Privacy Policy

1.Who is responsible

The controller for the personal data described here is the operator of Tradeus, who can be reached at support@tradeus.app. Use that address for any request under this policy; it goes to a person, not an autoresponder.

We have not appointed a data protection officer. We are not required to: we do not process personal data on a large scale as our core activity, and we do not monitor anyone systematically. The address above reaches the person who decides how this data is handled, which in a company this size is the more useful answer.

2.What this policy covers, and what it does not

This policy covers what we do with personal data in the Tradeus application, its API and this website. Three things happen around it that are not ours, and being vague about the boundary would be the most misleading part of the document:

• The checkout. Whop sells the subscription in its own name. Your card details, billing address and tax data are entered into Whop's form and stay with Whop, which decides what happens to them and answers for them under its own privacy policy. They never reach us.
• Your broker. The account, the money and the orders are yours and your broker's. What we hold is the credential you gave us to reach it and the trading data it returns; the broker keeps its own records under its own terms, and closing your Tradeus account does not close anything there.
• Discord and Google. Sign-in happens at one of them — whichever you choose. We never see a password of either, and what they do with your account is between you and them.

3.What we collect

• Account data. When you sign in with Discord we receive your Discord user ID, email address, display name and avatar URL. When you sign in with Google we receive your Google account identifier, email address, whether Google considers that address verified, your name and your picture. Those fields are the whole of the scope we request from either — we do not read your Discord servers, messages or friends, and we do not ask Google for your mail, files or contacts. If you arrived on one of our own labelled links, that label (for example “x-ads”) is stored with your account when you sign in, so we can tell which of our links brought customers. It says which link, not anything about you, and it is never shared. If you came by clicking one of our Google ads, the click identifier Google adds to the address (“gclid”) is stored with your account as well, for 90 days. We tell Google Ads whether that click led to an account or a free trial — the identifier, which of the two, and when; nothing else about you. The ground for both is not the contract but our interest in those questions, set out below.
• Your way through the checkout. When you are signed in and open the checkout, we record each step of it on your account — that you opened it, ticked the withdrawal box, that Whop's form was shown, a payment error's short code if there was one, that you opened the same checkout on whop.com instead, that it completed or that you went back — with the plan and the time, to the second. It is how we see where a purchase got stuck and help you. When an account is created, and when a checkout is opened, fails or completes, we are told in a private Discord channel of our own, so a buyer who is stuck hears from us the same day: the message carries our number for the account and the plan, never your name or email address. Nothing you type into the payment form reaches us: that form is Whop's. What we hand Whop is what the purchase needs: the email address you signed in with, so you do not have to type it again; our number for your account, so the payment is credited to it; and, if the link you came by carried them, its referral or discount code.
• API keys you create. If you create a read-only API key in your profile, we keep its name, its first twelve characters (so you can tell your keys apart), when it was created and when it was last used — and a one-way hash of the key, never the key itself, which is shown to you once. Whoever holds the key can read your accounts' balances, open profit and loss, status and the orders Tradeus placed on them, until you revoke it; it cannot place, change or cancel anything. The ground is the contract: it is a feature you switch on.
• Profile data you choose to add. Handle, bio, region, tier, traded instruments and TradingView username. Parts of this are public where you switch them to public — you control each of these in your profile settings.
• Broker connection data. The access tokens or credentials needed to reach the broker you connect. These are encrypted before they are written to disk (AES-256-GCM) and are never displayed back to you or to anyone else. See section 8.
• Trading data. Accounts, balances, positions, orders, fills, risk settings and the event log produced while the service runs on your behalf.
• Billing reference. A membership identifier from Whop, and which plan it is for. Your name, billing address, card details and tax data are given to Whop at the checkout and stay with Whop — they never reach us, so we cannot see or store them.
• Server logs and technical data. Like any server, ours records the requests it answers: the time, the method and path, the response, the browser's user-agent string and the IP address the request came from. The same address is counted, briefly and in memory, by the brake that stops password and token guessing. Logs are scrubbed before they are written — the session token, any authorisation header and any secret in a query string are replaced with a marker, and request bodies are not logged at all, which is where broker credentials travel.
• Six counters, which hold nothing about you. Every arrival adds one to three tallies kept apart from one another — how many visits carried a given campaign label, how many came from a given country, and how many came from a given website — every page you open adds one to a fourth, how many times that page was read, a fifth counts how many visitors got as far as the prices (and how many had them on screen), the sign-in and the choice of Google or Discord — and, where the advertising-pixel question is asked, how many answered it yes and how many no — and a sixth counts how many visits with a campaign label came from a click on one of our Google ads. For that one only the fact is counted — whether the address carried Google's click identifier — never the identifier itself. There is no row per visitor, no identifier, no address and no time beyond the date, and nothing here can follow anyone from one page to the next. They are kept apart, except that visits and those steps are shown side by side per campaign link — and on a quiet day a tally of one can still be one person, so we treat them with the same care as everything else we hold. These counters skip a browser that is signed in on the page it is reading, anything from a test copy of the site, and automated visitors such as search and advertising crawlers, recognised by the name their software sends. The country is the one our hosting provider reads from the network and is never taken from your device; the website is reduced to its name, with the page and anything you searched for discarded before it is counted.
• What you send to the AI assistant. The question you type and the context the feature attaches to it. See section 7.
• Support correspondence. If you write to us, we keep the message and our reply so the next person to read the thread knows what was already said.

4.Why we may process it

Every category above has a ground under Art. 6(1) GDPR, and they are not all the same one. Where the ground is legitimate interest, the interest is named, because an unnamed one cannot be objected to.

• Account, trading and broker connection data — Art. 6(1)(b). Necessary to perform the contract you entered into. Without it there is no copier, no risk manager and no dashboard.
• Billing reference — Art. 6(1)(b) and Art. 6(1)(c). Necessary to know which plan you hold, and to keep records the law requires us to keep.
• Server logs, rate limiting and security — Art. 6(1)(f). Our legitimate interest in keeping the service available, diagnosing faults, and stopping brute-force and abuse. This one protects your account as much as our server, which is the balance we have struck.
• Your way through the checkout — Art. 6(1)(f). Our legitimate interest in finding where a purchase fails and helping the person it failed for. It holds no payment detail, only our own steps and Whop's error code, and you can object at any time by writing to us. Handing Whop your sign-in email and our number for your account is Art. 6(1)(b): steps you asked for on the way to the contract.
• The label of our link on your account, and the five counters — Art. 6(1)(f). Our legitimate interest in knowing which of our own links and pages bring customers. The label names a link, not you, and the counters name nobody; you can object by writing to us, and we clear the label from your account. The same interest covers the Google ad click identifier and telling Google Ads which clicks became an account or a trial, so that the ads we pay for reach people who find the product useful rather than people who do not; you can object in the same way, and we delete the identifier and report nothing further.
• Public profile fields and leaderboard entries — Art. 6(1)(a). Your consent, given by switching a field to public, withdrawable at any time by switching it back. Withdrawing does not affect what was lawful before.
• Support correspondence — Art. 6(1)(b) and (f). To answer you, and to keep a record of what was answered.
• Product emails about changes and outages — Art. 6(1)(b) and (f). These are service messages, not marketing. We do not run a marketing mailing list; if we ever do, it will be opt-in and separate from this.

5.What we never do

Negative statements are worth more than positive ones in a document like this, because they are the ones a supervisory authority can check against the product in an afternoon.

• We do not sell personal data, and we have no advertising business to sell it to.
• We use no analytics service and no session replay, and we build no cross-site profile of you. What we count ourselves is six plain tallies — visits by campaign link, by country, by referring site, pages read, visits from a click on one of our Google ads, and how far visitors get towards an account, which includes how many answered the pixel question below with yes and how many with no — none of them about you, and set out in the section on what we hold. There is one advertising pixel — Whop's, so they can tell whether an advertisement we paid for led to a sale — and it runs only where you have accepted it, never on the pages behind your sign-in. It does take a fingerprint of your browser, and we would rather name that than let the sentence above imply otherwise. Whop's script can also read form fields, take an identity out of a link, decorate outbound links and measure your graphics hardware; we start it with every one of those switched off, and the itemised list sets out both what is left and how we know. Google runs no script here; if you came from one of our Google ads, Google Ads is told only whether that click became an account or a trial, as the table of who else sees it says.
• We do not train models on your trading data, and we do not give it to anyone else to train on.
• We do not publish your trading results. A profile field is public only if you set it to public.
• No automated decision with legal effect. Nothing here profiles you or decides anything about you within the meaning of Art. 22 GDPR. The software acts on rules you configured — that is automation of your own instruction, not a decision taken about you by us.

6.Who else sees it

These are everyone who receives personal data, in what role, from where, and on what basis it may leave the EEA. “Processor” means they act only on our instructions; controller means they decide for themselves and answer to you directly for that part.

That is the whole list. There is no analytics vendor, no data broker and no email marketing platform on it, because we do not use any. The previous version of this page promised that if anything of that kind were ever added, the table would change before the feature shipped. Two things were — the advertising pixel in the row above, and Google Ads being told which of its clicks became customers — and this table changed before each of them shipped, in the same commit that built it.

7.The AI assistant, in detail

When you ask the assistant something, the question and the context the feature attaches to it — which can include your accounts, positions and settings, because that is what makes an answer useful — are sent to Anthropic's API, which generates the reply and returns it. We send what the answer needs and not the whole account.

Under the commercial terms we use, inputs and outputs sent through that API are not used to train models, and are retained only briefly for abuse detection before being discarded. We do not train anything on them either, and we do not read your conversations except where you send one to us in a support request.

The assistant is a text generator. It does not place orders, it can be confidently wrong, and nothing it writes is advice — the same as everything else in the product, and worth repeating precisely because it answers in sentences.

Ask Tradeus, on the public website. The assistant at the bottom right of the public pages works without an account. What you type there, and the conversation in the open panel, is sent to Anthropic's API with the text of our own public pages — nothing about you, your browser or an account goes with it. Your browser keeps nothing: the conversation is gone when you close the page. On our side we keep each question for 30 days, with anything that looks like an email address, a link or a long number removed and without your address or any identifier, so we can see which questions our pages fail to answer; and per day only how many questions were asked and what they cost. To limit how often one visitor can ask, your network address is hashed in memory for at most a day and never stored.

8.Broker credentials, in detail

A broker connection is the most sensitive thing we hold, because it is what lets software act on an account with money in it. It is handled accordingly:

• Credentials are encrypted with AES-256-GCM before they are written to disk, under a key held in the server environment and not in the database.
• They are never displayed back — not to you, not in support, not in a log. Request bodies are not logged, which is the route by which they arrive.
• They are used only to reach the broker you connected, for the account you connected, to do the things you configured.
• Disconnecting deletes them. Not marked inactive — deleted. Deleting your account deletes all of them.
• Where the broker supports OAuth, we hold a token you can revoke at the broker as well as here, which is the better arrangement and the one we prefer where there is a choice.

9.International transfers

Most of the providers in section 6 are established in the United States, so personal data is transferred outside the EEA. Each transfer rests on one of the following: an adequacy decision, where the recipient is certified under the EU–US Data Privacy Framework; the European Commission's Standard Contractual Clauses, where it is not; or, for your broker, Art. 49(1)(b) — the transfer is necessary to perform the contract you yourself asked for by connecting that account.

The United States does not offer protection identical to the EEA, and a transfer there cannot be made perfectly equivalent by contract. We reduce what is exposed rather than claim otherwise: payment data never reaches us at all, broker credentials are encrypted before storage, and the assistant is sent the context an answer needs rather than an account export.

10.How long we keep it

“As long as necessary” is not an answer, so here are the actual periods.

One caveat about backups. The database is backed up, and the backups are encrypted and overwritten on a rolling schedule. Deleting something removes it from the live service immediately; it disappears from the backups as those are overwritten, within a short number of weeks. We do not restore deleted data from a backup to bring it back, and a restore performed for any other reason is followed by re-applying deletions.

11.How we protect it

The measures required by Art. 32, in the form they actually take here rather than as a list of adjectives:

• Everything travels over TLS; the application is not reachable without it.
• Broker credentials are encrypted at rest with AES-256-GCM under a key that is not in the database.
• Sessions are bearer tokens that are redacted out of logs, and the live feed authenticates in the connection handshake rather than in a URL — a URL is the part that gets written into logs by every machine along the way.
• API keys are stored only as a SHA-256 hash, are shown once, only ever read (a key is refused everywhere outside the read-only API), and stop working the moment you revoke them.
• Sign-in is delegated to Discord or Google, so there is no password of ours to leak, and a brute-force brake counts attempts per address.
• Access to production is limited to the people who operate it, and the database is not exposed to the public internet.
• Changes are covered by automated checks that run on every build, including checks that hold this policy and the storage disclosure against what the code actually does.

No system is perfectly secure, and any policy claiming otherwise is describing a hope. If you find a weakness, write to support@tradeus.app; we will not pursue anyone who reports one in good faith.

12.If something goes wrong

If personal data is breached and there is a risk to you, we report it to the Austrian data protection authority within 72 hours of becoming aware of it, as Art. 33 requires. Where the risk to you is high, Art. 34 requires us to tell you as well — and we will, directly, saying what happened, what was affected and what to do about it, rather than publishing a notice and hoping you read it. We keep a record of incidents even where no report is required.

13.Your rights

You can request access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to support@tradeus.app. If you believe we have handled your data unlawfully you can complain to the Austrian data protection authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna).

We answer within one month. Where a request is genuinely complex we may extend that by up to two further months and will tell you why inside the first month. There is no charge. We may ask you to confirm you are who you say you are — for a request to delete an account that can place trades, that is protection for you rather than an obstacle.

Two of these you can exercise yourself, immediately, without writing to anyone: switching a public profile field back to private withdraws that consent, and disconnecting a broker deletes its credentials on the spot. Deleting the whole account is done on request: write to support@tradeus.app and we delete it, within the month the law allows and usually the same day.

14.Children

The service is not for anyone under 18, and we do not knowingly collect data from anyone under that age — trading a leveraged account is not a minor's activity in any case. If you believe a minor has created an account, write to support@tradeus.app and we will delete it.

15.If you are in the United States

We apply the same standard to everyone rather than running a second, thinner policy for residents of states with their own privacy laws. For California in particular:

• We do not sell personal information, and we do not share it for cross-context behavioural advertising, as the CCPA/CPRA define those terms. There is therefore nothing for a “Do Not Sell or Share” link to switch off.
• You may request to know what we hold, to have it corrected, and to have it deleted, and we will not treat you differently for asking. The address is the same: support@tradeus.app.
• We do not use or disclose sensitive personal information for any purpose beyond running the service you asked for.
• Do Not Track and Global Privacy Control. There is now one thing to apply them to, and they are applied to it: a browser sending a GPC signal is treated as having declined the advertising pixel. It does not load, and you are not asked. Pressing Allow on the banner anyway still works — a specific answer about this site beats a standing general one — and so does pressing No.

16.Cookies and local storage

We write no cookies of our own, and use no analytics service and no session replay. What the site keeps is a small number of entries in your browser's own local and session storage, and each one is named there with its purpose and how long it lasts on the cookies and local storage page. This paragraph used to re-list them in prose, four lines above a comment promising the list could not drift back into fiction, and by then the prose had already dropped two of them. The generated list is the list.

Whop's advertising pixel sets a cookie on this domain, and only after you accept it on the banner. It is the one cookie that exists because of something we did, it is set by Whop's script rather than by us, and it identifies the visit so that an advertisement we paid for can be matched to a sale. It never loads on the pages behind your sign-in. The same random identifier is kept in two further places, and the script sends a fingerprint of your browser with each page view — a hash of screen size, time zone, language, fonts and the like, which is how it recognises a visit where cookies are refused. Every one of those is a named row on the cookies page, with what it holds and how long it lasts.

The checkout brings more that is not ours: when you open it, Whop's checkout script runs on this page and keeps its own entries here — two cookies, a device identifier for its fraud checks, read together with characteristics of your browser — under Whop's own privacy policy. Every one of these is named individually — with its purpose, how long it lasts and a button that deletes all of them — on the cookies and local storage page, which also sets out what the banner asks and what declining does.

17.Changes

If this policy changes materially we will say so in the product before the change takes effect. The date above is when this version was published. Earlier versions are not archived on the site; if you need to know what the policy said on a particular date, ask and we will tell you.