Privacy

Signing in with Discord gives us your Discord id, username and avatar - nothing else, and no server or message access. The Discord id is stored only in hashed and encrypted form; the access token is discarded immediately after sign-in. Your username here is pseudonymous; your real name is never requested.

Beyond that, we store what you put in: wallet addresses you track, read-only exchange API credentials (encrypted with AES-256-GCM before storage, decrypted only inside server code), imported trade data, and everything you write in your journal.

Nothing, until you publish it. Imported trades arrive private and stay private; profiles are off by default; publishing is per entry, with field-level withholding - a withheld field is absent from the published payload and never leaves the server. Setting an entry back to private deletes the public copy immediately.

No advertising, no sale of data, no third-party analytics or tracking scripts, no direct messages. There is no code path that places an order or moves funds - exchange access is read-only by construction.

Deleting your account removes your journal, connections, credentials, uploads, published entries and group memberships. Comments you left on other people's entries are anonymised rather than deleted, so the surrounding discussion stays readable.

One honest limit: public blockchains are public. Removing a wallet address here removes it from this platform only - the chain itself is not ours to delete.

Data is stored in Google Cloud (Firebase) in the United States. Exchange credentials are encrypted at the application layer before they reach storage, so the database never holds a usable key.