Privacy Policy

This Privacy Policy explains how NEWTRADIUM, LLC (“Newtradium”, “we”, “us”) collects, uses, discloses, and protects information when you use the Newtradium experimental trading-research platform (the “Platform”). It applies to the Sandbox (FakeCoins) and any Live Mode you choose to enable. By using the Platform you consent to the practices described here.

a. Account data

• Email address and display name (when authentication is used).
• Account identifiers, creation timestamps, and administrative allowlist membership.

b. Trading & telemetry data

• Sandbox balances, orders, positions, and equity snapshots.
• Every signal the engine generates: strategy identifiers, indicator values, confidence scores, and full reasoning chains.
• Risk settings, mode switches, and engine start/stop events.
• Administrative audit events (key changes, resets, approvals).

c. Exchange API credentials (Live Mode only)

• API keys/secrets for connected venues (Alpaca, Binance, Coinbase), stored encrypted — see Section 5.
• We never see or store your exchange account passwords.

d. Technical data

• Server logs: request timestamps, routes, status codes.
• Crash diagnostics and error traces (secrets redacted).

We do not run third-party advertising trackers, sell data to data brokers, or embed social pixels. There is nothing to opt out of because we do not collect it.

• To operate the engine: fetch market data, simulate or route orders, track positions.
• To render dashboards, reasoning logs, and performance telemetry.
• To enforce risk limits, state machines, and admin authorization.
• To secure the Platform: audit trails, abuse detection, incident response.
• To communicate critical operational notices (never marketing without separate opt-in).

Where GDPR applies, we process account and telemetry data under contract (operating the Platform you signed up for), legitimate interests (security, abuse prevention, service improvement — balanced against your rights), and consent (any optional communications). You may object to legitimate-interest processing or withdraw consent at any time via the contact below.

Exchange API credentials are encrypted at rest using AES-256-GCM, an authenticated cipher providing both confidentiality and tamper detection:

• A unique 96-bit initialization vector per encryption.
• An auth tag verified on every decryption — altered ciphertext fails closed.
• The master key lives only in server-side environment storage, never in the database, codebase, or client bundle.
• Plaintext secrets are never logged, cached in responses, or returned by any API endpoint — list views expose only a last-4 preview.

Broader measures include least-privilege database roles, HTTPS-only transport, fail-closed authorization checks, and append-only audit logging of administrative actions. No system is perfectly secure; Section 8 covers breach notification.

We share the minimum data necessary with these categories:

• Hosting: Vercel, Inc. (application hosting, edge network) — processes request data under its own DPA.
• Database: our managed PostgreSQL provider stores accounts, telemetry, and encrypted credentials.
• Market data: Binance public endpoints receive only ticker/kline requests — no personal data is sent.
• Exchanges (only if you enable Live Mode): your venue credentials are transmitted to execute your orders; those exchanges process your data under their own privacy policies.

We never sell personal information. We disclose data to authorities only where legally compelled, and then with prompt notice to you unless prohibited.

• Account records: until you request deletion, plus 30 days in backups.
• Trading telemetry & signal logs: retained while your account exists to power analytics; deletable on request.
• Encrypted credentials: deleted immediately when you deactivate a key; purged from backups within 90 days.
• Server logs: 30 days rolling.
• Audit trail: retained up to 1 year as an integrity record.

Subject to applicable law (GDPR, UK GDPR, CCPA/CPRA and similar), you may request: access to your data; correction; deletion; portability (machine-readable export); restriction of processing; objection to legitimate-interest processing; and withdrawal of consent. California residents will not be discriminated against for exercising rights. We verify requests before acting and respond within statutory windows.

In the event of a personal-data breach affecting your rights, we will notify affected users and regulators within the timelines required by law (72 hours to lead supervisors under GDPR where applicable).

The Platform is not directed at anyone under 18 and we do not knowingly collect data from minors. Accounts identified as belonging to minors are suspended and their data deleted.

The Platform is operated from the United States. Where data is transferred out of the EEA/UK we rely on adequacy decisions or Standard Contractual Clauses with processors. Transfers carry the protections described in Sections 5–7 regardless of geography.

We use only strictly-necessary local storage for session state. No analytics cookies, no cross-site tracking, no fingerprinting. A cookie-consent banner would be theater given what we actually store — so there isn't one.

Material changes to this policy will be reflected by the “last updated” date and, for significant shifts, by direct notice. Continued use after changes take effect constitutes acceptance.

Privacy questions, data-subject requests, and deletion demands: privacy@newtradium.com. We aim to substantively respond within 30 days.