and expires with
the last of them.

**Two things deliberately survive deletion, and you should know both:**

1. **A record that you consented** — which version of this document, which
   purposes, and when. The identifying parts of that record (your IP address and
   browser) are erased along with everything else; what remains is the evidence
   that an agreement happened. It is kept because a regulator asking "did this
   person agree, and to what?" has to be answerable after the account is gone.
2. **The de-identified, aggregated results** described in §2, if you turned
   purpose 4 on. See the note there.

Nothing else survives. Not your book, not your notes, not your keys, not your
email address.

## 4. Your exchange API keys

If you connect an exchange, use **read-only keys with withdrawals disabled**.
The software only ever reads. Nothing about this product requires a key that can
trade or withdraw, and you should not give one to it — or to anything else.

Keys are encrypted **in your browser, under a passphrase only you know**, before
they reach the server. The server holds a blob it cannot read and unlocks it only
for the duration of a request you made, using a key your browser sends. If you
forget that passphrase, nobody here can recover those keys — you re-enter them.
That is the trade, and it is the right way round.

Your keys are never used for purpose 4, never included in an export intended for
sharing, and never written to logs or alerts.

## 5. What is not done with it

- Your data is **not sold**, and not shared with advertisers or data brokers.
- It is **not used to train anything that could reproduce your book**.
- It is not shown to other users, in any form, ever.

## 6. Your choices

- Change your optional purposes at any time in Settings.
- If your browser sends a **Global Privacy Control** signal, it is honoured
  automatically: purposes 4 and 5 are turned off, without you doing anything.
- Export your data at any time.
- Ask for deletion at any time.
- Ask what is held about you, ask for a correction, or opt out — and **if a
  request is refused, appeal it.** Every request is logged with a deadline, and
  you can see where yours stands.

## 7. Age

You must be **18 or older** to use this service. You will be asked to confirm
that at signup.

## 8. Confirming your email address

If you signed up yourself rather than by invitation, your account starts
**unconfirmed** and the dashboard stays locked until you follow the link sent to
your address. This is to stop the service being used to create accounts in bulk
against addresses that are not yours. Nothing is done with the address beyond
sending that link and the service messages in purpose 3.

---

*Questions about this document, or a request about your data: use the Privacy
section in Settings, or reply to any email you have received from the service.*