Privacy Policy

Effective Date: May 12, 2026  ·  Version 2.0

1. Who We Are

AlphaTerminal ("we", "us", or "our") operates the AlphaTerminal crypto trading terminal platform, accessible at alphaterminal.trade and via our iOS mobile application ("the App"). This Privacy Policy explains how we collect, use, share, and protect information about users ("you") of our website and mobile applications.

For questions about this policy, contact us at privacy@alphaterminal.trade.

2. Information We Collect

2.1 Information You Provide Directly

• Account registration: email address, display name, password (hashed)
• Exchange API keys: encrypted with AES-256-GCM, never stored in plaintext
• Payment information: processed by Stripe; we never see full card numbers
• Trading preferences, portfolio positions, and strategy configurations
• Support communications and feedback

2.2 Information Collected Automatically

• Device identifiers (device type, OS version, device ID)
• App usage data (features accessed, session duration, crash reports)
• IP address and approximate geographic location (country/city level)
• Log data (error logs, API request times, feature usage for performance monitoring)
• Analytics events (page views, conversion events, feature engagement)

2.3 Third-Party Data Sources

• Market data from CoinGecko, Binance, Bybit, Finnhub, and other exchanges
• On-chain wallet transaction data (public blockchain data for Whale Tracker features)
• This external data is not linked to your identity unless you explicitly connect it

3. How We Use Your Information

• Provide and operate the trading platform and all features you use
• Process payments and manage your subscription
• Send trading alerts, price notifications, and AI signals you subscribe to
• Improve our services, debug issues, and develop new features
• Communicate with you about your account, security, and product updates
• Comply with legal obligations and enforce our Terms of Service
• Detect and prevent fraud, unauthorized access, and abuse

4. How We Share Your Information

We do not sell, rent, or trade your personal data. We may share limited information with:

4.1 Service Providers

• Stripe — payment processing (subject to Stripe's privacy policy)
• Neon / AWS — database and infrastructure hosting
• OpenAI — AI signal generation (market data sent, not personal info)
• Render.com — application hosting and deployment
• Datadog — error monitoring and performance analytics

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government authority, or if necessary to protect the rights, property, or safety of AlphaTerminal, our users, or others.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all assets, user information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

5. Exchange API Keys

Your exchange API keys (Binance, Bybit, etc.) are encrypted with AES-256-GCM before storage. Keys are decrypted only in memory at the moment of an API call. We strongly recommend:

• Only granting read-only or trading permissions — never withdrawal permissions
• Setting IP whitelist restrictions on your exchange account to AlphaTerminal's server IPs
• Revoking and rotating keys periodically

AlphaTerminal cannot access your exchange funds directly. API keys only enable the trading and data actions you configure.

6. Data Retention

• Account data: retained while your account is active, deleted within 30 days of account closure
• Trade history and analytics: retained for 2 years to support performance reporting
• Encrypted API keys: deleted immediately upon disconnection or account closure
• Log data: retained for 90 days for security and debugging purposes
• Payment records: retained for 7 years as required by financial regulations

7. Your Rights and Choices

7.1 Access and Portability

You can request a copy of your personal data at any time by emailing privacy@alphaterminal.trade. We will respond within 30 days.

7.2 Deletion

You can request deletion of your account and associated personal data. We will delete your data within 30 days, except where retention is required by law (e.g., payment records).

7.3 Correction

You can update your email address and account information from within the app settings. For other corrections, contact privacy@alphaterminal.trade.

7.4 Opt-Out of Communications

You can manage notification preferences from Settings → Notifications within the app. You may opt out of marketing emails via the unsubscribe link in any email. Transactional emails (security alerts, receipts) cannot be opted out while your account is active.

7.5 California Residents (CCPA)

California residents have the right to know what personal information we collect, the right to delete that information, and the right to opt-out of sale (we do not sell personal information). Submit requests to privacy@alphaterminal.trade.

7.6 GDPR (EU/EEA Residents)

If you are located in the European Economic Area, you have rights under GDPR including access, rectification, erasure, restriction of processing, data portability, and the right to object. Our legal basis for processing is contract performance (operating the service you subscribed to) and legitimate interests (security, fraud prevention). Contact privacy@alphaterminal.trade for requests.

8. Children's Privacy

AlphaTerminal is not directed to children under 17 years of age. We do not knowingly collect personal information from children under 17. If we become aware that a user is under 17, we will terminate their account and delete their data promptly. If you believe a child has provided us with personal information, contact privacy@alphaterminal.trade immediately.

9. Security

We implement industry-standard security measures including:

• AES-256-GCM encryption for API keys and sensitive credentials
• TLS 1.3 encryption for all data in transit
• Parameterized SQL queries to prevent injection attacks
• JWT-based authentication with secure token handling
• Sandbox isolation — agent processes cannot access production credentials
• Regular security audits and dependency updates

No system is completely secure. You are responsible for maintaining the confidentiality of your password and for all activity under your account.

10. Third-Party Services and Links

The app may include links to third-party websites or integrate with third-party services (exchanges, data providers). This Privacy Policy does not apply to those services. We encourage you to review the privacy policies of any third-party services you use through or alongside AlphaTerminal.

11. International Data Transfers

AlphaTerminal operates primarily in the United States. If you are accessing our service from outside the US, your information may be transferred to and processed in the United States. We rely on Standard Contractual Clauses and other mechanisms where required to ensure transfers are lawful.

12. Push Notifications

If you enable push notifications, we collect your device push token to deliver trading alerts, price alerts, and AI signals. You can disable push notifications at any time in your device settings or in-app notification preferences. We do not use push notifications for marketing purposes without your explicit consent.

13. App Store Data Collection Disclosure

The following data types may be collected by AlphaTerminal and linked to your identity:

• Contact Info: Email address
• Financial Info: Payment details processed via Stripe; trading history for portfolio analytics
• Usage Data: App interactions, feature usage, session data
• Identifiers: User ID, device ID
• Diagnostics: Crash reports, performance data

The following data is collected but NOT linked to your identity:

• Crash data and diagnostic logs (anonymized)

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by an in-app notification at least 14 days before they take effect. Continued use of the service after changes constitutes acceptance of the revised policy.