The short version: this is a personal tool on one machine. It keeps the
least it can get away with, sells nothing, and shares nothing. There is no data team here.
There is a dog.
What is stored
Access to your Alpaca account so the software can trade it: an OAuth token if you
signed in through Alpaca, or an API key if your invite asked for one. Either is stored on
the server in a file readable only by that account, and you can revoke it at Alpaca any
time.
Your own AI key, only if you choose to add one so your bot's AI costs are yours.
Stored the same way, and revocable at your AI provider.
Your name and email, only if the operator entered them when inviting you, and only
so they can tell whose bot is whose.
Trading records — the positions and trades made on your account, kept so the
dashboard can show you your own history.
A dashboard link token, stored as a one-way hash, so the software can tell a valid
link from an invalid one without holding the link itself.
What is not stored
No passwords, for anything.
No keys over plain HTTP. The key form is only offered on a secure (HTTPS) page.
Not your watchlist. The symbols you choose are written to a watchlist in
your own Alpaca account and read back from there. No copy is kept here.
No analytics and no tracking. The only cookies are sign-in cookies: one for your
control panel and one for the operator's admin page. Nothing is loaded from third-party
servers.
Who it is shared with
Nobody. Nothing is sold, rented, or handed to advertisers, data brokers or anyone
else. The third parties involved are:
Alpaca, because that is where your account lives and where orders are sent. Their
handling of your data is governed by their own policy.
Hetzner, the company whose server this runs on. They provide the machine and have
no business reading its contents.
AI services, for engines and features that use them. What is sent is market
numbers and news text, never your name, balances or account details. If you add your own
AI key, your bot's requests go to that provider under your key.
If you run Classic V2 or Turbo iRD, anonymized trade outcomes (market readings, % results
and timestamps — never your account, balances, trade sizes or name) are pooled on this machine
with everyone else who runs those engines, to improve the shared engines.
Where it lives
On a rented server operated by one person, hosted by Hetzner in Ashburn, Virginia, USA.
It is access-restricted and served only over HTTPS, but it is still one person's server, not a
bank vault, which is part of why the software deliberately holds as little as it does, and
why it can never move your funds. There is no analytics pipeline.
Your control
Revoke any time from your Alpaca dashboard. Access stops immediately and the
stored token becomes useless.
Ask for deletion. Contact the operator and your invite record, token and stored
trading records will be removed.
Stop the bot yourself from your dashboard, without revoking access, if you just
want it to pause.
Children
This is not for anyone under 18, and is not directed at them.
Questions, or to request deletion: support@nicholastrading.com