Privacy Policy

1. Information We Collect

When you create an account, we collect your email address and a hashed version of your password. We do not store plaintext passwords. During your use of the platform, we collect:

• Account registration information (email address)
• Session data (hashed session tokens, IP address, user agent)
• Trading activity data (orders, positions, transaction history)
• Platform usage data (pages visited, features used)

2. How We Use Your Information

We use your information to:

• Provide and maintain your trading account
• Process and record your trading activity
• Ensure the security of your account
• Send important account notifications
• Improve the platform and user experience
• Comply with legal and regulatory requirements

3. Data Security

We implement security measures to protect your information, including:

• Argon2id password hashing (passwords are never stored in plaintext)
• SHA-256 session token hashing (raw tokens are not stored server-side)
• CSRF protection with HMAC-signed tokens
• Structured logging with automatic secret redaction
• TLS encryption for data in transit

For more details, see our security page.

4. Data Retention

We retain your account data for as long as your account is active. Trading history is maintained in an append-only ledger for audit and compliance purposes. If you request account deletion, we will remove your personal data while retaining anonymized transaction records as required.

5. Data Sharing

We do not sell your personal information. We may share your data only in these circumstances:

• With your explicit consent
• To comply with legal obligations or court orders
• To protect the security of the platform and its users
• With service providers who help us operate the platform (under strict data processing agreements)

6. Cookies and Session Management

We use HTTP-only, secure, SameSite cookies for session management. We use localStorage for user preferences like theme settings. We do not use third-party tracking cookies or advertising pixels.

7. Your Rights

You have the right to: access your personal data; correct inaccurate information; request deletion of your account and data; export your trading history; and withdraw consent for optional data processing. To exercise these rights, contact us at support@tradepunch.net.

8. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify users of significant changes via email or platform notification.