Privacy Policy

Educational project. This policy is a plain-language draft, not legal advice.

1. Who is responsible

The project author (a student; see contact below) operates the service.

2. What data is stored

• E-mail address and a salted hash of your password (argon2); the password itself is never stored.
• The Alpaca OAuth access token for your paper account, encrypted at rest (AES-256-GCM, bound to your user), and the Alpaca account number.
• Trading data created through the service: positions, closed trades, planned orders, account balance snapshots, strategy state.
• An audit log of actions (for example order placed, account connected). It does not contain secrets.

3. Why

Only to operate the service for you: to authenticate you, place orders on your paper account and show you your portfolio.

4. Sharing

Data is not sold or shared. It is sent only to Alpaca (to place and read orders on the account you authorized). Market prices are downloaded from a public data source and contain no personal data.

5. Retention and deletion

Data is kept until you delete your account. You can disconnect your broker (token erased) or delete your account and all associated data yourself in the app, or ask for it by contacting the author.

6. Security

Connections use HTTPS, passwords are hashed, broker tokens are encrypted and the service only requests the trading permission for paper accounts.

7. Your rights

You may ask for access to, correction or erasure of your data. Contact: the project author (contact details available on request)

Back