Privacy Policy
1. Data controller
VaulTrade Replay is the controller of the data we collect through this platform. You can reach us at support@vaultrade.xyz for any question about your data.
2. What data we collect
| Data | What for |
|---|---|
| Name and email address | Create your account, log you in, send you notices (verification, password recovery). |
| Password | Always stored encrypted (scrypt hash); never in plain text — not even we can read it. |
| Practice data (simulated accounts, trades, sessions) | Show you your own history, stats and results curve. |
| Language and theme preference | Remember how you like to view the platform. |
| IP address of every visit (processed as an irreversible hash, never stored raw) | Security, abuse prevention and limiting login attempts. |
| IP address and browser of every login (this one stored raw, not as a hash) | So you can see where your account has been accessed from and we can detect unauthorized access. Only your last 20 logins are kept; older ones are deleted automatically. |
| Pages visited, browser and referrer | Internal usage statistics for the platform (never shared with ad networks). |
| Subscription data (if you sign up for the Pro plan) | Manage your paid subscription. Card details are entered directly into our payment processor's (Stripe) own form and never pass through our servers or get stored by us. |
3. Legal basis and purpose
- Contract performance: creating and managing your account, providing the service you requested, and remembering your language and theme preference so the platform works the way you expect.
- Legitimate interest: platform security (limiting brute force, detecting abuse, recording which IP accessed each account so unauthorized access can be detected) and internal usage statistics to improve the product. You can object to this specific processing by writing to us (see section 7).
- Consent: for any non-essential cookies or preferences, should we add any in the future.
4. Cookies and local storage
We use a session cookie (strictly necessary to keep you logged in) and a language cookie. We also store your theme preference (light/dark) in your browser's local storage, which never leaves your device. None of these cookies are used for advertising or cross-site tracking. We do not use Google Analytics or any third-party analytics or advertising tool.
5. Who we share data with
We don't sell or share your data with third parties for commercial purposes. We share limited data with:
- Resend (based in the US) — for transactional emails (account verification, password reset). It receives your email address and the message content. As a provider outside the European Economic Area, this involves an international data transfer, covered by two mechanisms: Resend is self-certified under the EU-U.S. Data Privacy Framework, the adequacy decision recognized by the European Commission, and its contract additionally incorporates the EU Standard Contractual Clauses (Module 2, controller-to-processor) as a backup.
- Stripe (if you sign up for the Pro plan; contracted through Stripe Payments Europe, Ltd., based in Ireland/EU) — payment processing and subscription management. It receives your name, email address, and the payment details you enter directly into its own form (these never pass through our servers). When processing involves Stripe vendors outside the European Economic Area, Stripe applies its own safeguards (self-certification under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses as a backup).
6. How long we keep your data
We keep your account data while your account is active. You can delete your own account at any time from your settings page: once you confirm it with your password, your profile, practice accounts, trades and history are deleted immediately, unless the law requires us to retain a specific record for longer.
7. Your rights
As an EU user, you have the right to access, rectify, erase, restrict processing, object to, and request portability of your data. You can exercise these rights by writing to support@vaultrade.xyz, or change your name, email, password, and delete your account, directly from your settings page. If you believe we haven't handled your request properly, you also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es, or your local supervisory authority.
8. Security
Passwords are stored with scrypt (salted hash, resistant to brute force), connections use HTTPS in production, and we rate-limit login and registration attempts to make automated attacks harder.
9. Minors
This service is not directed at anyone under 18, and we do not knowingly collect data from minors.
10. Changes to this policy
If we make a material change to this policy, we'll notify you by email or with a notice on the platform.