Privacy policy

This page covers the hosted Exchange on this site. Exchange is open source, so other people run their own copies. If you sign in to someone else's copy, they hold your data, not us.

• Account: your name, email address, whether you verified it, and a scrypt hash of your password. If you sign in with Google, we also store the Google account link, the access, refresh and ID tokens Google issues with the scopes you granted, and your Google profile photo URL.
• Profile photo: the PNG, JPEG or WebP photo you add at sign-up, up to 90 KB, stored in the database.
• Workspaces: each workspace's name, its members and their roles, and pending invitations with the invited email address.
• Alpaca connections: the API key ID and secret for each connection, encrypted with AES-256-GCM, plus its name, paper or live, and the last 4 characters of the key ID so you can tell connections apart.
• Order history: every order placed through Exchange, with who placed it, through which connection, the symbol, side, quantity or amount, prices and status, and when it was replaced or canceled.
• Activity log: bulk cancels, closed positions, connection changes, member and role changes, deposit address changes and workspace switches, with who made each one.
• Deposit addresses: the USDC and USDT addresses you save for Ethereum and Solana.
• Sessions: for each signed-in session, the IP address and browser user agent. Sign-in attempts are also counted per IP address to block password guessing.

Your balance, positions, orders, watchlists and account details live in your Alpaca account. Exchange fetches them from Alpaca with your keys when you open a page. We don't keep a copy, except the order history described above. Alpaca's own privacy policy covers what Alpaca does with your data.

• A secure session cookie that keeps you signed in.
• Your theme, your chart type and your chart zoom, saved in local storage.

That's all. There are no analytics, no ads and no tracking scripts.

• Alpaca receives every request Exchange makes with your keys.
• Google, only if you sign in with Google.
• Resend sends the verification, password reset and invitation emails, so it sees your email address.
• Our hosting and database providers run the app and store the data above.
• Parqet serves the company and fund logos. In the app, our server fetches them through its image proxy, so Parqet sees our server and the symbols shown, not your IP address. On this site, your browser loads them straight from Parqet, so Parqet sees your IP address.
• randomuser.me serves the sample profile photos on this site's home page. Your browser loads them straight from randomuser.me, so it sees your IP address.

We don't sell your data or share it with anyone else, unless the law makes us.

Members of a workspace see its members, roles, connection names, order history and activity log. They never see your password or the keys themselves. Connections belong to the workspace, so keys you add stay there when you leave.

• Removing a connection deletes its encrypted keys.
• Deleting a workspace deletes its connections, order history, activity log and invitations.
• You can remove a saved deposit address at any time.
• There's no delete button for the account yet. Email support@treid.app from your account's address and we'll delete it, along with your photo, sessions and deposit addresses.

Orders and activity you made in a workspace you didn't own stay in that workspace's history, but your name is removed from them. Invitation entries keep the email address that was invited.

Keys are encrypted before they reach the database and are only decrypted on the server to call Alpaca. They are never sent to your browser. The code is public on GitHub, so you can check this yourself. To report a security problem, email support@treid.app instead of opening a public issue.

When this page changes, the date at the top changes too. We'll email you before any change to what we store or who we share it with.