Privacy Policy

Account information

• Email address and display name (provided at registration).
• Hashed password (we never store plaintext passwords).
• Subscription tier and billing history.
• Telegram chat ID (if you link Telegram).

Usage data

• Backtest and hyperopt run metadata (timeframes, pairs, results).
• VPS instance metadata (tier, region, status, uptime).
• Audit logs of account actions (login, VPS creation, deletions).

Data we do NOT collect

• Exchange API keys — stored exclusively on your VPS, never on our servers.
• Strategy source code — resides on your VPS only.
• Trading PnL, balances, or portfolio data.

• To provision and manage your VPS infrastructure.
• To process payments and maintain billing records.
• To send transactional emails (payment confirmations, trial notifications, service alerts).
• To provide customer support.
• To monitor service health and prevent abuse.

• All data is stored in EU data centers (Hetzner, Germany).
• Databases are encrypted at rest and connections use TLS in transit.
• Exchange credentials on your VPS are encrypted with per-customer Fernet keys (AES-128-CBC + HMAC-SHA256).
• Passwords are hashed with Argon2id.
• Access to production infrastructure is restricted to authorized personnel with 2FA.

• Active accounts: data is retained for the duration of your subscription.
• After cancellation: your VPS and all data on it are permanently deleted within 7 days (or immediately upon request).
• Billing records: retained for 24 months after account closure to comply with tax and accounting obligations, then anonymized or deleted.
• Audit logs: retained for 12 months, then purged.

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — request a copy of all personal data we hold about you via the data export feature in your account settings.
• Right to rectification — update your personal information from your account settings.
• Right to erasure — delete your account and all associated data from your account settings.
• Right to data portability — export your data in a machine-readable JSON format.
• Right to object — contact us to object to specific data processing activities.
• Right to lodge a complaint — you may file a complaint with your local data protection authority.

To exercise any of these rights, contact privacy@freqedge.io.

FreqEdge uses minimal browser storage:

• Authentication tokens (essential) — stored in localStorage to maintain your session. These are not tracking cookies.
• Cookie consent preference (essential) — stored in localStorage to remember your cookie choice.

Product analytics uses Plausible in a cookieless configuration (no cookies, no localStorage identifiers, no fingerprinting). Events are aggregated page and funnel metrics only. Because Plausible does not set cookies or store personal data in your browser, it is not gated behind the consent banner. We do not use advertising trackers or US ad-tech pixels.

We share limited data with the following processors, all of which maintain their own GDPR-compliant privacy policies:

• Stripe — payment processing (email, billing details).
• Plausible Analytics — cookieless product analytics (pageviews and named funnel events; no personal identifiers stored in the browser). Prefer a self-hosted EU instance when configured.
• Hetzner Cloud — VPS infrastructure (server metadata).
• Resend — transactional email delivery (email address).

We do not sell, rent, or share your personal data with any other third parties.

For privacy-related inquiries or to exercise your data rights:

• Email: privacy@freqedge.io
• General: legal@freqedge.io