Privacy policy

Tradeglyph — hello@tradeglyph.com.

Upon registration: email address, password (encrypted), first and last name (optional).

During use: trade data imported from your exchanges via read-only API key, API keys (AES-256 encrypted, never accessible in plain text), notes, tags and annotations added to your trades, performance data and statistics.

Automatically: IP address (server logs, kept 30 days), navigation data, browser type and operating system.

Your data is used to: provide and maintain the Tradeglyph service, manage your account and subscription, generate AI analyses of your trades (data transmitted to the Anthropic API), send email notifications you have enabled, process payments via Stripe, and respond to support requests.

Contract performance — service provision, account and subscription management.
Legitimate interest — security, fraud prevention, service improvement.
Consent — email notifications (revocable at any time).
Legal obligation — retention of billing data.

Vercel Inc. — hosting (USA, Privacy Shield certified).
Anthropic PBC — AI trade analysis (USA, anonymised data).
Stripe Inc. — payment processing (USA, PCI-DSS certified).

These transfers outside the EU are governed by standard contractual clauses (SCC) compliant with the GDPR.

Active account data: retained for the duration of the account. Data after account deletion: deleted within 30 days. Billing data: 10 years (French legal obligation). Server logs: 30 days.

You have the right to access, rectify, erase, port, object to, and restrict the processing of your data. To exercise these rights, contact us at hello@tradeglyph.com. We will respond within 30 days. You may also lodge a complaint with your local data protection authority.

Tradeglyph implements: bcrypt password hashing, AES-256 encryption of exchange API keys, HTTPS/TLS on all communications, two-factor authentication (TOTP 2FA), JWT token rotation and revocation, encrypted database backups.

Tradeglyph uses only strictly necessary cookies for service operation (session, authentication). No third-party advertising or analytics tracking cookies are used.

Any material changes to this policy will be notified by email to active users at least 30 days before taking effect.