Privacy

What we collect

Account info: name, username, email, and password (handled by our auth provider, Supabase — we never see or store your raw password). Your referral code and who referred you.

Trading connection: your PickMyTrade webhook token, stored encrypted, used only to relay orders on your behalf. We never store your Tradovate login or any broker credential directly.

Desk activity: the signals that reach the desk, the sim and live fills recorded from them, your sizing and risk settings, any broker fill statements you choose to upload for reconciliation, and any private hand notes you write (those are yours — not visible to admins).

Suitability answers: when you complete onboarding we ask about your trading experience and your financial situation — annual income, monthly expenses, and how much capital you can afford to put at risk. These are stored as brackets (for example “$50–100k”), never as exact figures, and are used to check that futures trading is appropriate for you and to size the risk warnings you see.

A wallet address, if you connect one: the crypto room's wallet panel, when it is open, lets you connect a wallet you already hold. The desk stores the public address you proved by signing a message, and the proof itself. For a wallet you connect, the desk asks only for a signed sentence: it never holds, generates or sees that wallet's private key or seed phrase, and never asks it to sign a transaction. You can revoke a stored address at any time from/crypto, whatever the room's switches say: while connecting is closed, or the room itself is closed to members, that page still shows a linked address with its REVOKE button, and revoking needs no switch to be on.

A desk wallet, if you create one: the recovery phrase and the private key are generated and kept in your own browser, on the signer's own origin, wallet.tradersoth.com — a page the desk opens as a pop-up and cannot read, any more than it could read a browser extension's store. That origin's storage, in that browser profile, holds the non-extractable signing key, the vault identity sealed under the wallet password you set, each vault's public material (its root, public seed and leaf hashes) and the signer's own record of which vault leaf signed which message. None of it is sent to, stored by, or recoverable from the desk; there is no field for any of it, and the password never leaves that window. The desk stores the same things as for a connected wallet — the verified address, the signed proof, the label “desk” — and where the key lives (“signer”, or “page” for the earlier desk wallet, which is retired). If the founder lifts the send lock, each send you make from a desk wallet, on devnet or on mainnet, is recorded against your seat — the network, the recipient address, the asset, the amount in base units, the priority fee you paid, the transaction signature and its outcome (requested, sent, confirmed or failed); you can read your own rows and an admin can read every row. Forgetting a desk wallet removes the key from the signer's storage in your browser, not the desk's record; revoking the link removes the desk's record, not the key.

The wallet disclosure, if you accept it: before a first send on mainnet the panel shows the wallet disclosure and asks you to accept it. The desk records against your seat which version you accepted and when, and asks again when the text changes. Devnet sends record no acceptance.

A vault, if you create one: the desk keeps a row per vault — the network, the program's id, the vault's address, the public half of its hash-based key (a Merkle root and a public seed), its height and tree number, and the transaction that created it — and a row per spend: the leaf number, the message digest, a hash of the signature payload, the recipient, the asset, the amount in base units, the staging account's address, the transaction signatures and the spend's status. Everything in those rows is already public on the ledger or is the desk's record of what you asked for; the signing half of the key never leaves the signer, and the desk has no column for it. You can read your own rows and an admin can read every row.

Your BTC Tells record, if you open that room: the BTC Tells page in the crypto room scores every call it makes against the public price, and the desk stores those scored calls, the signals it fired and its closed sim rows against your seat — hypothetical reads of public market data, never an order, a balance or a broker detail. The record is capped at 20,000 rows a day and deleted after 30 days; you can download any day of it as JSONL from /api/tells/record/export, and the desk's admin can read it. Your Trench fills, pasted or typed into that page, stay in your browser and are never sent to the desk; the ticket's multiplier, stake and cost in force travel with each closed sim row, and its multiplier and net payout with each scored call, because the record's dollar and payout figures are computed from them.

Security reports: when a desk page blocks a script or a connection the desk did not allow, your browser may post a security report to the desk. The report names the page's path and the blocked address; it is written to the server log without your identity and is not stored.

Pit Boss questions: what you type to the desk's concierge is sent, with a read-only summary of your own desk (sim totals, seat status, setup progress), to the model that composes the reply. Against your seat the desk records that you asked and when, which fixed topics the question matched, which rooms he dealt, which Learn pages he cited, whether the answer came up short, the length of the question and the turn count, and for a reading the bar frame and a coarse profit-factor bucket — and, when a reading is withheld, the rule that withheld it. It never stores your words or a reply you were shown.

The rest: support messages you send us, and a referral-attribution cookie (toth_ref, 30 days) set when you follow an invite link.

Why

To run the desk: authenticate you, compute sizing and risk figures against your own settings, relay and log signals, show you your own performance, and let you journal your own trades. To reach you: heartbeat alerts; an email when your own seat records a fill (on by default, one checkbox on your profile turns it off); and a weekly digest — off by default, opt-in. Each is stripped of any other member's name before it's sent. To keep the desk working: error monitoring when something breaks.

Who it's shared with

Only the services that make the desk function — never sold, never used for advertising:

• Supabase — accounts and the database.
• PickMyTrade — routes your relayed orders to Tradovate.
• Tradovate — the brokerage account you connect and control directly.
• Resend — sends desk emails (alerts, digests, support replies).
• Vercel — hosts the desk, and the signer page at wallet.tradersoth.com.
• Sentry — receives error reports when the app crashes, to help us fix it.
• Anthropic — the Claude API answers your Pit Boss questions; it receives the question and the read-only desk summary described above — and, if you press READ THIS TO ME under a backtest, the summary figures shown on that panel — nothing else, and only while the line is on.
• Solana nodes, through the desk — the wallet panel's chain reads and your sends no longer travel from your browser to a Solana node. Every call goes to the desk's own server, which forwards it to the node the owner configures for each network (or to Solana's public devnet and mainnet endpoints while none is set). So the desk's server sees every chain read the panel makes — the addresses, their balances and token accounts, and their transactions — and keeps a copy of each read for about a minute (the program's upgrade authority for about five) so the panel can draw without asking the node again, and nothing else beyond the ledger rows listed above; the node sees the desk's server and the public addresses asked about, not your IP address. Where the panel names USDC it names it by its mint: on mainnet EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v, on devnet a different token with no value. The panel also links faucet.solana.com and explorer.solana.com for the network you are on, which you open yourself.
• BTC Tells feeds — if you open that room, your browser itself connects to the public feeds of Coinbase, Kraken, Bitstamp, Deribit, OKX, Bybit, Hyperliquid, four Bitcoin mempool and chain nodes (mempool.emzy.de, mempool.space, blockstream.info, blockchain.info), the Jina reader, alternative.me and Google Fonts; each sees your IP address. The desk relays two Yahoo series and, as a fallback, Farside's table.

How it's protected

Your PickMyTrade token is encrypted before it's stored; the encryption key lives only in server environment variables, never in the codebase. Database access is scoped per-user with row-level security, so one member's ledger is not reachable from another member's session. That rule is enforced by the database itself rather than by the interface. Everything travels over HTTPS. The signer page at wallet.tradersoth.com is served under a content-security policy that lets it connect to nothing but its own origin and lets no other page frame it; the desk wallet's key is on that origin, where no script on a desk page can reach it.

Your data is stored on infrastructure operated by Supabase and Vercel, hosted in the United States. No system is immune to breach. If we discover one that affects your account data, we will email the address on your account and post a notice on the status page describing what happened and what to do about it.

How long we keep it

Signal and fill history is kept as a standing ledger, sim and live, and it is our policy never to reset or rewrite it: a record you can trust only works if nobody gets to edit the parts they dislike. One honest caveat, because the risk disclosure says the same thing and the two documents should agree: the desk is actively developed software, and while we do not reset ledgers deliberately, a defect or an infrastructure failure could still lose data. Your broker's statements remain the authoritative record of your account. Account info is kept while your account is active. You can ask us to delete your account and personal information at any time. Ledger rows tied to your account are anonymized rather than deleted outright, so the platform-wide activity counts shown to logged-out visitors stay accurate.

Your rights over your data

Wherever you live, you can ask us for a copy of the personal data held about you, ask us to correct anything inaccurate, ask us to delete your account and personal information, or object to a particular use. If you are in the UK, EU, or a US state with its own privacy law such as California, those requests are rights you hold under that law rather than favours we grant. Email the address at the bottom of this page and we will respond within 30 days. We do not sell personal information and do not share it for cross-context behavioural advertising.

Your choices

The weekly digest is opt-in and off by default; the fill email is on by default — turn either on or off from your profile. You can revoke the PickMyTrade connection at any time, which stops the desk from relaying anything further. You can ask us to export or delete your data by writing to the address below.

Cookies

We use the session cookie our auth provider sets to keep you signed in, and a 30-day toth_ref cookie to credit an invite link if you sign up later. No third-party advertising or tracking cookies.

Age

The desk isn't intended for anyone under the legal age to hold a futures brokerage account in their jurisdiction (18 in most places). We don't knowingly collect information from minors.

Changes

If this policy changes, we'll update the date at the top. We won't start using existing data in a materially new way without saying so here first.

Contact

Data requests or privacy questions: andrewlheras@gmail.com.