Your privacy is important to us. This policy explains what information we collect, how we use it, how we protect it, and the rights you have over your data. Plain language wherever possible — legalese only where the regulator requires it.
What we collect
- Email address
- Name (optional)
- Password — securely hashed, never stored in plain text
- Exchange API keys (strongly encrypted at rest)
- Discord / Telegram channel preferences
- WhatsApp selected group id / name (linked-device connection)
- Trading settings & risk parameters
- Trade history & execution logs
- Profit / loss records
- Signal history — including message content from the source channel(s) or group(s) you select on Discord, Telegram, and WhatsApp
- Login timestamps
- Feature usage patterns
- Error logs (anonymized)
WhatsApp connections
When you connect WhatsApp, we link to your account as a WhatsApp Web "linked device", using the same QR pairing WhatsApp offers for its desktop and web clients. As with any linked device, that link is technically account-wide — WhatsApp does not offer a link scoped to a single group. Our service is built to self-restrict to only the group(s) you select: every other chat is discarded before its text is read, and we do not read or store your other chats, contacts, calls, status, or media.
- Read-only. The service never sends, replies to, forwards, deletes, or posts anything on WhatsApp. It only reads messages from the group(s) you select.
- Selected groups only. We retain the message content of your selected group(s) as signal history to operate the Service; content from any other chat is dropped and never stored.
- You stay in control. You can revoke access at any time by disconnecting in the app or by removing the linked device from your phone (WhatsApp → Settings → Linked devices). Revoking tears down the session, and no further messages are read.
How we use it
| Purpose | Data used |
|---|---|
| Provide the Service | Account, Config, Trading data |
| Execute trades | API keys, Trading settings |
| Calculate profit share | Trading data, Profit records |
| Send notifications | Email address, Trading events |
| Improve the Service | Usage data (anonymized) |
Data security
🔒 We take security seriously
- API keys are strongly encrypted at rest
- Message content from your selected signal group(s) is encrypted at rest
- Secrets such as connection and proxy credentials are encrypted at rest
- Passwords are securely hashed
- All connections use TLS 1.3 / HTTPS
- Each WhatsApp session runs on dedicated, isolated per-user infrastructure — never a shared server connection
- Incoming signal messages are integrity-verified (HMAC) before they are ingested
- We never request withdrawal permissions for exchange APIs
- Regular security audits and penetration testing
Data sharing
We do not sell your personal information. We may share data with:
- Exchanges & brokers — to execute trades, using the API keys you provide
- Payment processors — Stripe for billing, limited to payment information
- Trusted service providers (sub-processors) — to operate the signal-detection part of the Service, the message content of the source channel(s) or group(s) you select on Discord, Telegram, and WhatsApp is processed by our own systems and a limited number of trusted third-party service providers acting on our behalf. They process it solely to detect and extract trading signals from that content, are contractually bound to use it only for that purpose, and may not use it for any other purpose or retain it beyond what that purpose requires.
- Law enforcement — when legally required, subject to court order or subpoena
Data retention
- Account data — until you delete your account
- Signal & message history — message content from your selected signal group(s) or channel(s) is kept as signal history for as long as your account is active, and is deleted when you delete your account or request deletion; it is encrypted at rest the whole time it is retained. Disconnecting a source stops any further content being read.
- Trading history — 7 years (tax / compliance)
- Server logs — 90 days
- Backups — 30 days, then permanently destroyed
Your rights
You have the right to:
- Access — request a copy of your data
- Correct — update inaccurate information
- Delete — request account deletion
- Export — download your data in a standard format
- Restrict — limit how we process your data
To exercise these rights, contact support@signalcopier.io. We respond within 30 days.
GDPR (EEA / UK)
If you are in the European Economic Area or the United Kingdom, we process your personal data on these legal bases: performance of a contract (to provide the Service you signed up for), your consent (e.g. connecting a Discord/exchange account or opting into notifications, which you can withdraw at any time), legitimate interests (securing and improving the Service), and legal obligation (e.g. tax and accounting records). You also have the right to object to processing and to lodge a complaint with your local data-protection authority.
CCPA / CPRA (California)
If you are a California resident, you have the right to know what personal information we collect, to request deletion, to correct it, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights. Categories collected and their purposes are described in "What we collect" and "How we use it" above.
Cookies & tracking
We use minimal cookies:
- Essential — session authentication (required)
- Preferences — UI settings like theme + ticker on/off (optional)
We do not use third-party advertising trackers. We use Plausible for privacy-friendly analytics — no cookies, no personal data.
International transfers
Your data may be processed in countries outside your residence. We use Standard Contractual Clauses where applicable to ensure adequate protection.
Children's privacy
Our Service is not intended for users under 18. We do not knowingly collect data from minors.
Changes to this policy
We may update this policy periodically. Significant changes will be notified via email or in-app banner before they take effect.
Contact us
For privacy-related inquiries: support@signalcopier.io.