Privacy Policy
Effective 26 July 2026
What we collect
Sign-in basics from your Google account (email address, name, profile picture). The exchange API credentials you choose to save, which must be read-only. The account data those credentials return: positions, balances, funding payments, fees and trade history. Basic technical logs needed to operate the service.
What we never collect
No exchange passwords. No credentials capable of trading or withdrawing (they are rejected at save time). No card numbers or payment details: cryptocurrency payments are handled entirely by Heleket, the payment processor, and we only receive a signed confirmation that a payment happened.
How data is used
Solely to provide the service: computing your analytics, maintaining your subscription status, and responding to support requests. Your data is never sold and never used for advertising.
Storage and security
Data is hosted in the European Union (Frankfurt). Exchange credentials are encrypted at rest with a key held separately from the database. Sessions are protected with signed, HTTPS-only cookies. Standard backups of the database are kept; backups contain credentials only in encrypted form.
Sharing
Data is shared only with the infrastructure needed to run the service: Render (hosting), Google (sign-in), Heleket (payment confirmation), ImprovMX (delivering account email such as password resets and renewal notices, which means they handle your email address and the contents of those messages), and the exchanges you connect (requests are made to them with your credentials on your behalf). Beyond that, only if required by law.
Cookies and local storage
We use one signed session cookie to keep you logged in, and two small local-storage keys for your theme choice and your answer to the cookie notice. There is no advertising and no third-party tracking. The full inventory, with purposes and durations, is in the Cookie Policy.
Audience measurement
We count visits to our own pages, on our own servers, with no analytics provider involved. We record the page, the time, the linking domain and any campaign tag. To count a person rather than a page, your IP address and browser type are combined into a one-way hash under a key that rotates daily and is deleted after 48 hours; neither the IP address nor the browser type is ever stored, and after the key is deleted the hash cannot be linked back to you. These records are aggregate, are kept at most 400 days, and are never sold or shared. The legal basis is our legitimate interest in knowing whether the service is being found and used. Do Not Track and Global Privacy Control are honoured, and the mechanism is described in full in the Cookie Policy.
When you create an account we also store the campaign or linking domain you arrived from, so we can tell which channels bring people who stay. It is a single label such as "google.com", attached to your account and nothing more.
Marketing email
We send marketing email only to people who have switched it on in Settings, which is off unless you turn it on. We record when you gave that permission so we can prove it was freely given. You can withdraw it in Settings at any time, with the same one click, and every marketing message also carries an unsubscribe link. Withdrawing takes effect immediately and we keep no record that you were previously subscribed.
Service email is separate and is not marketing: messages about your own account, billing, security or a material change to these policies are sent regardless, because they are part of providing the service you asked for.
Retention and deletion
Your data is kept while your account is active. You can delete saved API credentials at any time in Settings. You can request full deletion of your account and history at support@xhyzer.xyz and it will be honored.
Viewers
If a desk owner invites you as a read-only viewer, you can see that owner's portfolio analytics. Viewers never see anyone's API credentials.
Changes
This policy may be updated; material changes will be announced in the service.