Privacy Policy

1. Who we are

TradeQRX is operated by Xbitium Technologies LLC ("we"). This policy explains what we collect, why, and your choices. Contact: [email protected].

2. What we collect

• Account data — name, email, and a salted hash of your password (we cannot see your password). Passkeys store only public-key credentials.
• Subscription & payment data — plan, status, renewal dates, and payment records. Card details are handled entirely by Stripe; we never receive or store card numbers.
• Broker API keys (Automation users only) — stored encrypted at rest and used solely to execute automation on your own accounts. We instruct users to supply trade-only keys without withdrawal rights.
• Usage data — signals you track, paper-portfolio activity, delivery preferences, and standard server logs (IP, timestamps) for security and operations.

3. How we use it

To provide and secure the Service, deliver the signals and emails you opt into, process subscriptions, respond to support requests, and improve the platform. We do not sell your personal data, and we do not use it for third-party advertising.

4. Sharing

We share data only with processors needed to run the Service: Stripe (payments), Resend (email delivery), and our hosting infrastructure provider. Each processes data under its own privacy terms. We may disclose information if required by law.

5. Cookies and local storage

The console stores a session token in your browser (sessionStorage) to keep you signed in. We do not use advertising trackers.

6. Retention

We keep account data while your account is active. Payment records are retained as required for accounting and tax purposes.

7. Deletion

You can delete your account in the console (Account → Danger zone). Deletion immediately deactivates the account, removes you from all mailings, and queues personal data for removal from active systems; residual copies in encrypted backups are purged on the normal backup rotation cycle. Broker keys are deleted immediately on request or account deletion.

8. Security

Transport encryption (TLS) everywhere; passwords hashed with bcrypt; broker secrets encrypted at rest; access limited to operational need. No system is perfectly secure — please use a unique password and consider adding a passkey.

9. Children

The Service is for adults 18+. We do not knowingly collect data from minors.

10. International users

The Service is operated from the United States; by using it you consent to processing in the U.S.

11. Changes

We will announce material changes to this policy via the Service or email.