Privacy Policy

Version 2026-08-11 · Effective 2026-08-11

Privacy Policy

Effective date: 2026-08-11 · Version 2026-08-11

This Policy explains what [PROVIDER ENTITY] ("Provider", "we", "us") collects when you use the ScaleDCA service (the "Service"), why, who it is shared with, and what you can do about it. It forms part of the User Agreement.

1. What we collect

We collect only what the Service needs to operate. There is no advertising, no profiling and no behavioral tracking.

1.1 Account information

  • Email address — your sign-in identity and the address for verification, password reset and notices.
  • Password — stored only as a bcrypt hash. We never store, and cannot recover, your plaintext password.
  • Display name, if you set one.
  • Sign-in security data — count of consecutive failed sign-in attempts and any resulting lockout expiry, used to resist password guessing.
  • Invitation records — the email address invited and who invited it, since access is by invitation.

1.2 Brokerage connection

  • Brokerage account number and the name you give the account.
  • A reference to where your Credentials are stored. See Section 3.
  • We do not store your API key or secret in our application database.

1.3 Trading and financial data

This is the most sensitive category we hold, and it is detailed.

  • Every Order — security, side, quantity, price, dollar amount, status, timestamps, broker order identifiers and realized profit or loss.
  • Positions — quantity held, average entry price, market value and cost basis.
  • Tax lots — for applicable Strategy Types, individual purchase lots with acquisition date, cost per share and remaining quantity.
  • Strategy configuration — the security, Strategy Type and every parameter you set, including amounts, thresholds and ladders.
  • Strategy state — invested base, booked profit, step counters, ladder state and related bookkeeping.

1.4 Decision and audit records

  • A per-trade decision record for each Order, written to cloud object storage, containing the Strategy's full configuration and state at the moment of the decision, a snapshot of your broker position (quantity, average entry price, current price and market value), and the resulting order intent and fill.
  • An audit log of significant actions — sign-up, configuration changes, credential updates, acceptance of the User Agreement, halts — recording who acted, what changed, and the before and after values.

1.5 Notifications

  • Telegram chat identifier, if you connect Telegram, together with a hashed verification code and its expiry while verification is pending.

1.6 Technical data

  • Application logs, including structured records of Strategy decisions containing securities, prices and quantities, and platform-level request and error logs.
  • Email delivery metadata — we log the recipient address and subject of transactional emails we send. We do not log the body, which carries verification and reset tokens.

1.7 What we do not collect

  • No analytics of any kind. No Google Analytics, no product analytics, no session replay, no heatmaps.
  • No advertising or marketing trackers, no third-party pixels, no cross-site tracking.
  • No sale or sharing of personal information for advertising purposes, under any definition, ever.
  • The application's content security policy restricts network connections to our own origin, which is what makes the above verifiable rather than merely asserted.

2. How we use it

We use your information solely to:

  1. authenticate you and secure your account;
  2. connect to your Brokerage Account and execute your Strategies;
  3. display your positions, performance, history and reports;
  4. run backtests you request;
  5. send you transactional email and, if you enable it, Telegram notifications;
  6. maintain the audit and decision records described in Section 1.4, which exist so that any Order can be explained after the fact;
  7. operate, secure, debug, monitor and improve the Service; and
  8. comply with law and enforce the User Agreement.

We do not use your data to train machine-learning models, to build advertising profiles, or for any purpose unrelated to operating the Service.

3. How brokerage credentials are protected

Your Credentials receive stronger protection than any other data we hold.

  • They are never written to our application database and never written to logs. We log only that credentials were set, never their values.
  • They are encrypted before storage using envelope encryption: a data key encrypts the credential, and that data key is itself wrapped by a key held in a managed cloud key-management service.
  • The ciphertext is held in a managed secrets service, encrypted at rest with a customer-managed key.
  • Encryption is bound to your user, broker and account identity, so stored material cannot be decrypted for a different user or a different account.
  • Access is restricted by infrastructure permissions scoped to the specific secret prefix each service needs.

We do not warrant that these measures cannot be defeated. You can revoke Credentials at your Broker at any time, and you should do so if you stop using the Service or suspect a compromise.

4. Who we share it with

We do not sell your personal information. We share it only with the following service providers, and only as needed to operate the Service.

  • Google Cloud Platform — hosting, database, object storage, secrets, key management and logging. All infrastructure is in the United States, in a single region.
  • Alpaca Securities LLC — your Broker. We transmit Orders and read your account, positions and market data. Your relationship with Alpaca is governed by your agreement with Alpaca, not by this Policy.
  • Telegram, only if you connect it. Notification messages we send carry trade and position detail including security, price, quantity, invested base and booked profit. Once sent, that content is on Telegram's servers and subject to Telegram's own policies.
  • An email delivery service (currently Google's SMTP service) for verification, password reset and invitation email.

We may also disclose information where required by law, subpoena or legal process; to protect the rights, property or safety of Provider, our users or the public; to investigate fraud or a security incident; or in connection with a merger, acquisition, financing or sale of assets, in which case the acquirer is bound by this Policy or gives notice of a replacement.

5. Cookies and local storage

We use no advertising or analytics cookies. We set only:

  • pk_session — an HttpOnly, Secure session cookie holding your signed session token. It is not readable by page scripts. The session expires after 30 minutes of inactivity and after 12 hours absolutely, whichever comes first.
  • pk_session_meta — a readable cookie holding only the session expiry time, so the interface can warn you before you are signed out.
  • pk_theme — a browser local-storage entry recording your light or dark theme preference. It never leaves your browser.

pk_session is strictly necessary for the Service to function, so it cannot be disabled while you are signed in.

6. Security

We protect the Service with, among other measures: bcrypt password hashing; signed session tokens delivered in HttpOnly cookies with sliding and absolute expiry; account lockout after repeated failed sign-ins; multi-tenant isolation enforced on every request, so that one user's data cannot be reached through another's session; a strict content security policy; HTTP Strict Transport Security; and clickjacking and MIME-sniffing protections.

No system is perfectly secure. Provider's own security review records outstanding pre-production items, including penetration and load testing of the authentication system and alerting on authentication anomalies. You accept the Service in that condition, as disclosed in the Risk Disclosure Statement, Part G.

7. Retention

Other categories:

  • Account and trading records are retained while your account exists and for as long as needed afterward for legal, tax, accounting and dispute-resolution purposes.
  • Platform logs are retained according to the cloud provider's default retention.
  • Backups and snapshots are retained on infrastructure schedules and may hold your data for a period after deletion from the live system.

8. Your choices and rights

8.1 What you can do today, yourself

  • See your data — the Service shows your full trade history, positions, per-trade decision detail and a feed of recent account activity.
  • Correct it — you can update your display name and change your password.
  • Disconnect Telegram — this deletes the stored chat identifier.
  • Revoke brokerage access — at your Broker, at any time.

8.2 What requires contacting us

8.3 What deletion can and cannot reach

If we delete your account, we can delete your user record, profile, linked brokerage accounts, Strategies, positions and order history from the application database, and we can delete your stored Credentials from the secrets service.

We cannot delete, and will not delete, the per-trade decision records in object storage or entries already written to platform logs. Those are protected against modification and deletion by design, for the reason given in Section 7. Where the law grants you an erasure right, we will honor it to the extent it applies and will tell you plainly what we have retained and why.

8.4 State privacy rights

Depending on where you live, you may have rights to know, access, correct, delete, obtain a portable copy of, or limit the use of your personal information, and a right not to be discriminated against for exercising them. Exercise any of these by emailing [CONTACT EMAIL]. We do not sell personal information and we do not share it for cross-context behavioral advertising, so no opt-out of those activities is needed.

8.5 Communications

Transactional email — verification, password reset, security and account notices — is part of the Service and cannot be turned off while your account is open. We send no marketing email. Telegram notifications are opt-in and can be disconnected at any time.

9. Location of data

The Service is operated from the United States, and all data is stored and processed in the United States. If you access the Service from outside the United States, you consent to that transfer. The Service is intended for users in the United States, and we have not designed it for compliance with non-United States data-protection regimes.

10. Children

The Service is not directed to anyone under 18, and use requires you to be at least 18. We do not knowingly collect information from children. If you believe a child has provided us information, contact [CONTACT EMAIL] and we will delete it.

11. Security incidents

If we become aware of a breach affecting your personal information, we will notify you by email to the address on your account, without undue delay and as required by applicable law, describing what we know, what we are doing about it and what you should do.

12. Changes to this Policy

We may update this Policy. The version and effective date appear at the top. For a material change we will give notice by email or in the Service, and where the change materially affects how we handle your data we may require you to accept the revised User Agreement before continuing to use the Service.

13. Contact

  • Email: [CONTACT EMAIL]
  • Post: [PROVIDER ENTITY], [NOTICE ADDRESS]

Related: User Agreement · Risk Disclosure Statement