Privacy policy
This policy explains what personal data Algonney collects when you use algonney.com, its app and its guides at docs.algonney.com, why we collect it, who else processes it, how long it is kept and what you can do about it. Algonney is run by the operator of algonney.com ("we", "us").
Data we collect
Your account
- Your email address, your password stored only as a strong one-way hash (Argon2id), your role, plan and account status.
- Your two-factor secret (stored encrypted) and your backup codes.
- Your time zone, language and app settings, and the notes you allow the AI assistant to keep about you.
- If you sign in with Google: the Google account id and email address Google shares with us.
- Security records: email confirmations, password and email changes, two-factor changes and the devices that signed in to your account.
Exchange connections
- Your exchange API keys, secrets and, for OKX, passphrases. They are encrypted with XChaCha20-Poly1305 under a data key of your own, which is itself encrypted by the platform's master key. Only the last characters of a key are ever shown again.
- The key's permissions, its IP binding, the exchange's account id and whether it is a sub-account.
- The balances, orders, positions and trades the exchange reports for that account.
Jarvis chats and AI usage
- Your chats with Jarvis, the AI assistant: messages, the tasks it runs, the strategies it proposes and the memory notes you approve.
- What each AI request cost, in platform tokens.
Passwords, two-factor codes, API keys, seed phrases, card numbers, wallet addresses and other secrets are removed from your text before it is sent to an AI model and before it is stored.
Trading data
Your strategies and their versions, your bots, orders, fills, positions, trades, bot events, backtests and their results.
Sessions, security and logs
- Your sessions: when they started and were last used, the IP address and the browser.
- An audit log of security and money actions (for example sign-ins, key changes, withdrawals and staff actions), with the IP address.
- A one-way hash of the IP address you signed up from, used to detect referral abuse.
- A random device id stored in your browser and sent at sign-up and sign-in, used against abuse.
- Technical logs: errors reported by the app in your browser, requests for pages that do not exist, and server logs.
Site analytics
We count visits with our own first-party analytics: pages viewed, time on page, scroll depth and clicks, the source that brought you, the device type, operating system and browser family, and the country and region looked up from your IP address in a local database. The IP address and the full browser string are not stored for analytics. With your consent, an anonymous visitor id cookie tells new visits from returning ones. We use no third-party analytics or advertising tags.
Payments and wallet
Your orders, invoices, subscriptions and plan periods; your deposit address; the asset, amount and the sending address of each payment; your saved withdrawal addresses and withdrawals; your wallet and token balances and their history; promo codes and referral records.
Support and feedback
Your support chats, tickets and the images you attach to them, and feedback you send us.
Voice typing
Voice typing uses your browser's own speech service; some browsers process speech on their own servers. Algonney does not receive or store your audio, only the text you send.
Why we use it
- To run the service: your account, strategies, backtests, paper and live bots, payments, wallet and support.
- To keep it safe: two-factor authentication, sign-in protection and alerts, the audit log, and the detection of abuse, fraud and referral farming.
- To meet our obligations: keeping finance and payment records.
- To improve it: understanding how the site and app are used through first-party analytics, and reviewing Jarvis chats to improve the assistant (see below).
- To contact you: account emails and the notifications you choose in Settings.
We do not sell your personal data and do not use it for advertising.
Who can see your data
Our staff
Staff see personal data only through admin tools with a specific permission, and every staff read of a user's personal data is recorded in the audit log. To improve the service, staff with the chat history permission may read copies of Jarvis chats. Secrets are removed from these copies before they are stored, every view and export is audited, and the copies are deleted after the period in the table below or when you delete your account. Your own chat list in the app is not affected.
Service providers
These services process data on our behalf, each for its own role:
| Role | Provider | What it receives |
|---|---|---|
| AI models for Jarvis and the support helper | AI model providers, reached through OpenRouter | Your chat text with secrets removed, and the context the assistant needs |
| Crypto payments | Algonney Pay | Payment orders, deposit addresses, withdrawal requests and amounts |
| An email delivery provider | Your email address and the emails we send you | |
| Sign in with Google | Only if you choose it: the sign-in request | |
| Network, DNS, protection and backups | Cloudflare | All traffic to our sites passes through it; encrypted off-site backups are stored there |
| Trading | Binance, Bybit and OKX | The orders and requests your bots send with your key, from our server |
| Market data | CoinGecko | Requests for market capitalisation data, with no personal data |
| Location for analytics | db-ip | Nothing: we download its country database and look up addresses locally |
Payments on a blockchain are public by nature: the sending and receiving addresses and the amount of a transaction can be seen by anyone and cannot be erased.
Other users
If someone invited you with a referral link, they see that you signed up and paid, with your email address masked. A backtest you share by link can be opened by anyone who has the link.
Authorities
We disclose data when the law requires it.
Our providers may process data in countries other than yours.
Cookies
We use necessary cookies, and analytics and marketing cookies only with your consent. The Cookie policy lists every cookie and browser storage item, and Cookie settings at the bottom of every page changes your choice.
How long we keep data
Most data is kept while your account exists. For your event log, chats, AI usage, trades and orders, you choose how long they are kept in Settings › Data & logs, up to your plan's maximum:
| Limit | Free | Starter | Pro | Max |
|---|---|---|---|---|
| Maximum retention | 365 days | 730 days | 1,825 days | 3,650 days |
Other data is kept for fixed periods:
| Data | Kept |
|---|---|
| Chat history: days kept | 30 days |
| Keep finished tasks | 7 days |
| Support chat retention | 90 days |
| Notification retention | 30 days |
| Trades and equity retention | 180 days |
| Raw analytics kept | 90 days |
| Daily analytics totals kept | 396 days |
| Guest event retention | 396 days |
| Browser errors retention | 30 days |
| 404 list retention | 90 days |
| Keep minute rows | 30 days |
| Keep app logs | 14 days |
| Deletion grace period | 7 days |
| Finance records retention | forever |
Support tickets are kept until your account is deleted. The audit log is kept without a time limit. Backups are encrypted and replaced on a rolling schedule, so deleted data can remain in a backup until that backup is replaced.
Deleting your account
You can delete your account in Settings › Data & logs. The deletion happens after a grace period of 7 days, during which you can cancel it. The request ends all your sessions and stops your bots.
Before the deletion can finish, your wallet's USDT balance must be withdrawn, and no live position or pending deposit may remain open; the deletion waits until then. Unused platform tokens are lost, and you are asked to confirm that.
When the account is deleted, your data is deleted or anonymised. Your exchange keys are removed. Finance records, such as payments, invoices, ledger entries and AI usage, and the audit log are kept with your identity removed, for the period in the table above, because money records must stay complete.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict some uses, and to withdraw consent. In the app you can:
- download a copy of your data with Export my data in Settings › Data & logs;
- correct your account details in Settings;
- choose what is kept and for how long in Settings › Data & logs;
- change your cookie choice with Cookie settings;
- choose which notifications you receive;
- delete your account.
For anything else, contact us. You may also complain to the data protection authority where you live.
How we protect data
Exchange keys and two-factor secrets are encrypted, passwords are stored only as one-way hashes, connections use HTTPS, sensitive actions need a two-factor code, and staff access is limited by permission and audited. See Security.
Age
The service is not meant for anyone who is not old enough to enter a binding contract where they live (see the Terms of Service).
Changes
We may change this policy. We announce material changes in the app before they take effect. The date at the top of the page shows the latest version.
Contact
Questions about this policy or your data: support@algonney.com, or Support in the app.
Related policies
Terms of Service · Cookie policy · Risk disclosure · Acceptable use policy · Subscription policy · Wallet terms · Referral terms