Privacy Policy
1. What we collect
- Account data — your email address and authentication data, handled by our auth provider (Clerk). We never see your password.
- Exchange API keys — if you connect an exchange for live trading. Keys are encrypted at rest (AES-256-GCM), keys with withdrawal permission are rejected, and only a masked preview is ever displayed after connection.
- Strategy content — the prompts you type, the agent specifications drafted from them, grade reports, journals, and deployment history.
- Payment data — for crypto payments: transaction hashes and wallet addresses involved in your payment. For card payments: handled entirely by the payment processor; we never see card numbers.
- Telegram — your chat ID, only if you link Telegram for alerts.
- Usage data — logs, IP addresses (used for rate limiting on public endpoints), and basic analytics needed to run and secure the service.
2. How we use it
- To run the product: draft, grade, paper-trade, and (when you choose) live-trade your agents.
- To secure the platform: rate limiting, abuse prevention, audit.
- To communicate: waitlist invites, service alerts you opted into, and replies to your feedback.
- To improve the platform, including aggregate, de-identified analysis of grading outcomes.
We do not sell your data. We do not run third-party advertising.
3. AI processing
When you describe a strategy in plain English, that text is sent to our AI provider (Anthropic's Claude API) to draft the formal specification. Strategy prompts are the only user content routinely processed by the AI layer; exchange keys and payment data never are.
4. Who else touches your data (processors)
- Vercel — website hosting.
- Clerk — authentication.
- Anthropic — AI drafting of agent specifications.
- Payment processors (Stripe / NOWPayments) and public blockchain APIs (e.g. TonCenter) — payment handling and on-chain verification.
- Exchanges you connect — trade execution happens on your exchange account under your keys.
- Telegram — only if you link it for alerts.
5. What's public by design
Public grade pages (/verify/…), badges, and NEXA listings are public, permanent records — that permanence is the product's trust mechanism. They show strategy results and disclosed assumptions, never your identity, email, or keys. Don't publicly grade or list what you want private; grading inside the Studio is private to your account.
6. Retention and deletion
- Account data is kept while your account exists.
- Disconnecting an exchange key deletes the stored encrypted key immediately.
- Self-serve export and deletion: Studio → Billing → "Data & account" lets you download a full JSON export of everything tied to your account, or delete it outright. Deletion is a real, immediate purge — not a deactivation flag — across every table: agents, deployments, trade history, exchange keys, passes, notes, feedback, developer keys. It's blocked only if a live real-money deployment is still running or a NEXA fee is unsettled, so you can't lose track of open positions or money owed either direction; stop or settle those first, then delete. Public verify pages you chose to publish remain (they were already de-linked from your identity by design — see §5) since deleting them would break the trust mechanism for anyone who already viewed or relied on that grade.
7. Security
Encryption in transit everywhere; sensitive secrets encrypted at rest; keys scoped trade-only; infrastructure access limited to the founding team; nightly backups. No system is perfectly secure — which is one more reason we never take custody of funds.
8. Your rights
Subject to applicable law (including Singapore's PDPA and, where it applies, the GDPR), you may request access to, correction of, or deletion of your personal data, and object to or restrict certain processing. Contact us and we'll respond within 30 days.
9. Cookies and local storage
We use only what the product needs: authentication session cookies (Clerk) and a local-storage entry for your light/dark theme preference. No advertising or cross-site tracking cookies.
10. Changes and contact
Material changes to this policy will be announced on the site. Questions or requests: the in-app feedback widget, or Telegram @tessenaibot.