Privacy Policy

Tradefend LLC ("Tradefend", "we", "us") operates the Tradefend website, terminal and connectors, and is the data controller for the personal data described in this policy.

1. What we collect

• Account data: your email address, Terminal ID (FX-number), display name, time zone and a salted hash of your password (we never store the password itself).
• Trading data: the read-only stream from your connected trading account — balance, equity, open positions, orders and account history needed to compute your rules and equity curve. Connections run hosted on Tradefend-operated machines.
• Hosted connection sign-ins: the platform sign-in you submit through the connect flow is encrypted in your browser (RSA-4096 + AES-256-GCM to an offline operations key) before it reaches us. Our web server stores only the sealed copy, which it cannot read; it is opened solely on our operations machines to place and maintain your connection, retained while your account is hosted, and deleted when you disconnect.
• Platform OAuth tokens: where a platform supports token-based access (e.g. cTrader), we hold a revocable access token instead of any password, stored encrypted at rest on our servers — you can withdraw it at any time from the platform's own security page.
• Connector keys: API keys created for your account are stored encrypted at rest and are revocable by you at any time from your profile.
• Billing data: handled by our payment processor; we do not store card numbers.
• Technical logs: standard server logs (IP address, timestamps) kept for security and abuse prevention.

2. What we do with it

We use your data to run the terminal: compute rule compliance, render your equity curve, deliver alerts, execute a Breach Guard instruction if you armed one, provide support and bill your subscription. That's the whole list.

3. What we never do

We do not sell your data. We do not share your trading data with prop firms, brokers, advertisers or anyone else, except service providers strictly necessary to operate the Service — hosting, payment processing, email delivery, AI-assisted support tooling operating under our instructions, and messaging (Telegram) where you opt in — or where required by law.

4. Communications

We send service email (onboarding, support and account notices) and rule-change digests — a next-morning notice when a firm you hold accounts with changes a rule, and a weekly roundup. Every digest carries a one-click unsubscribe, and you can manage digest preferences from your profile. Support and onboarding correspondence may be drafted with the assistance of automated systems and is subject to human oversight.

5. Cookies and analytics

The terminal uses essential session cookies only — no advertising or cross-site tracking cookies. The marketing site carries no third-party ad-tech.

6. Security

Passwords are stored as salted PBKDF2 hashes; connector keys and platform tokens are encrypted at rest with authenticated encryption, with the decryption key held outside the database — so a copy of the database alone is unreadable; hosted sign-ins are sealed with public-key encryption in your browser and cannot be read by our web server; transport is TLS everywhere; connector access is read-only by architecture — the sole exception is the optional Breach Guard which, only if you arm it, can submit position-closing orders on the connected account. No system is perfectly secure, but we designed Tradefend so the data we hold is the minimum needed to do the job.

7. Retention and deletion

Account and trading data are kept while your account is active. Email support@tradefend.com from your account email to request export or deletion; we delete within 30 days, except records we must keep for legal or billing reasons.

8. Children

The Service is not directed at anyone under 18.

9. Changes

Material changes to this policy will be announced by email or in-app before they take effect.

10. Contact

support@tradefend.com