Privacy Policy

Information used by this website

We store your name, email, password hash, account role/status and registration date. We record the terms and privacy versions accepted at registration.

If you use billing, we store invoices, subscription expiry, chosen payment network, receiving address at submission, uploaded screenshots, payment review notes and the verified transfer reference entered by the administrator. Screenshots may contain personal or financial details; crop unrelated information before uploading.

The public Contact Us form stores your name, email, subject, message, optional signed-in account ID, submission timestamp and admin review status. A hashed submission token prevents duplicate submissions. Authorized administrators can read these messages. We send an acknowledgement to the email address you submit.

If you contact support, we store query subjects, categories, messages, senders, timestamps and case status. Do not include passwords, API tokens, private keys or wallet seed phrases.

Paper-trading simulation records

We store your separate virtual balance, paper-copy opt-in setting, paper trades and expiry observations, daily paper-loss budgets and copy-skipping reasons. These records help test master trading and copy controls. They are not Deriv transactions and are never used to calculate profit-share invoices. Paper balances are not money held for you.

Why we use this information

Account information lets us provide login and the customer workspace. Billing records support payment verification and access decisions. Messages let us investigate and reply to your queries. Audit records support security checks, rate limiting and review of administrator actions.

If you choose Connect Deriv, we redirect you to Deriv for sign-in and consent, then exchange a temporary authorization code on our server. We do not collect your Deriv password. The server session temporarily holds an access token, its expiry, the demo-account IDs, currencies and balance snapshots returned by Deriv, and your selected demo account. This release uses those details for connection testing and does not execute trades.

Cookies, logging and access

The application uses a session cookie to keep you signed in and protect account actions. It does not include advertising trackers in this build. Your browser or hosting provider may maintain separate logs; the operator must review those services before deployment.

Login, registration and contact-form rate-limit records contain a hash of the request IP or email identifier. Hosting logs may separately contain IP addresses. Authorized administrators can review account, payment, support and public contact records. Other customers cannot read your private queries or payment screenshots.

Service email notifications

We use your email address for registration acknowledgements, payment status updates, support updates, contact acknowledgements and subscription renewal reminders. A private delivery queue stores the recipient, message, delivery status and retry count. Successful queue records are removed after 30 days by the scheduled mail task; pending and failed messages remain for operator review. Our configured SMTP provider processes recipients and message content to deliver these service emails. These messages are not marketing subscriptions, and an acknowledgement does not verify ownership of the submitted address.

Third-party services

The research worker receives public market prices from Deriv. It does not send your support messages or payment screenshots to Deriv. Opening a Deriv affiliate link or choosing Connect Deriv takes you to a separate service with its own privacy terms. Account linking sends our application ID, callback address and requested Trade permission to Deriv; authorized account-list requests use a server-held access token.

The hosting and database services selected by the operator may process stored website information. Their identities, locations and any relevant international-transfer arrangements must be documented for the public deployment.

Retention and requests

Account-linking data is held only in your server session in this release. Authorization codes and tokens are not written to the application database or deliberately logged by our linking code. Disconnect removes the local connection and pending sign-in requests; logout destroys the website session. Tokens expire and require reconnection. Server session files may remain until the hosting provider cleans them up, so the operator must configure secure session storage and cleanup. Disconnecting locally does not revoke the application permission in Deriv; you can revoke it there separately.

Account, billing, support, public contact, paper-simulation and audit records remain stored until reviewed and removed by the operator. This release does not automatically delete those records on a schedule. Retention periods must be selected for the deployed service and communicated before public use.

You can ask for access, correction, account closure or deletion by opening a privacy query. Requests are reviewed manually; records needed for an unresolved payment, dispute or applicable record-keeping obligation may need to be retained. The availability of particular rights depends on the rules that apply to your situation.

Security and updates

Passwords are stored as hashes. The application checks account permissions, protects form actions against cross-site requests, and restricts direct access to payment screenshot storage. Secure hosting and HTTPS are also required; no system can promise absolute security.

We will update this notice when the information we collect or the services we use change. Registration records identify the version acknowledged at the time of signup.

For privacy questions, visit Contact Us or submit a query with the Privacy category.