# Privacy Policy Updated 2026-10-20 This policy describes what BuildTrade™ stores, why, and what we deliberately do not collect. The short version: we store what the product needs to work, we do not sell data, and we never hold plaintext exchange credentials outside the moment they are used. ## Who is responsible BuildTrade™ is operated by LifeBusiness Technologies, based in Québec, Canada, which is responsible for the personal information described in this policy. The person in charge of protecting it is our Privacy Officer, reached at [support@buildtrade.app](mailto:support@buildtrade.app). ## What we store - **Account data:** email, password hash (bcrypt), optional TOTP secret (encrypted), subscription tier and billing status. - **Product data you create:** strategies, bots and their trade history, journal entries, chart drawings, preferences, referral relationships, gamification progress. - **Exchange credentials** (only if you connect an exchange for automated trading): encrypted with per-credential envelope encryption; decrypted just-in-time for order relay and zeroed immediately after use. Every decrypt operation is audit-logged. We refuse withdrawal-capable keys. - **Compliance log:** an append-only record of trading-region events — your attested region, and the IP-derived country, and browser user-agent captured on compliance-relevant events only (attestation, blocked requests, login-region mismatch). This exists to demonstrate good-faith enforcement of exchange jurisdiction rules. - **Operational logs:** standard server logs and aggregate, privacy-first admin metrics (counts, never browsing profiles). ## What we do not do - No sale or rental of personal data. No advertising trackers. - No third-party geolocation lookups — region hints come only from the country header your own connection already carries, read once and never stored as a location history. - No plaintext credential storage, ever, and credentials never appear in API responses or logs. ## The public website The BuildTrade™ website (buildtrade.app) sets no cookies for visitors and runs no tracking or analytics script. To learn which pages help people, it counts requests: each hour the request lines are added up into daily totals and then deleted. The totals cover the pages people opened, visits, where a visit came from (a search engine, an AI answer, a social site, Discord, an email, the web app, another website, or none), campaign tags in the link, the country Cloudflare reports for the connection, and the device type and browser family. - Never kept: your IP address, cookies, account, or anything that could link one visit to another. - A visit is the first page opened from outside the website. A reload, or a click from one page of the website to the next, is a page view, never a new visit. - Search engines, AI crawlers, AI tools opening a page because someone asked, link previews, SEO tools, scripts, bots that pretend to be a browser, and our own checks are each counted in their own group, never as people. The website tells them apart only from what each request says about itself: the browser's name, and whether it sent a few things every real browser sends. Never from an address, a cookie or a script. An AI that drives your own browser without saying so counts as you. - If your browser sends Global Privacy Control or Do Not Track, your visit adds one to the page it opened and nothing else about it is looked at or kept. A sign-up started from such a browser counts only as one sign-up that asked not to be tracked. - A sign-up button tells the app which part of the website it sits in (for example, pricing) and where the visit came from (for example, a search engine). The app adds one to each of those counts for the day and stores neither on your account. - Links we post in Discord carry a tag naming Discord, because the Discord app does not say where a link was clicked. The tag names the place, never you. - Our staff can tell the website to leave their own browser out of the counts. That sets one cookie in that browser only, holding nothing but a yes. - A detail seen fewer than 5 times in a day, such as a rare referring site or country, is merged into "Other" after 3 days. Daily totals are kept for 25 months. - Pages are delivered through Cloudflare, which sees your connection's address in order to deliver them. We do not keep it. More detail, in plain words: [Does the website track me?](https://buildtrade.app/help/website-visit-counts/) ## Payments Card details are entered directly with our payment processors and never touch our servers; we store only the processor's customer/subscription identifiers and payment status. Crypto payments are processed by a third-party crypto payment provider; we store the order and payment status needed to activate your subscription. ## Cookies and local storage We use an HttpOnly refresh-token cookie for authentication and browser local storage for interface preferences (theme, layout, acknowledgments). No cross-site tracking cookies. ## Retention and deletion Data is kept while your account exists. On account deletion we remove personal data; aggregate statistics and records we must keep for legal or security reasons (e.g. the compliance log) may be retained in de-identified or restricted form. ## Contact Privacy questions, or a request to see, correct or delete your personal information: write to our Privacy Officer at [support@buildtrade.app](mailto:support@buildtrade.app). Web page: https://buildtrade.app/legal/privacy/