Privacy Policy

Last updated: 2026-07-23

This Privacy Policy explains how VelaDeck (“we”, “us”) collects, uses and protects information when you use the Service.

1. Information we collect

• Account: email address and hashed password.
• Brokerage link: the OAuth access and refresh tokens Alpaca issues after you authorize the connection, stored encrypted at rest. We do not receive or store your Alpaca password.
• Strategy subscriptions: which strategies you follow and the allocation percentage you assigned to each.
• Execution logs: orders submitted on your behalf, their status, and metadata returned by Alpaca (order id, ticker, notional, timestamps).
• Operational logs: server logs (IP, user agent, request paths, timestamps) for security and debugging.

2. How we use it

• To operate the Service: pull strategy compositions, generate signals, submit orders to Alpaca, and surface results in your dashboard.
• To notify you about signals via WhatsApp if you have opted in.
• To detect abuse, prevent fraud, and diagnose issues.

3. What we do not do

• We do not sell your data to third parties.
• We do not use your data for advertising or profiling.
• We do not access, withdraw, or transfer funds from your Alpaca account. The OAuth scopes we request cover trading and account introspection only.

4. Third parties

• Alpaca Securities LLC — broker and execution venue. Their privacy practices apply to your brokerage account data.
• Upstream data provider — source of strategy composition and performance data. We do not share your personal data with them.
• Cloudflare — edge network and TLS. Standard request metadata may be logged by Cloudflare.

5. Data retention

We keep account and execution data while your account is active. You can delete your account at any time; on deletion we remove personally-identifying data within 30 days and revoke stored OAuth tokens.

6. Security

Tokens are encrypted with a symmetric key stored server-side. Traffic is TLS-only. Access to the production environment is restricted. Nevertheless, no method of transmission or storage is 100% secure, and you use the Service at your own risk.

7. Children

The Service is not directed to individuals under 18.

8. Changes

We may update this policy from time to time. Material changes will be communicated via the Service or by email.

9. Contact

Reach us at [email protected].