Privacy Policy

This policy explains what AutoTradIQ collects when you use the website and app, why, who else sees it, and the choices you have. We do not sell your personal information.

What we collect

• Your account: when you sign in with Google, your name, email address, profile picture link and Google account id, plus when you signed up and last signed in, and your role.
• Google sign-in attempts: each time anyone tries to sign in with Google, whether it works or not: the time, what happened and why, the email address, name, profile picture link and Google account id Google gives us, whether Google has verified the address, the IP address it came from and the browser and system in a few words (such as "Chrome on Windows"). Kept 180 days for security, and shown to the administrator. Never your Google password or the codes and tokens of the sign-in itself.
• Exchange keys: the API keys you add, encrypted before they are stored (AES-256-GCM). They are never shown back to you, never sent to your browser and never written to logs.
• Your AI keys: your OpenAI, Anthropic, Google Gemini and xAI keys and chosen models, encrypted the same way, which one you use, whether prompt caching is on, and how many tokens each AI request used and read from the provider's cache (counts only, never the request itself).
• Trading data: your bots, their settings and saved state, the orders and fills they make, account balances and value over time, and the limits and preferences you set.
• Notifications: if you turn on push notifications, the push address your browser gives us for each device.
• Contact requests: what you send through the request pages: your name, email address, the integration you ask for and your message.
• Technical data: server logs with request details such as IP address and browser type, kept for security, rate limiting and fixing problems.
• Product analytics: inside the signed-in app only, how the app is used (pages, clicks, errors, performance and session recordings), through PostHog. All text on screen and everything typed is masked before it leaves your browser; prices, balances, names and keys are never sent; your IP address is not stored with events; and you are identified only by an internal id, never your name or email.

Cookies and local storage

• Sign-in: a session cookie that keeps you signed in (up to 24 hours, ending after 20 minutes without use), and a few short-lived cookies (5 minutes) that protect the Google sign-in step and note whether it started from the request access page.
• Preferences: your browser's local storage keeps choices such as your display currency, chart ranges and AI review goal.
• Analytics: in the app, PostHog stores an id in your browser to group a visit's events.

The public pages (this one, the landing page, the request pages and the other legal pages) set no analytics cookies.

How we use it

• To run the service: sign you in, run your bots on your exchange, show your results, and send the notifications you ask for.
• To keep it safe: stop abuse, protect accounts and investigate problems.
• To improve it: understand which features are used and where the app fails.
• To reply to your requests for access or integrations, and to decide what to build next.

Who else sees it

• Your exchange (Coinbase, Kraken, Gemini, Alpaca, Webull, Kalshi or Polymarket US today) receives the orders and requests your bots make with your keys, under its own privacy policy.
• Polymarket US, if you connect it, receives your API Key ID and requests signed with your Secret Key, at its API (api.polymarket.us), for your balance, positions and orders, under its own privacy policy. The app also reads public market data from gateway.polymarket.us. Your Secret Key is stored encrypted and never leaves our server.
• Public, if you connect it, receives your secret key once in a while in exchange for a short-lived access token, at its API (api.public.com), and the requests for your balance, positions, orders and prices, under its own privacy policy. Your secret key is stored encrypted and never leaves our server except to Public.
• Webull, if you connect it, receives your App Key and requests signed with your App Secret, at its OpenAPI (api.webull.com), for your balance, positions, orders and prices, under its own privacy policy. Your App Secret is stored encrypted and never leaves our server.
• Public data sources (ESPN, the National Weather Service and NOAA, NASA, Yahoo Finance and CNBC) are read for scores, weather and prices. Nothing about you is sent to them.
• OpenAI, Anthropic, Google Gemini or xAI, whichever you choose, only when you use an AI feature with your own key: a bot's settings and results, and market figures. Never your keys, email or name.
• Google, for sign-in.
• Render, which hosts the service and its databases in the United States.
• PostHog, for the product analytics described above, in the United States.
• Browser push services (for example Google, Apple or Mozilla) deliver the notifications you turn on.
• Authorities, if the law requires it.

How long we keep it

Account and trading data are kept while you have an account. When your account is deleted, your bots, settings, keys, orders and history are deleted with it. Server logs are kept for a limited period. Google sign-in attempts are kept 180 days, then deleted. Contact requests are kept until they are no longer needed to handle your request or measure interest.

Security

Keys are encrypted at rest, connections use HTTPS, and access to the service's systems is restricted. No system is completely secure; use exchange keys without withdrawal permission, so a leaked key cannot move your money.

Your choices and rights

• Remove your exchange or AI keys at any time in the app, and revoke them at the provider.
• Turn notifications off on any device.
• Ask for a copy of your data, a correction, or deletion of your account and data, through the contact page. Depending on where you live, you may have further rights, such as to object to or restrict some uses, and to complain to a data protection authority.

Children

AutoTradIQ is not for anyone under 18, and we do not knowingly collect information about children.

Changes

We may update this policy. The date above shows the latest version; significant changes will be announced in the app.

Contact

Questions about privacy: use the contact page.