XKalevur Privacy Policy
DRAFT FOR LEGAL REVIEW. Not in force until reviewed by counsel and published. Items in [square brackets] must be filled in or confirmed.
Effective date: [date] Version: [0.1 draft]
XKalevur ([ADDRESS - to be added]) ("we") runs XKalevur. This policy explains what personal information we handle and why. Contact: support@xkalevur.com.
1. The short version
- XKalevur runs on your computer. Your broker and exchange API keys, positions, orders, balances, settings and trading history stay on your computer. They are not sent to us.
- We hold only what is needed to run your account and subscription: your e-mail address, your plan and billing status, and the devices signed in.
- We do not sell personal information.
- We do not currently collect usage or diagnostic data from the software. If we add anonymous diagnostics later, it will be as described in section 5, and we will tell you before it starts.
2. What we collect and why
| Information | Why | Where |
|---|---|---|
| E-mail address | Your account; sending sign-in codes and service messages; matching payments to you | Our backend |
| Sign-in method (e-mail code and/or Google), Google account identifier and verified e-mail if you choose Google | To sign you in | Our backend; Google |
| Plan, subscription status, billing period dates, Stripe customer ID | To give you the features you paid for | Our backend; Stripe |
| Payment details (card, billing address) | Payment | Stripe only; we never see your full card number |
| Devices (a random device ID, device name, last seen) | To enforce the devices limit | Our backend |
| Security data: IP address and time of sign-in attempts, ban status | Fraud prevention and abuse protection | Our backend; Cloudflare |
| Messages you send us (contact form, support e-mails) and diagnostic bundles you choose to send | To answer you and fix problems. A bundle you export may contain logs of your orders and symbols; review it before sending | E-mail/support tools |
| Website data: standard server logs, cookies needed for sign-in | Operating and securing the site | Cloudflare |
We do not collect your broker keys, account numbers, balances, or trades.
3. Legal bases (where GDPR or similar law applies)
Contract (running your account and subscription), legitimate interests (security, fraud prevention, improving reliability), legal obligation (tax and accounting records), and consent where we ask for it (for example optional diagnostics).
4. Who receives data (processors)
Stripe (payments), Cloudflare (website, hosting, DNS, network security, e-mail forwarding), [Resend/Postmark] (sending sign-in e-mails), Google (if you use Google sign-in; and our mailbox provider), and professional advisers and authorities when the law requires. They process data for us under their own terms. Some are in the United States; where required we rely on appropriate transfer safeguards. [counsel]
Separately, the software on your computer talks directly to the services you connect (your broker, exchange, data and news providers, and any AI provider you configure). We are not a party to that traffic and do not receive it. Their privacy policies apply.
5. Anonymous diagnostics (not active yet)
Today the software sends us no diagnostics or usage data. If we add it, it will be limited to technical information about how the software runs (for example version, operating-system version, error types and counts, feature-load times), never your name, e-mail, broker details, keys, balances, positions, symbols traded or order details, and not linked to your account. We will update this policy, announce it, and make it opt-in [counsel/owner to confirm opt-in vs opt-out] with a switch in Settings.
6. Retention
Account data is kept while your account exists and afterwards for as long as needed for billing records, tax and legal duties, and fraud prevention (about [7] years for financial records). Sign-in codes expire in minutes. Support messages are kept [24] months. Banned-account identifiers are kept to prevent re-registration.
7. Security
Codes are stored hashed and expire quickly; sign-in is protected by rate limits; secrets are held in a managed secret store; traffic is encrypted. On your computer, keys are encrypted with the Windows data-protection store, and the optional PIN locks the screen after inactivity. No system is perfectly secure; keep your computer, e-mail and PIN safe.
8. Your rights
Depending on where you live (for example GDPR, UK GDPR, CCPA/CPRA) you may ask to access, correct, delete or export your data, object to or restrict processing, withdraw consent, and not be discriminated against for using these rights. Write to support@xkalevur.com; we may verify your identity. You may also complain to your data-protection authority. Deleting your account removes your account data from our systems except what we must keep by law. Cancel your subscription separately (see the Refund and Cancellation Policy).
9. Children
The Service is for adults (18+). We do not knowingly collect information from children.
10. Cookies
The website uses cookies/local storage needed for sign-in and security; [no advertising or cross-site tracking cookies].
11. Changes
We will post changes here and notify you of material ones by e-mail or in the app.
Questions? Write to support@xkalevur.com or use the contact form.