Privacy Policy

1. Who We Are

ProTrader ("we", "us") operates the ProTrader signal platform. This policy explains what personal data we collect, how we use it, and your rights over it. We are the data controller for data processed on the Platform.

For data enquiries: privacy@protrader.app

2. Data We Collect

Account data

• Email address — for magic-link login, signal delivery, and billing correspondence
• Display name — optional; shown on trader profiles and leaderboard
• Password hash — if you choose password-based login (bcrypt; we never store plaintext)
• Google account ID — if you sign in with Google (sub identifier only)

Communication data

• Telegram chat ID — if you connect Telegram for signal alerts; used only to send alerts to your chat
• Telegram session state — transient multi-step bot conversation state; not retained beyond the session

Billing data

• Stripe customer ID — a reference ID used to look up your subscription in Stripe; we do not store card numbers
• Card details are stored exclusively by Stripe under their own PCI-DSS compliance

Usage data

• Signal opt-in records (which signals you chose to track)
• Trader follows
• Journal trade uploads (if you are a trader)
• Expert screenshot samples (if you upload them as a trader)

Data we do NOT collect

• Exchange API keys with trade permissions — we explicitly refuse these
• Actual trading activity or position data from exchanges
• Device fingerprints, IP addresses for tracking, or ad cookies

3. How We Use Your Data

We do not sell your data to third parties or use it for advertising.

4. Third-Party Services

• Stripe — payment processing. Subject to Stripe's privacy policy.
• Telegram — alert delivery. Your Telegram chat ID is shared with the Telegram API only to send you messages you opted into.
• Anthropic Claude — AI sentiment analysis. Signal data (pair, direction, market context) is sent to Anthropic's API when ANTHROPIC_API_KEY is configured. No personal account data is included. Subject to Anthropic's privacy policy.
• Binance — market data (public WebSocket and REST APIs). No user data is transmitted.

5. Data Retention

• Account data: retained while your account is active and for 90 days after deletion request
• Signal history: retained indefinitely as part of the public track record
• Magic link tokens: deleted on use or expiry (20 minutes)
• Telegram bind tokens: deleted on use or expiry (15 minutes)
• Billing records: retained for 7 years for tax compliance

6. Your Rights (GDPR & equivalents)

If you are in the EEA, UK, or another jurisdiction with equivalent privacy law, you have the following rights:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your account and personal data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest

To exercise any right, email privacy@protrader.app. We will respond within 30 days.

7. Cookies

We use a single httpOnly cookie (pt_access) to maintain your authenticated session. No tracking cookies, analytics cookies, or advertising cookies are set.

8. Changes to This Policy

We may update this policy. Material changes will be communicated by email or in-app notice before they take effect.