Privacy Notice — Closed Beta v1.0
DRAFT · Not approved for external beta
Version: closed-beta-v1.0-draft-2026-10-26 · Updated: 2026-10-26
No effective date is set. Operator details, address and legal terms require completion and separate approval.
Status and controller
DRAFT, version shown above; effective date NOT SET. REQUIRED BEFORE EXTERNAL LAUNCH: legal identity, address and authority of the adult controller/representative, legal contact and, where applicable, EU representative or data protection officer. Project contact for requests: jn840233@gmail.com. No complete GDPR compliance is asserted.
Data and purposes
The application stores account ID, name, email, verification state, password hash, session tokens/expiry and optional IP/user agent; access grants; document acknowledgments, 18+ confirmation and residence-country code; strategies, virtual portfolios/operations and risk evidence; deletion requests and minimal audit data. No birth date, passport or location tracking is requested. Purposes are access, research-tool operation, rights handling and abuse prevention.
Legal bases requiring approval
Candidates for legal assessment are necessary contract/pre-contract processing, documented security legitimate interests, applicable legal duties and separate freely given consent where genuinely optional. Reading this notice is not blanket consent. The actual controller must document the lawful basis per purpose and any legitimate-interest balancing before external participation. Marketing is not automatically enabled.
Recipients and transfers
The current application uses owner-managed PostgreSQL on the existing REG.RU VPS and REG.RU SMTP; hosting infrastructure, mail delivery and the recipient mailbox provider can process data. Binance receives public market requests from the server, not account records. No JexonMind AI provider or analytics/advertising SDK is configured. Exact provider entities, locations, DPAs, EU representation and any required international-transfer safeguards are UNCONFIRMED and block legal approval.
Cookies and technical records
Better Auth uses necessary secure, HttpOnly, SameSite session cookies on HTTPS, with a seven-day session lifetime; session cookie caching is disabled. The language preference cookie is set on explicit language selection for up to one year. No optional advertising/analytics tracking has been found in this version. Any future non-essential device access must be assessed for prior consent, including applicable TDDDG requirements. Application/auth logging is restricted; infrastructure and mail systems may still keep technical records.
Retention
Expiry is not the same as physical deletion. Proposed targets for approval are technical logs up to 30 days, research feedback up to 90 days after research, and backup rotation up to 30 days. Account/history lifecycle, acknowledgment evidence, erasure records and lawful exceptions require separate documented decisions. These targets are not claimed to be legally approved or fully automatic today; the technical retention matrix states the actual mechanisms and gaps.
Access, export and erasure
Profile provides a machine-readable own-account export in bounded parts, excluding passwords, tokens and verification secrets. Keep all parts; concurrent changes can affect later pages. A deletion request requires identity review and handling of related records; submitting it is not a promise of instant destruction of all copies. Mailboxes, infrastructure records and backups require separate handling. Restoring backups must reconcile completed erasures before returning a database to service.
Your rights and security
Where applicable, request access, correction, erasure, restriction, portability or objection; withdraw optional consent for future processing without changing prior lawful processing. You may complain to a competent data-protection supervisory authority. Contact the project address; identity may need to be confirmed without sending passwords or unnecessary documents. Access control, hashing, protected sessions and backups reduce risk but do not guarantee absolute security. No model makes live trading or other real-money decisions here.